CAS-002 무료 덤프문제 온라인 액세스

The audit department at a company requires proof of exploitation when conducting internal network penetration tests. Which of the following provides the MOST conclusive proof of compromise without further compromising the integrity of the system?

• A.Take a packet capture of the test activity.
• B.Add a new test user account on the system.
• C.Provide a list of grabbed service banners.
• D.Modify a file on the system and include the path in the test's report.

A web developer is responsible for a simple web application that books holiday accommodations. The front-facing web server offers an HTML form, which asks for a user's age. This input gets placed into a signed integer variable and is then checked to ensure that the user is in the adult age range.
Users have reported that the website is not functioning correctly. The web developer has inspected log files and sees that a very large number (in the billions) was submitted just before the issue started occurring. Which of the following is the MOST likely situation that has occurred?

• A.Computers are able to store numbers well above "billions" in size. Therefore, the website issues are not related to the large number being input.
• B.The application has crashed because a very large integer has led to a "divide by zero". Improper error handling prevented the application from recovering.
• C.The age variable has had an integer overflow and was assigned a very small negative number which led to unpredictable application behavior. Improper error handling prevented the application from recovering.
• D.The age variable stored the large number and filled up disk space which stopped the application from continuing to function. Improper error handling prevented the application from recovering.

A security consultant is investigating acts of corporate espionage within an organization.
Each time the organization releases confidential information to high-ranking engineers, the information is soon leaked to competing companies. Which of the following techniques should the consultant use to discover the source of the information leaks?

• A.Enforce non-disclosure agreements
• B.Digital rights management
• C.Digital watermarking
• D.Steganography

An administrator attempts to install the package "named.9.3.6-12-x86_64.rpm" on a server.
Even though the package was downloaded from the official repository, the server states the package cannot be installed because no GPG key is found. Which of the following should the administrator perform to allow the program to be installed?

• A.Generate RSA and DSA keys using GPG.
• B.Import the repository's public key.
• C.Download the file from the program publisher's website.
• D.Run sha1sum and verify the hash.

New zero-day attacks are announced on a regular basis against a broad range of technology systems. Which of the following best practices should a security manager do to manage the risks of these attack vectors? (Select TWO).

• A.Create an inventory of applications.
• B.Backup the router and firewall configurations.
• C.Establish an emergency response call tree.
• D.Update all network diagrams.
• E.Maintain a list of critical systems.