CASP+ Pre-Assessment

Alice is an administrator who works in the finance department. She has clicked a link in an email that has executed unwanted actions in a web application she is using. What type of attack is this?

• XXS

• CSRF

• SQLi

• Buffer overflow

You are exploring the best option for your organization to move from a physical data center to virtual machines hosted on bare-metal servers. Which of the following is the BEST option for the move?

• Type 1 hypervisor

• Type 2 hypervisor

• iPaaS

• IaaS

You are looking for a replacement for POP3. Which of the following protocols offers advantages over POP3 for mobile users?

• HTTPS

• NTP

• IMAP

• SMTP

DNSSEC provides authority and data integrity. DNSSEC will not protect against which of the following?

• Spoofing

• Kiting/tasting

• Verification

• Masquerade

You have built an access control list for a router that is subject to PCI DSS. The ACL you have built contains four commands that deny HTTP, POP3, FTP, and Telnet. No traffic is coming through the router. What is the most likely reason?

• Traffic is dropped because of the "deny TCP any HTTP" statement.

• Traffic is dropped because of the "deny TCP any FTP" statement.

• Traffic is accepted but not forwarded to the proper location.

• There are no permit statements in the ACL

You are evaluating the security policy of a large enterprise. There are many elements and point of enforcement, including email and remote access systems. XML is the natural choice implemented with XML for a fine-grained, attribute-based access control?

• OASIS

• SAMLv2

• SOAP

• XACML

Using Microsoft Network Monitor, you have captured traffic on TCP port 23. Your security policy states that port 23 is not to be used. What client-server protocol is probably running over this port?

• SNMP

• Telnet

• PuTTY

• FTP

TCP is connection oriented, while UDP is connectionless. Which of these is NOT a valid header in a UDP packet?

• Source port

• Destination port

• Length

• Sequence number

You are having difficulties reaching tech support for a specific web application that has crashed. You have to find the agreement between your company and the provider. What is the document that requires a provider to maintain a certain level of support?

• NDA

• SLA

• MOU

• MTTR

Which of the following would be considered a detective and administrative control?

• Fences and gates

• IDS and honeypots

• IPS and antivirus

• Audit logs