CompTIA Advanced Security Practitioner Sample Questions:

1. Company XYZ provides cable television service to several regional areas. They are
currently installing fiber-to-the-home in many areas with hopes of also providing telephone and Internet services. The telephone and Internet services portions of the company will each be separate subsidiaries of the parent company. The board of directors wishes to keep the subsidiaries separate from the parent company. However all three companies must share customer data for the purposes of accounting, billing, and customer authentication. The solution must use open standards, and be simple and seamless for customers, while only sharing minimal data between the companies. Which of the following solutions is BEST suited for this scenario?

A) The companies should federate, with the parent becoming the IdP, and the subsidiaries becoming an SSP.
B) The companies should federate, with the parent becoming the ASP, and the subsidiaries becoming an IdP.
C) The companies should federate, with the parent becoming the SP, and the subsidiaries becoming an IdP.
D) The companies should federate, with the parent becoming the IdP, and the subsidiaries becoming an SP.

2. A corporation has expanded for the first time by integrating several newly acquired businesses.
Which of the following are the FIRST tasks that the security team should undertake? (Select TWO).

A) Remove acquired companies Internet access.
B) Install firewalls between the businesses.
C) Re-image all end user computers to a standard image.
D) Develop interconnection policy.
E) Conduct a risk analysis of each acquired company's networks.
F) Federate identity management systems.

3. SDLC is being used for the commissioning of a new platform. To provide an appropriate level of assurance the security requirements that were specified at the project origin need to be carried through to implementation. Which of the following would BEST help to determine if this occurred?

A) Requirements workshop
B) Secure code review and penetration test
C) Security requirements traceability matrix (SRTM)
D) Security development lifecycle (SDL)

4. An Association is preparing to upgrade their firewalls at five locations around the United States. Each of the three vendor's RFP responses is in-line with the security and other requirements. Which of the following should the security administrator do to ensure the firewall platform is appropriate for the Association?

A) Correlate current industry research with the RFP responses to ensure validity.
B) Create a lab environment to evaluate each of the three firewall platforms.
C) Benchmark each firewall platform's capabilities and experiences with similar sized companies.
D) Develop criteria and rate each firewall platform based on information in the RFP responses.

5. Continuous monitoring is a popular risk reduction technique in many large organizations with formal certification processes for IT projects. In order to implement continuous monitoring in an effective manner which of the following is correct?

A) All logs must be centrally managed and access to the logs restricted only to data storage staff.
B) Only security related alerts should be forwarded to the network team for resolution.
C) Critical logs must be monitored hourly and adequate staff must be assigned to the network team.
D) Logging must be set appropriately and alerts delivered to security staff in a timely manner.

Solutions: