CompTIA Advanced Security Practitioner (CASP+): CAS-004

An analyst is evaluating the security of a web application that does not hold sensitive or financial data. The application requires users to have a minimum password length of 12 characters. One of the characters must be capitalized, and one must be a number. To reset the password, the user is asked to provide the birthplace, birthdate, and mother's maiden name. When all of these are entered correctly, a new password is emailed to the user. Which of the following should concern the analyst the MOST?

A. The security answers may be determined via online reconnaissance.

B. The password is too long, which may encourage users to write the password down.

C. The password should include a special character.

D. The minimum password length is too short.

A security technician is trying to connect a remote site to the central office over a site-to-site VPN. The technician has verified the source and destination IP addresses are correct, but the technician is unable to get the remote site to connect. The following error message keeps repeating:

An error has occurred during Phase 1 handshake. Deleting keys and retrying...

Which of the following is most likely the reason the connection is failing?

A. The IKE hashing algorithm uses different key lengths on each VPN device.

B. The IPSec settings allow more than one cipher suite on both devices.

C. The Diffie-Hellman group on both sides matches but is a legacy group.

D. The remote VPN is attempting to connect with a protocol other than SSL/TLS.

A security architect is reviewing the following organizational specifications for a new application:

1.

Be sessionless and API-based

2.

Accept uploaded documents with PII, so all storage must be ephemeral

3.

Be able to scale on-demand across multiple nodes

4.

Restrict all network access except for the TLS port

Which of the following ways should the architect recommend the application be deployed in order to meet security and organizational infrastructure requirements?

A. Utilizing the cloud container service

B. On server instances with autoscaling groups

C. Using scripted delivery

D. With a content delivery network