CompTIA Advanced Security Practitioner Sample Questions:

1. A security audit has uncovered a lack of security controls with respect to employees' network account management. Specifically, the audit reveals that employee's network accounts are notdisabled in a timely manner once an employee departs the organization. The company policy states that the network account of an employee should be disabled within eight hours of termination. However, the audit shows that 5% of the accounts were not terminated until three days after a dismissed employee departs. Furthermore, 2% of the accounts are still active.
Which of the following is the BEST course of action that the security officer can take to avoid repeat audit findings?

A) Enforce the company policy by conducting monthly account reviews of inactive accounts.
B) Review the HR termination process and ask the software developers to review the identity management code.
C) Review the termination policy with the company managers to ensure prompt reporting of employee terminations.
D) Update the company policy to account for delays and unforeseen situations in account deactivation.

2. A high-tech company dealing with sensitive data seized the mobile device of an employee suspected of leaking company secrets to a competitive organization. Which of the following is the BEST order for mobile phone evidence extraction?

A) Evidence log, device isolation ,device identification, preparation to identify the necessary tools, data processing, verification of data accuracy, presentation and archival.
B) Device identification, evidence log, preparation to identify the necessary tools, data processing, verification of data accuracy, device isolation, documentation, reporting, presentation and archival.
C) Evidence intake, device identification, preparation to identify the necessary tools, device isolation, data processing, verification of data accuracy, documentation, reporting, presentation and archival.
D) Device isolation, evidence intake, device identification, data processing, verification of data accuracy, documentation, reporting, presentation and archival.

3. Which of the following BEST describes the implications of placing an IDS device inside or outside of the corporate firewall?

A) Placing the IDS device inside the firewall will allow it to monitor potential remote attacks but may increase the load on the system.
B) Placing the IDS device inside the firewall will allow it to monitor potential internal attacks but may increase the load on the system.
C) Placing the IDS device outside the firewall will allow it to monitor potential remote attacks but the firewall will not be able to block the attacks.
D) Placing the IDS device outside the firewall will allow it to monitor potential remote attacks while still allowing the firewall to block the attack.

4. A hosting company provides inexpensive guest virtual machines to low-margin customers. Customers manage their own guest virtual machines. Some customers want basic guarantees of logical separation from other customers and it has been indicated that some customers would like to have configuration control of this separation; whereas others want this provided as a value-added service by the hosting company. Which of the following BEST meets these requirements?

A) The hosting company should install a hypervisor-based firewall and allow customers to manage this on an as-needed basis.
B) The hosting company should install a host-based firewall on customer guest hosts and offer to administer host firewalls for customers if requested.
C) The hosting company should manage the hypervisor-based firewall; while allowing customers to configure their own host-based firewall.
D) Customers should purchase physical firewalls to protect their guest hosts and have the hosting company manage these if requested.

5. In developing a new computing lifecycle process for a large corporation, the security team is developing the process for decommissioning computing equipment. In order to reduce the potential for data leakage, which of the following should the team consider? (Select TWO).

A) Install of standard image
B) Erase all files on drive
C) Remove and hold all drives
D) Drive wipe
E) Physical destruction

Solutions: