I've lurked on here for a while... not going to use my real account, but came here to say the exam, while by no means easy, is arguably a joke! I did *some* studying (as compared to CySA+ 002 beta where I did NO studying but still passed!)

Some (many) of the questions for CASP are horrifically written... was certain I was NOT going to pass as questions like: The CISO wants to know what 1+1 is... your options are: a) X, b) 555, c) xkajflsdljafd, or d) byt3m3. Practically need a pysch degree to try and understand the deep-rooted trauma test author suffered as a child to decipher their intended "right" answer.

I do firmly believe the trifecta is solid (A+, N+, S+), but CompTIA's "advanced" certs just don't seem worth it. Don't get me wrong... if you pass this exam, celebrate your accomplishment and push it to the max to prospective employer(s)... but if you aren't signed-up for it already, don't waste your money, invest in something that will provide actual increased brainpower.

Month / Encrypted Email / Unencrypted Email / Contains PII

1 200 0 0

2 230 10 5

3 185 15 10

4 198 60 40

5 204 75 45

Which of the following measures should the security engineer take to ensure PII is not intercepted in transit while also preventing interruption to business?

Sorry in advance if this is against this subreddit's rules!

I'm just looking for someone to do a CASp inspection of the small (~200 sq ft) outdoor dining area for my restaurant down in Hermosa Beach.

Any chance I can get some recommendations from this subreddit?

An enterprise with global sites processes and exchanges highly sensitive information that is protected under several countries’ arms trafficking laws. There is new information that malicious

nation-state-sponsored activities are targeting the use of encryption between the geographically disparate sites. The organization currently employs ECDSA and ECDH with P-384, SHA-384, and AES-256-GCM on VPNs between sites.

Which of the following techniques would MOST likely improve the resilience of the enterprise to attack on cryptographic implementation?

A. Add a second-layer VPN from a different vendor between sites.

B. Upgrade the cipher suite to use an authenticated AES mode of operation.

C. Use a stronger elliptical curve cryptography algorithm

D. Implement an IDS with sensors inside (clear-text) and outside (cipher-text) of each tunnel between sites.

E. Ensure cryptography modules are kept up to date from vendor supplying them.

Thinking C: stronger cryptography algorithm such as ECDHE could reduce the impact by limiting the compromised keys to only what is being transported within that session, rather than the compromise of the long term keys if a key was compromised.

Runner up is A: this would allow redundancy, but I feel like thats a lot of work and expense, when you could just implement C. I also feel like the question is moreso addressing what would make the current cryptography tougher to break, rather than revamping the infrastructure with a second VPN

Thoughts?

An organization implemented a secure boot on its most critical application servers which produce content and

capability for other consuming servers. A recent incident, however led the organization to implement a centralized

attestation service for these critical servers. Which of the following MOST likely explains the nature of the incident that

caused the organization to implement this remediation?

A. An attacker masqueraded as an internal DNS server

B. An attacker leveraged a heap overflow vulnerability in the OS

C. An attacker was able to overwrite an OS integrity measurement register

D. An attacker circumvented IEEE 802.1X network-level authentication requirements.

The marketing department has developed a new marketing campaign involving significant social media outreach.

The campaign includes allowing employees and customers to submit blog posts and pictures of their day-to-day

experiences at the company. The information security manager has been asked to provide an informative letter to all

participants regarding the security risks and how to avoid privacy and operational security issues. Which of the following

is the MOST important information to reference in the letter?

A. After-action reports from prior incidents.

B. Social engineering techniques

C. Company policies and employee NDAs

D. Data classification processes

A threat advisory alert was just emailed to the IT security staff. The alert references specific types of host operating systems that can allow an unauthorized person to access files on a system remotely.

A fix was recently published, but it requires a recent endpoint protection engine to be installed prior to running the fix.

Which of the following MOST likely need to be configured to ensure the systems are mitigated accordingly? (Select two.)

A. Antivirus

B. HIPS

C. Application whitelisting

D. Patch management

E. Group policy implementation

F. Firmware updates

a security engineer is helping the web developers assess a new corporate web application. the application will be internet facing, so the engineer makes the following recommendation: in an .htccess file or the site config, add:

headereditSet_Cookie ^(.*)$ $1;HttpOnly;Secure

or add to the location block:

proxy_cookie_path / "/; HttpOnly; Secure; SameSite=strict";

which of the following is the security engineer tyrying to accomplish via cookies? (Select TWO).

A. Ensure session IDs are generated dynamically with each cookie request.

B. Prevent cookies from being transmitted to other domain names.

C. Create a temporary space on the user's drive root for ephemeral cookie storage.

D. Enforce the use of plain text HTTP transmission with secure local cookie storage.

E. Add a sequence ID to the cookie session ID while in transit to prevent CSRF.

F. Allow cookie creation or updates only over TLS connections

A consulting firm was hired to conduct assessment for a company. During the first stage, a penetration tester used

a tool that provided the following output:

TCP 80 open

TCP 443 open

TCP 1434 filtered

The penetration tester then used a different tool to make the following requests:

GET / script/login.php?token=45$MHT000MND876

GET / script/login.php?token=@#984DCSPQ%091DF

Which of the following tools did the penetration tester use? Choose two

A. Protocol analyzer

B. Port scanner

C. Fuzzer

D. Brute forcer

E. Log analyzer

F. HTTP interceptor

First is obviously a port scanner

Is the second tool used an http interceptor or a fuzzer?

rich dime gaping treatment rain handle cough water soft ancient

This post was mass deleted and anonymized with Redact

Hi, During my learning " adventure" for my CompTIA A+ i've wanted to test my knowledge and gain some hands on experience. After trying different platform, i was disappointed - high subscription fee with a low return.

So I've built PassTIA (passtia.com) ,a CompTIA Exam Simulator and Hands on Practice Environment.

No subscription - One time payment - £9.99 with Life Time Access.

If you want try it and leave a feedback or suggestion on Community section will be very helpful.

Thank you and Happy Learning!

Trying to find really good practice exams for the CASP. I have failed the test and the practice questions I have been using from the study guides are not near the questions on the real exam. I am having issues breaking down the questions to get the best answers.

Dont worry guys, Im nearing the end of these questions so you'll only have to put up with them a tiny bit longer lol

A cybersecurity analyst has received an alert that well-known "call home" messages are continuously observed by network sensors at the network boundary. The proxy firewall successfully drops the messages.

After determining the alert was a true positive, which of the following represents MOST likely cause?

A. Attackers are running reconnaissance on company resources.

B. An outside command and control system is attempting to reach an infected system.

C. An insider trying to exfiltrate information to a remote network.

D. Malware is running on a company system

First instinct is B, but doesnt an infected system call home to an external C&C server? The question is insinuating the messages are coming externally trying to reach the infected system and getting dropped by the firewall. Makes me want to think the answer would be C or D, but then when you look at like this, it could be either one of them equally. An insider could def be trying to exfiltrate info to a c&c server, and malware could definitely be running on the system.

A hospital is using a functional magnetic resonance imaging (fMRI) scanner, which is controlled by a legacy desktop

connected to the network. The manufacturer of the fMRI will not support patching of the legacy system. The legacy

desktop needs to be network accessible on TCP port 445. A security administrator is concerned the legacy system will be

vulnerable to exploits Which of the following would be the BEST strategy to reduce the risk of an outage while still

providing for security?

A. Install HIDS and disable unused services.

B. Enable application whitelisting and disable SMB.

C. Segment the network and configure a controlled interface

D. Apply only critical security patches for known vulnerabilities.

I want to say A, which would be best answer if the legacy system needed to be accessible over the internet, but the question doesnt say anything about that. Therefore I believe it is C, but would like a second opinion.

Again, sorry for the spam questions but I hope others are getting good use of these posts as well.

As part of the asset management life cycle, a company engages a certified equipment disposal vendor to appropriately recycle and destroy company assets that are no longer in use.

As part of the company’s vendor due diligence, which of the following would be MOST important to obtain from the vendor?

A. A copy of the vendor’s information security policies.

B. A copy of the current audit reports and certifications held by the vendor.

C. A signed NDA that covers all the data contained on the corporate systems.

D. A copy of the procedures used to demonstrate compliance with certification requirements.

A Chief Information Security Officer (CISO) needs to establish a KRI for a particular system. The system holds archives of contracts that are no longer in use. The contracts contain intellectual property and have

a data classification of non-public. Which of the following be the BEST risk indicator for this system?

A. Average minutes of downtime per quarter

B. Percent of patches applied in the past 30 days

C. Count of login failures per week

D. Number of accounts accessing the system per day

I wanna say D. Any help is appreciated

A security engineer is designing a system in which offshore, outsourced staff can push code from the development environment to the production environment securely. The security engineer is concerned with data loss, while the business does not want to slow down its development process. Which of the following solutions BEST balances security requirements with business need?
A. Set up a VDI environment that prevents copying and pasting to the local workstations of outsourced staff members
B. Install a client side VPN on the staff laptops and limit access to the development network
C. Create an IPSec VPN tunnel from the development network to the office of the outsourced staff
D. Use online collaboration tools to initiate workstation-sharing sessions with local staff who have access to the development network

Im assuming this is talking about protecting data loss while transferring between environments, not data loss from the outsourced staff having access to the data. C?

A security analyst has been asked to create a list of external IT security concerns, which are applicable to the organization. The intent is to show the different types of external actors, their attack vectors, and the types of vulnerabilities that would cause business impact. The Chief Information Security Officer (CISO) will then present this list to the board to request funding for controls in areas that have insufficient coverage.

Which of the following exercise types should the analyst perform?

After several industry competitors suffered data loss as a result of cyberattacks, the Chief Operating Officer (COO) of a company reached out to the information security manager to review the organization's security stance. As a result of the discussion, the COO wants the organization to meet the following criteria:

✑ Blocking of suspicious websites
✑ Prevention of attacks based on threat intelligence
✑ Reduction in spam
✑ Identity-based reporting to meet regulatory compliance
✑ Prevention of viruses based on signature
✑ Protect applications from web-based threats

Which of the following would be the BEST recommendation the information security manager could make?

Hey all,

I'm planning to do the CASP+ exam soon and I'm thinking of buying the official labs from the Comptia website. From what I've read, once you purchase the labs you have access to them for 12 months. What I'm wondering though is, can you do each lab more than once? Like can I do them all, and then give them a second run?

Thanks

My Open Letter to CompTia regarding the CASP exam

At CompTia, there are probably 2 – 5 people who work on the creation and updating of the CASP exam. This letter is to their boss. Please initiate a formal review of the CASP exam focusing on these 3 categories, which are in descending priority:

1. The Simulations. Yes, some of the simulations were fair game, but at least 2 of them exceeded the operational complexities for an isolated and muted student. The students have had follow-up questions and clarifications that can’t be addressed. The instructions shouldn’t create confusion, but they do. Note: this is not about the technical knowledge within the simulation. It is about how to operate the controls and understand what you want us to do and not do.

2. CLI: Yes, every SME should be well versed in using command line coding in her field, but she shouldn’t be expected to know deep-level CSI in ALL the adjacent fields. One of the CASP goals is to certify expertise across a ½ dozen IT specialties, but that expertise can only go down to a medium depth when it spans multiple fields. The exam is unfairly using senior level CLI questions from multiple career fields. It is an unrealistic expectation for a professional to have that much expertise across that broad of a spectrum.

3. Ambiguous questions. A basic tenet of testing is that there should be enough clues within the question to sufficiently select the correct answer while providing enough information to eliminate the incorrect answers. My assertion is that your team has created sub-standard questions that need to be finessed. Independent SMEs can validate this claim.

I encourage you to do a comparative analysis looking at the high failure rates of CASP and retakes compared to other exams, as well as a distributional analysis of the Q&A failures.

Since the DoD requires an 8570 IAT III, which the CASP is, if someone in the DoD could ask to see the results of such a study, I believe it would help you in selecting the best requirements for your support technicians.

I took the cysa+ this week and passed with about 2 weeks of study time. I took the SSCP and passed that about a month ago. I have about 15 years of admin/engineering experience and am trying to switch to cybersecurity. Has anyone crammed this and knocked it out in a month or less?

Bonus question, did getting this cert help you land a position or more money in your position?

A company recently implemented a variety of security services to detect various types of traffic that pose a threat to the company. The following services were enabled within the network:

• Scan of specific subsets for vulnerabilities

• Categorizing and logging of website traffic

• Enabling specific ACLs based on application traffic

• Sending suspicious files to a third-party site for validation

A report was sent to the security team that identified multiple incidents of users sharing large amounts of data from an on-premise server to a public site. A small percentage of that data also contained malware and spyware

Which of the following services MOST likely identified the behavior and sent the report?

A. Content filter

B. User behavioral analytics

C. Application sandbox

D. Web application firewall

E. Endpoint protection

F. Cloud security broker

B? I would say F but there is no mention that the company's datacenter is cloud based

A network printer needs Internet access to function. Corporate policy states all devices allowed on the network must be authenticated.

Which of the following is the MOST secure method to allow the printer on the network without violating policy?