CompTIA Advanced Security Practitioner (CASP+): CAS-003

Given the following information about a company's internal network:

User IP space: 192.168.1.0/24

Server IP space: 192.168.192.0/25

A security engineer has been told that there are rogue websites hosted outside of the proper server space, and those websites need to be identified. Which of the following should the engineer do?

A. Use a protocol analyzer on 192.168.1.0/24

B. Use a port scanner on 192.168.1.0/24

C. Use an HTTP interceptor on 192.168.1.0/24

D. Use a port scanner on 192.168.192.0/25

E. Use a protocol analyzer on 192.168.192.0/25

F. Use an HTTP interceptor on 192.168.192.0/25

Following a complete outage of the electronic medical record system for more than 18 hours, the hospital's Chief Executive Officer (CEO) has requested that the Chief Information Security Officer (CISO) perform an investigation into the possibility of a disgruntled employee causing the outage maliciously. To begin the investigation, the CISO pulls all event logs and device configurations from the time of the outage. The CISO immediately notices the configuration of a top-ofrack switch from one day prior to the outage does not match the configuration that was in place at the time of the outage. However, none of the event logs show who changed the switch configuration, and seven people have the ability to change it. Because of this, the investigation is inconclusive.

Which of the following processes should be implemented to ensure this information is available for future investigations?

A. Asset inventory management

B. Incident response plan

C. Test and evaluation

D. Configuration and change management

Which of the following controls primarily detects abuse of privilege but does not prevent it?

A. Off-boarding

B. Separation of duties

C. Least privilege

D. Job rotation