CompTIA CAS-001 問題集

質問 1：
A security analyst is tasked to create an executive briefing, which explains the activity and motivation of a cyber adversary. Which of the following is the MOST important content for the brief for management personnel to understand?
A. Threat actor types, threat actor motivation, and the attack impact
B. Threat actor types, attack sophistication, and the anatomy of an attack
C. Unsophisticated agents, organized groups, and nation states
D. Threat actor types, threat actor motivation, and attack tools
正解：A

質問 2：
A corporate executive lost their smartphone while on an overseas business trip. The phone was equipped with file encryption and secured with a strong passphrase. The phone contained over 60GB of proprietary data. Given this scenario, which of the following is the BEST course of action?
A. Have the executive change all passwords and issue the executive a new phone.
B. Immediately implement a plan to remotely wipe all data from the device.
C. File an insurance claim and assure the executive the data is secure because it is encrypted.
D. Execute a plan to remotely disable the device and report the loss to the police.
正解：B

質問 3：
Company A is purchasing Company B, and will import all of Company B's users into its authentication system. Company A uses 802.1x with a RADIUS server, while Company B uses a captive SSL portal with an LDAP backend. Which of the following is the BEST way to integrate these two networks?
A. Enable RADIUS and end point security on Company B's network devices.
B. Enable 802.1x on Company B's network devices.
C. Enable LDAP authentication on Company A's network devices.
D. Enable LDAP/TLS authentication on Company A's network devices.
正解：B

質問 4：
An internal committee comprised of the facilities manager, the physical security manager, the network administrator, and a member of the executive team has been formed to address a recent breach at a company's data center. It was discovered that during the breach, an HVAC specialist had gained entry to an area that contained server farms holding sensitive financial data. Although the HVAC specialist was there to fix a legitimate issue, the investigation concluded security be provided for the two entry and exit points for the server farm. Which of the following should be implemented to accomplish the recommendations of the investigation?
A. Implement a policy that all non-employees should be escorted in the data center.
B. Hire an HVAC person for the company, eliminating the need for external HVAC people.
C. Implement CCTV cameras at both points.
D. Place a mantrap at the points with biometric security.
正解：D

質問 5：
A data breach occurred which impacted the HR and payroll system. It is believed that an attack from within the organization resulted in the data breach. Which of the following should be performed FIRST after the data breach occurred?
A. Review NIDS logs
B. Conduct a business impact analysis
C. Assess system status
D. Restore from backup tapes
正解：C

質問 6：
The new security policy states that only authorized software will be allowed on the corporate network and all personally owned equipment needs to be configured by the IT security staff before being allowed on the network. The security administrator creates standard images with all the required software and proper security controls. These images are required to be loaded on all personally owned equipment prior to connecting to the corporate network. These measures ensure compliance with the new security policy. Which of the following security risks still needs to be addressed in this scenario?
A. An employee connecting their personal laptop to use a non-company endorsed accounting application that the employee used at a previous company.
B. An employee using a corporate FTP application to transfer customer lists and other proprietary files to an external computer and selling them to a competitor.
C. An employee accidentally infecting the network with a virus by connecting a USB drive to the employee's personal laptop.
D. An employee copying gigabytes of personal video files from the employee's personal laptop to their company desktop to share files.
正解：B

質問 7：
The security administrator is receiving numerous alerts from the internal IDS of a possible Conficker infection spreading through the network via the Windows file sharing services. Given the size of the company which deploys over 20,000 workstations and 1,000 servers, the security engineer believes that the best course of action is to block the file sharing service across the organization by placing ACLs on the internal routers.
Which of the following should the security administrator do before applying the ACL?
A. Quickly research best practices with respect to stopping Conficker infections and implement the solution.
B. Consult with the rest of the security team and get approval on the solution by all the team members and the team manager.
C. Apply the ACL immediately since this is an emergency that could lead to a widespread data compromise.
D. Call an emergency change management meeting to ensure the ACL will not impact core business functions.
正解：D

質問 8：
A system designer needs to factor in CIA requirements for a new SAN. Which of the CIA requirements is BEST met by multipathing?
A. Integrity
B. Availability
C. Confidentiality
D. Authentication
正解：B