CompTIA CAS-001 問題集

質問 1：
A large enterprise is expanding through the acquisition of a second corporation. Which of the following should be undertaken FIRST before connecting the networks of the newly formed entity?
A. Implement a firewall/DMZ system between the networks.
B. Develop a risk analysis for the merged networks.
C. Conduct a complete review of the security posture of the acquired corporation.
D. A system and network scan to determine if all of the systems are secure.
正解：B

質問 2：
A system administrator needs to develop a policy for when an application server is no longer needed. Which of the following policies would need to be developed?
A. De-provisioning policy
B. Data retention policy
C. Provisioning policy
D. Backup policy
正解：B

質問 3：
The Information Security Officer (ISO) is reviewing new policies that have been recently made effective and now apply to the company. Upon review, the ISO identifies a new requirement to implement two-factor authentication on the company's wireless system. Due to budget constraints, the company will be unable to implement the requirement for the next two years. The ISO is required to submit a policy exception form to the Chief Information Officer (CIO). Which of the following are MOST important to include when submitting the exception form? (Select THREE).
A. Business or technical justification for not implementing the requirements.
B. Risks associated with the inability to implement the requirements.
C. Internal procedures that may justify a budget submission to implement the new requirement.
D. All section of the policy that may justify non-implementation of the requirements.
E. A revised DRP and COOP plan to the exception form.
F. Industry best practices with respect to the technical implementation of the current controls.
G. Current and planned controls to mitigate the risks.
正解：A,B,G

質問 4：
An employee was terminated and promptly escorted to their exit interview, after which the employee left the building. It was later discovered that this employee had started a consulting business using screen shots of their work at the company which included live customer data. This information had been removed through the use of a USB device. After this incident, it was determined a process review must be conducted to ensure this issue does not recur.
Which of the following business areas should primarily be involved in this discussion? (Select TWO).
A. IT Management
B. Human Resources
C. Database Administrator
D. Network Administrator
E. Finance
正解：A,B

質問 5：
Ann, a Physical Security Manager, is ready to replace all 50 analog surveillance cameras with IP cameras with built-in web management. Ann has several security guard desks on different networks that must be able to view the cameras without unauthorized people viewing the video as well. The selected IP camera vendor does not have the ability to authenticate users at the camera level. Which of the following should Ann suggest to BEST secure this environment?
A. Create an IP camera network and deploy NIPS to prevent unauthorized access.
B. Create an IP camera network and only allow SSL access to the cameras.
C. Create an IP camera network and restrict access to cameras from a single management host.
D. Create an IP camera network and deploy a proxy to authenticate users prior to accessing the cameras.
正解：D

質問 6：
The Chief Executive Officer (CEO) has asked the IT administrator to protect the externally facing web server from SQL injection attacks and ensure the backend database server is monitored for unusual behavior while enforcing rules to terminate unusual behavior. Which of the following would BEST meet the CEO's requirements?
A. UTM and NIDS
B. WAF and SIEM
C. WAF and DAM
D. DAM and SIEM
E. UTM and HSM
正解：C

質問 7：
A new internal network segmentation solution will be implemented into the enterprise that consists of 200 internal firewalls. As part of running a pilot exercise, it was determined that it takes three changes to deploy a new application onto the network before it is operational. Security now has a significant affect on overall availability. Which of the following would be the FIRST process to perform as a result of these findings?
A. Perform a cost benefit analysis and implement the solution as it stands as long as the risks are understood by the business owners around the availability issues. Decrease the current SLA expectations to match the new solution.
B. Engage internal auditors to perform a review of the project to determine why and how the project did not meet the security requirements. As part of the review ask them to review the control effectiveness.
C. Lower the SLA to a more tolerable level and perform a risk assessment to see if the solution could be met by another solution. Reuse the firewall infrastructure on other projects.
D. Review to determine if control effectiveness is in line with the complexity of the solution. Determine if the requirements can be met with a simpler solution.
正解：D

質問 8：
A forensic analyst receives a hard drive containing malware quarantined by the antivirus application. After creating an image and determining the directory location of the malware file, which of the following helps to determine when the system became infected?
A. The timeline analysis of the file system.
B. The time stamp of the malware in the swap file.
C. The malware file's modify, access, change time properties.
D. The date/time stamp of the malware detection in the antivirus logs.
正解：A