CompTIA CAS-004 問題集

質問 1：
A security engineer has been informed by the firewall team that a specific Windows workstation is part of a command-and-control network. The only information the security engineer is receiving is that the traffic is occurring on a non-standard port (TCP 40322). Which of the following commands should the security engineer use FIRST to find the malicious process?
A. tcpdump
B. ipconfig
C. traceroute
D. tasklist
E. netstar
正解：E
解説: (Topexam メンバーにのみ表示されます)

質問 2：
A SIEM generated an alert after a third-party database administrator, who had recently been granted temporary access to the repository, accessed business-sensitive content in the database. The SIEM had generated similar alerts before this incident. Which of the following best explains the cause of the alert?
A. Database activity monitoring
B. Database decoy
C. Database field tokenization
D. Database integrity enforcement
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A company with customers in the United States and Europe wants to ensure its content is delivered to end users with low latency. Content includes both sensitive and public information. The company's data centers are located on the West Coast of the United States. Users on the East Coast of the United States and users in Europe are experiencing slow application response. Which of the following would allow the company to improve application response quickly?
A. Using colocation services in regions where the application response is slow
B. Implementing a CDN and forcing all traffic through the CDN
C. Installing reverse caching proxies in both data centers and implementing proxy auto scaling
D. Using HTTPS to serve sensitive content and HTTP for public content
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
An organization performed a risk assessment and discovered that less than 50% of its employees have been completing security awareness training. Which of the following should the ChiefInformation Security Officer highlight as an area of Increased vulnerability in a report to the management team?
A. Social engineering
B. APT targeting
C. Pivoting
D. Third-party compromise
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
An incident response team completed recovery from offline backup for several workstations. The workstations were subjected to a ransomware attack after users fell victim to a spear-phishing campaign, despite a robust training program. Which of the following questions should be considered during the lessons- learned phase to most likely reduce the risk of reoccurrence? (Select two).
A. What internal and external stakeholders need to be notified of the breach?
B. Are there opportunities for legal recourse against the originators of the spear-phishing campaign?
C. Which technical controls, if implemented, would provide defense when user training fails?
D. What measurable user behaviors were exhibited that contributed to the compromise?
E. Which user roles are most often targeted by spear phishing attacks?
F. Which methods can be implemented to increase speed of offline backup recovery?
正解：C,D

質問 6：
A Chief Information Officer is considering migrating all company data to the cloud to save money on expensive SAN storage.
Which of the following is a security concern that will MOST likely need to be addressed during migration?
A. Data exposure
B. Data dispersion
C. Latency
D. Data loss
正解：A
解説: (Topexam メンバーにのみ表示されます)