CompTIA CAS-005 問題集

質問 1：
A security officer performs due diligence activities before implementing a third-party solution into the enterprise environment. The security officer needs evidence from the third party that a data subject access request handling process is in place. Which of the following is the security officer most likely seeking to maintain compliance?
A. Information security standards
B. Privacy regulations
C. E-discovery requirements
D. Reporting frameworks
E. Certification requirements
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
A company isolated its OT systems from other areas of the corporate network These systems are required to report usage information over the internet to the vendor Which oi the following b*st reduces the risk of compromise or sabotage' (Select two).
A. Performing boot Integrity checks
B. Implementing a site-to-site IPSec VPN
C. Implementing allow lists
D. Executing daily health checks
E. Monitoring network behavior
F. Encrypting data at rest
正解：B,C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A compliance officer isfacilitating abusiness impact analysis (BIA)and wantsbusiness unit leadersto collect meaningful data. Several business unit leaders want more information about the types of data the officer needs.
Which of the following data types would be the most beneficial for the compliance officer?(Select two)
A. Critical processes
B. Contingency plans
C. Network diagrams
D. Inventory details
E. Applicable contract obligations
F. Costs associated with downtime
正解：A,E,F
解説: (Topexam メンバーにのみ表示されます)

質問 4：
An organization is implementing advanced security controls associated with the execution of software applications on corporate endpoints. The organization must implement a deny-all, permit-by-exception approach to software authorization for all systems regardless of OS. Which of the following should be implemented to meet these requirements?
A. Atomic execution
B. Block list
C. SELinux
D. XDR
E. MDM
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
A web application server that provides services to hybrid modern and legacy financial applications recently underwent a scheduled upgrade to update common libraries, including OpenSSL. Multiple users are now reporting failed connection attempts to the server. The technician performing initial triage identified the following:
* Client applications more than five years old appear to be the most affected.
* Web server logs show initial connection attempts by affected hosts.
* For the failed connections, logs indicate "cipher unavailable."
Which of the following is most likely to safely remediate this situation?
A. The server needs to be configured for backward compatibility to SSL 3.0 applications.
B. The client applications need to be modified to support AES in Galois/Counter Mode or equivalent.
C. The server-side digital signature algorithm needs to be modified to support elliptic curve cryptography.
D. The client TLS configuration must be set to enforce electronic codebook modes of operation.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A company wants to implement hardware security key authentication for accessing sensitive information systems The goal is to prevent unauthorized users from gaining access with a stolen password Which of the following models should the company implement to best solve this issue?
A. Context-based
B. Rule based
C. Time-based
D. Role based
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 7：
An organization is prioritizing efforts to remediate or mitigate risks identified during the latest assessment.
For one of the risks, a full remediation was not possible, but the organization was able to successfully apply mitigations to reduce the likelihood of the impact. Which of the following should the organization perform next?
A. Assess the residual risk.
B. Update the organization's threat model.
C. Recalculate the magnitude of the impact.
D. Move to the next risk in the register.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 8：
An engineering team determines the cost to mitigate certain risks is higher than the asset values The team must ensure the risks are prioritized appropriately. Which of the following is the best way to address the issue?
A. Branch protection
B. Vulnerability assessments
C. Purchasing insurance
D. Data labeling
正解：C
解説: (Topexam メンバーにのみ表示されます)