CompTIA RC0-501 問題集

質問 1：
DRAG DROP
You have been tasked with designing a security plan for your company. Drag and drop the appropriate security controls on the floor plan.
Instructions: All objects must be used and all place holders must be filled. Order does not matter. When you have completed the simulation, please select the Done button to submit.

正解：


質問 2：
A vulnerability scanner that uses its running service's access level to better assess vulnerabilities across multiple assets within an organization is performing a:
A. Non-intrusive scan.
B. Passive scan.
C. Privilege escalation test.
D. Credentialed scan.
正解：D

質問 3：
A system's administrator has finished configuring firewall ACL to allow access to a new web answer.
PERMIT TCP from: ANY to: 192.168.1.10:80
PERMIT TCP from: ANY to: 192.168.1.10:443
DENY TCP from: ANY to: ANY
The security administrator confirms form the following packet capture that there is network traffic from the internet to the web server:
TCP 10.23.243.2:2000->192.168.1.10:80 POST/default's
TCP 172.16.4.100:1934->192.168.1.10:80 GET/session.aspx?user_1_sessionid= a12ad8741d8f7e7ac723847aa8231a The company's internal auditor issues a security finding and requests that immediate action be taken. With which of the following is the auditor MOST concerned?
A. Implicit deny
B. Clear text credentials
C. Default configuration
D. Misconfigured firewall
正解：B

質問 4：
A security analyst is hardening a web server, which should allow a secure certificate-based session using the organization's PKI infrastructure. The web server should also utilize the latest security techniques and standards. Given this set of requirements, which of the following techniques should the analyst implement to BEST meet these requirements?
(Select two.)
A. Enable and configure TLS on the server.
B. Implement a CRL using an authorized CA.
C. Install a certificate signed by a public CA.
D. Configure the web server to use a host header.
E. Install an X- 509-compliant certificate.
正解：A,E

質問 5：
When considering a third-party cloud service provider, which of the following criteria would be the BEST to include in the security assessment process? (Select two.)
A. Adherence to regulatory compliance
B. Breadth of applications support
C. Size of the corporation
D. Use of performance analytics
E. Data retention policies
正解：A,E

質問 6：
An in-house penetration tester is using a packet capture device to listen in on network communications. This is an example of:
A. Exploiting the switch
B. Persistence
C. Passive reconnaissance
D. Escalation of privileges
正解：A

質問 7：
A company's user lockout policy is enabled after five unsuccessful login attempts. The help desk notices a user is repeatedly locked out over the course of a workweek. Upon contacting the user, the help desk discovers the user is on vacation and does not have network access. Which of the following types of attacks are MOST likely occurring? (Select two.)
A. Replay
B. Rainbow tables
C. Brute force
D. Pass the hash
E. Dictionary
正解：D,E

質問 8：
A system administrator is reviewing the following information from a compromised server.

Given the above information, which of the following processes was MOST likely exploited via remote buffer overflow attack?
A. Apache
B. TFTP
C. LSASS
D. MySQL
正解：B