CompTIA CAS-001 問題集

質問 1：
Ann, a Physical Security Manager, is ready to replace all 50 analog surveillance cameras with IP cameras with built-in web management. Ann has several security guard desks on different networks that must be able to view the cameras without unauthorized people viewing the video as well. The selected IP camera vendor does not have the ability to authenticate users at the camera level. Which of the following should Ann suggest to BEST secure this environment?
A. Create an IP camera network and deploy NIPS to prevent unauthorized access.
B. Create an IP camera network and only allow SSL access to the cameras.
C. Create an IP camera network and restrict access to cameras from a single management host.
D. Create an IP camera network and deploy a proxy to authenticate users prior to accessing the cameras.
正解：D

質問 2：
Two universities are making their 802.11n wireless networks available to the other
university's students. The infrastructure will pass the student's credentials back to the home school for authentication via the Internet.
The requirements are: Mutual authentication of clients and authentication server The design should not limit connection speeds Authentication must be delegated to the home school No passwords should be sent unencrypted The following design was implemented: WPA2 Enterprise using EAP-PEAP-MSCHAPv2 will be used for wireless security RADIUS proxy servers will be used to forward authentication requests to the home school The RADIUS servers will have certificates from a common public certificate authority A strong shared secret will be used for RADIUS server authentication
Which of the following security considerations should be added to the design?
A. The RADIUS servers should have local accounts for the visiting students
B. The transport layer between the RADIUS servers should be secured
C. WPA Enterprise should be used to decrease the network overhead
D. Students should be given certificates to use for authentication to the network
正解：B

質問 3：
A company has been purchased by another agency and the new security architect has identified new security goals for the organization. The current location has video surveillance throughout the building and entryways. The following requirements must be met:
1.Ability to log entry of all employees in and out of specific areas
2.Access control into and out of all sensitive areas
3.Two-factor authentication
Which of the following would MOST likely be implemented to meet the above requirements and provide a secure solution? (Select TWO).
A. Visitor logs
B. Mantrap
C. Motion detection sensors
D. Biometric readers
E. Proximity readers
正解：D,E

質問 4：
An online banking application has had its source code updated and is soon to be relaunched. The underlying infrastructure has not been changed. In order to ensure that the application has an appropriate security posture, several security-related activities are required.
Which of the following security activities should be performed to provide an appropriate level of security testing coverage? (Select TWO).
A. Penetration test across the application with accounts of varying access levels (i.e. non-authenticated, authenticated, and administrative users).
B. Fingerprinting across all of the online banking servers to ascertain open ports and services.
C. Vulnerability assessment across all of the online banking servers to ascertain host and container configuration lock-down and patch levels.
D. Black box code review across the entire code base to ensure that there are no security defects present.
E. Code review across critical modules to ensure that security defects, Trojans, and backdoors are not present.
正解：A,E

質問 5：
A new web based application has been developed and deployed in production. A security engineer decides to use an HTTP interceptor for testing the application. Which of the following problems would MOST likely be uncovered by this tool?
A. The tool could show that input validation was only enabled on the client side
B. The tool could fuzz the application to determine where memory leaks occur
C. The tool could force HTTP methods such as DELETE that the server has denied
D. The tool could enumerate backend SQL database table and column names
正解：A

質問 6：
Which of the following does SAML uses to prevent government auditors or law enforcement from identifying specific entities as having already connected to a service provider through an SSO operation?
A. Restful interfaces
B. Transient identifiers
C. Security bindings
D. Directory services
正解：B

質問 7：
The security team for Company XYZ has determined that someone from outside the organization has obtained sensitive information about the internal organization by querying the external DNS server of the company. The security manager is tasked with making sure this problem does not occur in the future. How would the security manager address this problem?
A. Implement a split DNS, only allowing the external DNS server to contain information about domains that only the outside world should be aware, and an internal DNS server to maintain authoritative records for internal systems.
B. Implement a split DNS, only allowing the external DNS server to contain information about internal domain resources that the outside world would be interested in, and an internal DNS server to maintain authoritative records for internal systems.
C. Implement a split DNS, only allowing the internal DNS server to contain information about domains the outside world should be aware of, and an external DNS server to maintain authoritative records for internal systems.
D. Implement a split DNS, only allowing the external DNS server to contain information about domains that only the outside world should be aware, and an internal DNS server to maintain non-authoritative records for external systems.
正解：A

質問 8：
New zero-day attacks are announced on a regular basis against a broad range of technology systems. Which of the following best practices should a security manager do to manage the risks of these attack vectors? (Select TWO).
A. Maintain a list of critical systems.
B. Update all network diagrams.
C. Backup the router and firewall configurations.
D. Create an inventory of applications.
E. Establish an emergency response call tree.
正解：A,D