CompTIA CAS-001 問題集

質問 1：
---
Company XYZ provides residential television cable service across a large region.
The company's board of directors is in the process of approving a deal with the following three companies:
A National landline telephone provider
A Regional wireless telephone provider
An international Internet service provider
The board of directors at Company XYZ wants to keep the companies and billing separated.
While the Chief Information Officer (CIO) at Company XYZ is concerned about the confidentiality of Company XYZ's customer data and wants to share only minimal information about its customers for the purpose of accounting, billing, and customer authentication.
The proposed solution must use open standards and must make it simple and seamless for Company XYZ's customers to receive all four services.
Which of the following solutions is BEST suited for this scenario?
A. Company XYZ needs to install the IdP, while the partner companies need to install the SP portion of a Federated identity solution.
B. Company XYZ must implement VPN and strict access control to allow the other three companies to access the internal LDAP.
C. Company XYZ needs to install the SP, while the partner companies need to install the WAYF portion of a Federated identity solution.
D. All four companies must implement a TACACS+ web based single sign-on solution with associated captive portal technology.
正解：A

質問 2：
A security engineer at a major financial institution is prototyping multiple secure network configurations. The testing is focused on understanding the impact each potential design will have on the three major security tenants of the network. All designs must take into account the stringent compliance and reporting requirements for most worldwide financial institutions.Which of the following is the BEST list of security lifecycle related concerns related to deploying the final design?
A. Ensuring smooth transition of maintenance resources to support the new network, updating all whole disk encryption keys to be compatible with IPv6, and maximizing profits for bank shareholders.
B. Decommissioning the existing network smoothly, implementing maintenance and operations procedures for the new network in advance, and ensuring compliance with applicable regulations and laws.
C. Decommissioning plan for the new network, proper disposal protocols for the existing network equipment, transitioning operations to the new network on day one, and ensuring compliance with corporate data retention policies.
D. Resistance of the new network design to DDoS attacks, ability to ensure confidentiality of all data in transit, security of change management processes and procedures, and resilience of the firewalls to power fluctuations.
E. Interoperability with the Security Administration Remote Access protocol, integrity of the data at rest, overall network availability, and compliance with corporate and government regulations and policies.
正解：B

質問 3：
A security incident happens three times a year on a company's web server costing the company $1,500 in downtime, per occurrence. The web server is only for archival access and is scheduled to be decommissioned in five years. The cost of implementing software to prevent this incident would be $15,000 initially, plus $1,000 a year for maintenance. Which of the following is the MOST cost-effective manner to deal with this risk?
A. Accept the risk
B. Avoid the risk
C. Transfer the risk
D. Mitigate the risk
正解：D

質問 4：
The network administrator has been tracking the cause of network performance problems and decides to take a look at the internal and external router stats.

Which of the following should the network administrator do to resolve the performance issue after analyzing the above information?
A. An ACL should be placed on the internal router to drop layer 4 packets to and from port 0.
B. The TCP flags of business related traffic should be modified accordingly.
C. The IP TOS field of business related network traffic should be modified accordingly.
D. An ACL should be placed on the external router to drop incoming ICMP packets.
正解：C

質問 5：
A trust relationship has been established between two organizations with web based services. One organization is acting as the Requesting Authority (RA) and the other acts as the Provisioning Service Provider (PSP). Which of the following is correct about the trust relationship?
A. The trust relationship uses SPML in the SAML header. The SAML body transports the SPML requests / responses.
B. The trust relationship uses SAML in the SOAP header. The SOAP body transports the SPML requests / responses.
C. The trust relationship uses SPML in the SOAP header. The SOAP body transports the SAML requests / responses.
D. The trust relationship uses XACML in the SAML header. The SAML body transports the SOAP requests / responses.
正解：B

質問 6：
Which of the following is a security advantage of single sign-on? (Select TWO).
A. Applications need to validate authentication tokens.
B. Authentication is secured by the certificate authority.
C. All password transactions are encrypted.
D. Less time and complexity removing user access.
E. Users only have to remember one password.
正解：D,E

質問 7：
A business wants to start using social media to promote the corporation and to ensure that customers have a good experience with their products. Which of the following security items should the company have in place before implementation? (Select TWO).
A. Senior staff blogs should be ghost written by marketing professionals.
B. The finance department must provide a cost benefit analysis for social media.
C. The company should ensure that the company has sufficient bandwidth to allow for social media traffic.
D. The security policy needs to be reviewed to ensure that social media policy is properly implemented.
E. The company must dedicate specific staff to act as social media representatives of the company.
F. All staff needs to be instructed in the proper use of social media in the work environment.
正解：D,E

質問 8：
When attending the latest security conference, an information security administrator noticed only a few people carrying a laptop around. Most other attendees only carried their smartphones.
Which of the following would impact the security of conference's resources?
A. Wireless network security may need to be decreased to allow for increased access of mobile devices.
B. Network security may need to be increased by reducing the number of available physical network jacks.
C. Physical security may need to be increased to deter or prevent theft of mobile devices.
D. Wireless network security may need to be increased to decrease access of mobile devices.
正解：B