CompTIA CAS-001 問題集

質問 1：
A security consultant is evaluating forms which will be used on a company website. Which of the following techniques or terms is MOST effective at preventing malicious individuals from successfully exploiting programming flaws in the website?
A. Input validation
B. Application sandboxing
C. Data loss prevention
D. Anti-spam software
正解：A

質問 2：
In order for a company to boost profits by implementing cost savings on non-core business activities, the IT manager has sought approval for the corporate email system to be hosted in the cloud. The compliance officer has been tasked with ensuring that data lifecycle issues are taken into account. Which of the following BEST covers the data lifecycle end-to-end?
A. Securing virtual environments, appliances, and equipment that handle email
B. Information classification, vendor selection, and the RFP process
C. Creation and secure destruction of mail accounts, emails, and calendar items
D. Data provisioning, processing, in transit, at rest, and de-provisioning
正解：D

質問 3：
CORRECT TEXT
The IDS has detected abnormal behavior on this network. Click on the network devices to view device information. Based on this information, the following tasks should be completed:
1. Select the server that is a victim of a cross-site scripting (XSS) attack.
2. Select the source of the brute force password attack.
3. Modify the access control list (ACL) on the router(s) to ONLY block the XSS attack.
Instructions: Simulations can be reset at anytime to the initial state: however, all selections will be deleted



正解：
Please review following steps:
Explanation:
Check the below images for more details:










質問 4：
A production server has been compromised. Which of the following is the BEST way to preserve the non-volatile evidence?
A. Login remotely and perform a full backup of the server.
B. Install remote backup software and copy data to write-once media.
C. Remove all power sources from the server.
D. Shut the server down and image the hard drive.
正解：D

質問 5：
A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame as to whose fault it was that the incident occurred. In which part of the incident response phase would this be addressed in a controlled and productive manner?
A. During the Identification Phase
B. During the Lessons Learned phase
C. During the Preparation Phase
D. During the Containment Phase
正解：B

質問 6：
An existing enterprise architecture included an enclave where sensitive research and development work was conducted. This network enclave also served as a storage location for proprietary corporate data and records. The initial security architect chose to protect the enclaveby restricting access to a single physical port on a firewall. All downstream network devices were isolated from the rest of the network and communicated solely through the single 100mbps firewall port. Over time, researchers connected devices on the protected enclave directly to external resources and corporate data stores. Mobile and wireless devices were also added to the enclave to support high speed data research. Which of the following BEST describes the process which weakened the security posture of the enclave?
A. Emerging security threats rendered the existing architecture obsolete.
B. Emerging business requirements led to the de-perimiterization of the network.
C. The single firewall port was oversaturated with network packets.
D. The shrinking of an overall attack surface due to the additional access.
正解：B

質問 7：
A security administrator is shown the following log excerpt from a Unix system:
2013 Oct 10 07:14:57 web14 sshd[1632]: Failed password for root from 198.51.100.23 port 37914 ssh2
2013 Oct 10 07:14:57 web14 sshd[1635]: Failed password for root from 198.51.100.23 port 37915 ssh2
2013 Oct 10 07:14:58 web14 sshd[1638]: Failed password for root from 198.51.100.23 port 37916 ssh2
2013 Oct 10 07:15:59 web14 sshd[1640]: Failed password for root from 198.51.100.23 port 37918 ssh2
2013 Oct 10 07:16:00 web14 sshd[1641]: Failed password for root from 198.51.100.23 port 37920 ssh2
2013 Oct 10 07:16:00 web14 sshd[1642]: Successful login for root from 198.51.100.23 port 37924 ssh2
Which of the following is the MOST likely explanation of what is occurring and the BEST immediate response? (Select TWO).
A. Use iptables to immediately DROP connections from the IP 198.51.100.23.
B. Isolate the system immediately and begin forensic analysis on the host.
C. An authorized administrator has logged into the root account remotely.
D. Change the root password immediately to a password not found in a dictionary.
E. A remote attacker has compromised the root account using a buffer overflow in sshd.
F. The administrator should disable remote root logins.
G. A remote attacker has guessed the root password using a dictionary attack.
H. A remote attacker has compromised the private key of the root account.
正解：B,G

質問 8：
The <nameID> element in SAML can be provided in which of the following predefined formats? (Select TWO).
A. X.509 subject name
B. WWN record name
C. Kerberos principal name
D. EV certificate OID extension
E. PTR DNS record
正解：A,C