CompTIA CAS-003 問題集

質問 1：
A system administrator recently conducted a vulnerability scan of the internet. Subsequently, the organization was successfully attacked by an adversary. Which of the following in the MOST likely for why the organization network was compromised?
A. The system administrator did not perform a full system sun.
B. There was a false positive since the network was fully patched.
C. The vulnerability database was not updated.
D. The systems administrator performed a credentialed scan.
正解：A

質問 2：
An SQL database is no longer accessible online due to a recent security breach. An investigation reveals that unauthorized access to the database was possible due to an SQL injection vulnerability. To prevent this type of breach in the future, which of the following security controls should be put in place before bringing the database back online? (Choose two.)
A. Input validation
B. Secure storage policies
C. Database activity monitoring
D. Web application firewall
E. Secure coding standards
F. Browser security updates
正解：A,C

質問 3：
A company is developing requirements for a customized OS build that will be used in an embedded environment. The company procured hardware that is capable of reducing the likelihood of successful buffer overruns while executables are processing. Which of the following capabilities must be included for the OS to take advantage of this critical hardware-based countermeasure?
A. NX/XN bit
B. ASLR
C. Application whitelisting
D. SCP
E. TrustZone
正解：A

質問 4：
The Chief Information Officer (CISO) is concerned that certain systems administrators will privileged access may be reading other users' emails. Review of a tool's output shows the administrators have used web mail to log into other users' inboxes.
Which of the following tools would show this type of output?
A. File integrity monitoring tool
B. Password cracker
C. Command-line tool
D. Log analysis tool
正解：D

質問 5：
As part of an organization's ongoing vulnerability assessment program, the Chief Information Security Officer (CISO) wants to evaluate the organization's systems, personnel, and facilities for various threats As part of the assessment the CISO plans to engage an independent cybersecurity assessment firm to perform social engineering and physical penetration testing against the organization's corporate offices and remote locations. Which of the following techniques would MOST likely be employed as part of this assessment? (Select THREE).
A. Tailgating
B. Rogue AP substitution
C. TOC/TOU exploitation
D. Badge skimming
E. Vishing
F. Privilege escalation
G. Vulnerability scanning
H. SQL injection
正解：A,D,E

質問 6：
Following a recent network intrusion, a company wants to determine the current security awareness of all of its employees. Which of the following is the BEST way to test awareness?
A. Hire an external company to provide an independent audit of the network security posture
B. Review the social media of all employees to see how much proprietary information is shared
C. Send an email from a corporate account, requesting users to log onto a website with their enterprise account
D. Conduct a series of security training events with comprehensive tests at the end
正解：C

質問 7：
A security architect is implementing security measures in response to an external audit that found vulnerabilities in the corporate collaboration tool suite. The report identified the lack of any mechanism to provide confidentiality for electronic correspondence between users and between users and group mailboxes. Which of the following controls would BEST mitigate the identified vulnerability?
A. Federate with an existing PKI provider, and reject all non-signed emails
B. Implement two-factor email authentication, and require users to hash all email messages upon receipt
C. Issue digital certificates to all users, including owners of group mailboxes, and enable S/MIME
D. Provide digital certificates to all systems, and eliminate the user group or shared mailboxes
正解：C

質問 8：
A company suspects a web server may have been infiltrated by a rival corporation. The security engineer reviews the web server logs and finds the following:

The security engineer looks at the code with a developer, and they determine the log entry is created when the following line is run:

Which of the following is an appropriate security control the company should implement?
A. Restrict directory permission to read-only access.
B. Parameterize a query in the path variable to prevent SQL injection.
C. Use server-side processing to avoid XSS vulnerabilities in path input.
D. Separate the items in the system call to prevent command injection.
正解：D