CompTIA CAS-005 問題集

質問 1：
A vulnerability can on a web server identified the following:

Which of the following actions would most likely eliminate on path decryption attacks? (Select two).
A. Increasing the key length to 256 for TLS_RSA_WITH_AES_128_CBC_SHA
B. Implementing HIPS rules to identify and block BEAST attack attempts
C. Restricting cipher suites to only allow TLS_RSA_WITH_AES_128_CBC_SHA
D. Removing support for CBC-based key exchange and signing algorithms
E. Adding TLS_ECDHE_ECDSA_WITH_AE3_256_GCMS_HA256
F. Disallowing cipher suites that use ephemeral modes of operation for key agreement
正解：D,E
解説: (Topexam メンバーにのみ表示されます)

質問 2：
The identity and access management team is sending logs to the SIEM for continuous monitoring.
The deployed log collector is forwarding logs to the SIEM. However, only false positive alerts are being generated.
Which of the following is the most likely reason for the inaccurate alerts?
A. The retention policy is not property configured
B. The data is not being properly parsed
C. The compute resources are insufficient to support the SIEM
D. The SIEM indexes are 100 large
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Which of the following best describes the reason PQC implementation is important?
A. To leverage asymmetric encryption for large amounts of data
B. To improve encryption performance and speed using lightweight cryptography
C. To have larger key lengths available through key stretching
D. To protect data against decryption due to increases in computational resource availability
正解：D

質問 4：
A security engineer wants to enhance the security posture of end-user systems in a zero trust environment. Given the following requirements:
- Reduce the ability for potentially compromised endpoints to contact
C2 infrastructure.
- Track the requests that the malware makes to the IPs.
- Avoid the download of additional payloads.
Which of the following should the engineer deploy to meet these requirements?
A. HIDS
B. Zone transfer protection
C. Browser isolation
D. DNS sinkholing
正解：D

質問 5：
During a forensic review of a cybersecurity incident, a security engineer collected a portion of the payload used by an attacker on a comprised web server. Given the following portion of the code:

Which of the following best describes this incident?
A. XSRF attack
B. Stored XSS
C. SQL injection
D. Command injection
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A security architect is onboarding a new EDR agent on servers that traditionally do not have internet access. In order for the agent to receive updates and report back to the management console, some changes must be made. Which of the following should the architect do to best accomplish this requirement? (Choose two.)
A. Configure a proxy policy that blocks only lists of known-bad, fully qualified domain names.
B. Configure a proxy policy that blocks all traffic on port 443.
C. Create a firewall rule to only allow traffic from the subnet to the internet via port 443.
D. Configure a proxy policy that allows only fully qualified domain names needed to communicate to a portal.
E. Create a firewall rule to only allow traffic from the subnet to the internet to fully qualified names that are not identified as malicious by the firewall vendor.
F. Create a firewall rule to only allow traffic from the subnet to the internet via a proxy.
正解：D,F

質問 7：
Which of the following AI concerns is most adequately addressed by input sanitation?
A. Prompt Injection
B. Non-explainable model
C. Model inversion
D. Data poisoning
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 8：
A nation-state actor is exposed for attacking large corporations by establishing persistence in smaller companies that are likely to be acquired by these large corporations. The actor then provisions user accounts in the companies for use post-acquisition. Before an upcoming acquisition, a security officer conducts threat modeling with this attack vector. Which of the following practices is the best way to investigate this threat?
A. Auditing vendors to mitigate supply chain risk during the acquisition
B. Restricting internet traffic originating from countries in which the nation-state actor is known to operate
C. Comparing all existing credentials to personnel and services
D. Placing a hold on all information about corporate interest in acquisitions
正解：C