CompTIA CAS-005 問題集

質問 1：
A company wants to install a three-tier approach to separate the web. database, and application servers A security administrator must harden the environment which of the following is the best solution?
A. installing a firewall and making it the network core
B. Configuring a SASb solution to restrict users to server communication
C. Implementing microsegmentation on the server VLANs
D. Deploying a VPN to prevent remote locations from accessing server VLANs
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
A malware researcher has discovered a credential stealer is looking at a specific memory register to harvest passwords that will be used later for lateral movement in corporate networks. The malware is using TCP 4444 to communicate with other workstations. The lateral movement would be best mitigated by:
A. Configuring the CPU's NX bit
B. Enabling ASLR on the Active Directory server
C. Enabling a host firewall
D. Enabling an edge firewall
E. Enforcing all systems to use UEFI
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
SIMULATION
[Security Architecture]
During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.
INSTRUCTIONS
Review each of the events and select the appropriate analysis and remediation options for each IoC.



正解：
See the solution below in Explanation
Explanation:
Analysis and Remediation Options for Each IoC:
IoC 1:
Evidence:
Source: Apache_httpd
Type: DNSQ
Dest: @10.1.1.1:53,@10.1.2.5
Data: update.s.domain, CNAME 3a129sk219r9slmfkzzz000.s.domain, 108.158.253.253 Analysis:
Analysis: The service is attempting to resolve a malicious domain.
Reason: The DNS queries and the nature of the CNAME resolution indicate that the service is trying to resolve potentially harmful domains, which is a common tactic used by malware to connect to command-and-control servers.
Remediation:
Remediation: Implement a blocklist for known malicious ports.
Reason: Blocking known malicious domains at the DNS level prevents the resolution of harmful domains, thereby protecting the network from potential connections to malicious servers.
IoC 2:
Evidence:
Src: 10.0.5.5
Dst: 10.1.2.1, 10.1.2.2, 10.1.2.3, 10.1.2.4, 10.1.2.5
Proto: IP_ICMP
Data: ECHO
Action: Drop
Analysis:
Analysis: Someone is footprinting a network subnet.
Reason: The repeated ICMP ECHO requests to different addresses within a subnet indicate that someone is scanning the network to discover active hosts, a common reconnaissance technique used by attackers.
Remediation:
Remediation: Block ping requests across the WAN interface.
Reason: Blocking ICMP ECHO requests on the WAN interface can prevent attackers from using ping sweeps to gather information about the network topology and active devices.
IoC 3:
Evidence:
Proxylog:
GET /announce?info_hash=%01dff%27f%21%10%c5%wp%4e%1d%6f%63%3c%49%6d&peer_id%3dxJFS Uploaded=0&downloaded=0&left=3767869&compact=1&ip=10.5.1.26&event=started User-Agent: RAZA 2.1.0.0 Host: localhost Connection: Keep-Alive HTTP200 OK Analysis:
Analysis: An employee is using P2P services to download files.
Reason: The HTTP GET request with parameters related to a BitTorrent client indicates that the employee is using peer-to-peer (P2P) services, which can lead to unauthorized data transfer and potential security risks.
Remediation:
Remediation: Enforce endpoint controls on third-party software installations.
Reason: By enforcing strict endpoint controls, you can prevent the installation and use of unauthorized software, such as P2P clients, thereby mitigating the risk of data leaks and other security threats associated with such applications.
Reference:
CompTIA Security+ Study Guide: This guide offers detailed explanations on identifying and mitigating various types of Indicators of Compromise (IoCs) and the corresponding analysis and remediation strategies.
CompTIA Security+ Exam Objectives: These objectives cover key concepts in network security monitoring and incident response, providing guidelines on how to handle different types of security events.
Security Operations Center (SOC) Best Practices: This resource outlines effective strategies for analyzing and responding to anomalous events within a SOC, including the use of blocklists, endpoint controls, and network configuration changes.
By accurately analyzing the nature of each IoC and applying the appropriate remediation measures, the organization can effectively mitigate potential security threats and maintain a robust security posture.

質問 4：
A security analyst isreviewing the following event timeline from an COR solution:

Which of the following most likely has occurred and needs to be fixed?
A. An EDRbypass was utilized by a threat actor and updates must be installed by the administrator.
B. A logic law has introduced a TOCTOU vulnerability and must be addressed by the COR vendor
C. The Dl P has failed to block malicious exfiltration and data tagging is not being utilized property
D. A potential insider threat is being investigated and will be addressed by the senior management team.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：

Which of the following is the security engineer most likely doing?
A. Threat hunting for suspicious activity from an insider threat
B. Baselining user behavior to support advancedanalytics
C. Reporting on remote log-in activities to track team metrics
D. Assessing log inactivities using geolocation to tune impossible Travel rate alerts
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
An analyst reviews a SIEM and generates the following report:

OnlyHOST002is authorized for internet traffic. Which of the following statements is accurate?
A. The network connection activity is unusual, and a network infection is highly possible.
B. The VM002 host is misconfigured and needs to be revised by the network team.
C. The SIEM platform is reporting multiple false positives on the alerts.
D. The HOST002 host is under attack, and a security incident should be declared.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 7：
A security analyst discovered requests associated with IP addresses known for born legitimate 3nd bot-related traffic. Which ofthe following should the analyst use to determine whether the requests are malicious?
A. Byte length of the request
B. HTML encoding field
C. Web application headers
D. User-agent string
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 8：
A user from the sales department opened a suspicious file attachment. The sales department then contacted the SOC to investigate a number of unresponsive systems, and the team successfully identified the file and the origin of the attack. Which of the following is the next step of the incident response plan?
A. Response
B. Recovery
C. Remediation
D. Containment
正解：D
解説: (Topexam メンバーにのみ表示されます)