検証済みCAS-005問題集と解答で2025年最新のCAS-005をダウンロード
更新された100%カバー率リアルCAS-005試験問題で100%合格保証付いてます
CompTIA CAS-005 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
質問 # 190
An organization has been using self-managed encryption keys rather than the free keys managed by the cloud provider. The Chief Information Security Officer (CISO) reviews the monthly bill and realizes the self- managed keys are more costly than anticipated. Which of the following should the CISO recommend to reduce costs while maintaining a strong security posture?
- A. Extend the key rotation period to one year so that the cloud provider can use cached keys.
- B. Adjust the configuration for cloud provider keys on data that is classified as public.
- C. Utilize an on-premises HSM to locally manage keys.
- D. Begin using cloud-managed keys on all new resources deployed in the cloud.
正解：B
解説：
Comprehensive and Detailed Step by Step Explanation:
Understanding the Scenario: Theorganization is using customer-managed encryption keys in the cloud, which is more expensive than using the cloud provider's free managed keys. The CISO needs to find a way to reduce costs without significantly weakening the security posture.
Analyzing the Answer Choices:
A: Utilize an on-premises HSM to locally manage keys: While on-premises HSMs offer strong security, they introduce additional costs and complexity (procurement, maintenance, etc.). This option is unlikely to reduce costs compared to cloud-based key management.
B: Adjust the configuration for cloud provider keys on data that is classified as public: This is the most practical and cost-effective approach. Data classified as public doesn't require the same level of protection as sensitive data. Using the cloud provider's free managed keys for public data can significantly reduce costs without compromising security, as the data is intended to be publicly accessible anyway.
Reference: This aligns with the principle of applying security controls based on data classification and risk assessment, a key concept in CASP+.
C: Begin using cloud-managed keys on all new resources deployed in the cloud: While this would reduce costs, it's a broad approach that doesn't consider the sensitivity of the data. Applying cloud-managed keys to sensitive data might not be acceptable from a security standpoint.
D: Extend the key rotation period to one year so that the cloud provider can use cached keys: Extending the key rotation period weakens security. Frequent key rotation is a security best practice to limit the impact of a potential key compromise.
Reference: Key rotation is a fundamental security control, and reducing its frequency goes against CASP+ principles related to cryptography and risk management.
Why B is the Correct Answer:
Risk-Based Approach: Using cloud-provider-managed keys for public data is a reasonable risk-based decision. Public data, by definition, is not confidential.
Cost Optimization: This directly addresses the CISO's concern about cost, as cloud-provider-managed keys are often free or significantly cheaper.
Security Balance: It maintains a strong security posture for sensitive data by continuing to use customer- managed keys where appropriate, while optimizing costs for less sensitive data.
CASP+ Relevance: This approach demonstrates an understanding of risk management, data classification, and cost-benefit analysis in security decision-making, all of which are important topics in CASP+.
Elaboration on Data Classification:
Data Classification Policy: Organizations should have a clear data classification policy that defines different levels of data sensitivity (e.g., public, internal, confidential, restricted).
Security Controls Based on Classification: Security controls, including encryption key management, should be applied based on the data's classification level.
Cost-Benefit Analysis: Data classification helps organizations make informed decisions about where to invest in stronger security controls and where cost optimization is acceptable.
In conclusion, adjusting the configuration to use cloud-provider-managed keys for data classified as public is the most effective way to reduce costs while maintaining a strong security posture. It's a practical, risk-based approach that aligns with data classification principles and cost-benefit considerations, all of which are important concepts covered in the CASP+ exam objectives.
質問 # 191
Users must accept the terms presented in a captive petal when connecting to a guest network. Recently, users have reported that they are unable to access the Internet after joining the network A network engineer observes the following:
* Users should be redirected to the captive portal.
* The Motive portal runs Tl. S 1 2
* Newer browser versions encounter security errors that cannot be bypassed
* Certain websites cause unexpected re directs
Which of the following mow likely explains this behavior?
- A. Employment of the HSTS setting is proliferating rapidly.
- B. The TLS ciphers supported by the captive portal ate deprecated
- C. Allowed traffic rules are causing the NIPS to drop legitimate traffic
- D. An attacker is redirecting supplicants to an evil twin WLAN.
正解：B
解説：
The most likely explanation for the issues encountered with the captive portal is that the TLS ciphers supported by the captive portal are deprecated. Here's why:
TLS Cipher Suites: Modern browsers are continuously updated to support the latest security standards and often drop support for deprecated and insecure cipher suites. If the captive portal uses outdated TLS ciphers, newer browsers may refuse to connect, causing security errors.
HSTS and Browser Security: Browsers with HTTP Strict Transport Security (HSTS) enabled will not allow connections to sites with weak security configurations. Deprecated TLS ciphers would cause these browsers to block the connection.
Reference:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
NIST Special Publication 800-52: Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations OWASP Transport Layer Protection Cheat Sheet By updating the TLS ciphers to modern, supported ones, the security engineer can ensure compatibility with newer browser versions and resolve the connectivity issues reported by users.
質問 # 192
A security analyst received a report that an internal web page is down after a company-wide update to the web browser Given the following error message:
Which of the following is the best way to fix this issue?
- A. Disabling all deprecated ciphers
- B. Blocking all non-essential pons
- C. Rewriting any legacy web functions
- D. Discontinuing the use of self-signed certificates
正解：D
解説：
The error message "NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM" indicates that the web browser is rejecting the certificate because it uses a weak signature algorithm. This commonly happens with self-signed certificates, which often use outdated or insecure algorithms.
Why Discontinue Self-Signed Certificates?
Security Compliance: Modern browsers enforce strict security standards and may reject certificates that do not comply with these standards.
Trusted Certificates: Using certificates from a trusted Certificate Authority (CA) ensures compliance with security standards and is less likely to be flagged as insecure.
Weak Signature Algorithm: Self-signed certificates might use weak algorithms like MD5 or SHA-1, which are considered insecure.
Other options do not address the specific cause of the certificate error:
A: Rewriting legacy web functions: Does not address the certificate issue.
B: Disabling deprecated ciphers: Useful for improving security but not related to the certificate error.
C: Blocking non-essential ports: This is unrelated to the issue of certificate validation.
質問 # 193
An external threat actor attacks public infrastructure providers. In response to the attack and during follow-up activities, various providers share information obtained during response efforts. After the attack, energy sector companies share their status and response data:
Company SIEM UEBA DLP ISAC Member TIP Integration Time to Detect Time to Respond
1 Yes No Yes Yes Yes 10 minutes 20 minutes
2 Yes Yes Yes Yes No 20 minutes 40 minutes
3 Yes Yes No No Yes 12 minutes 24 minutes
Which of the following is the most important issue to address to defend against future attacks?
- A. Failure to join the industry ISAC
- B. Failure to implement a DLP system
- C. Failure to integrate with the TIP
- D. Failure to implement a UEBA system
正解：A
解説：
The data provided shows that all companies have SIEM systems, but they differ in their implementation of UEBA, DLP, ISAC membership, and TIP integration. The key metric to evaluate is the effectiveness in detecting and responding to attacks, as shown by the "Time to Detect" and "Time to Respond" columns. Company 1, which is an ISAC member, has the fastest detection (10 minutes) and response (20 minutes) times. Company 3, which is not an ISAC member, has slower detection (12 minutes) and response (24 minutes) times, despite having UEBA and TIP integration. Company 2, which lacks TIP integration but is an ISAC member, has the slowest times (20 minutes to detect, 40 minutes to respond). This suggests that ISAC membership correlates with faster detection and response, likely due to access to shared threat intelligence.
According to the CompTIA SecurityX CAS-005 objectives (Domain 2: Security Operations, 2.2), Information Sharing and Analysis Centers (ISACs) are critical for enabling organizations to share real-time threat intelligence within their industry. ISACs provide access to actionable intelligence, best practices, and coordinated response strategies, which are essential for defending against sophisticated attacks targeting critical infrastructure like the energy sector. The lack of ISAC membership (Company 3) limits access to this intelligence, hindering proactive defense and response capabilities. While UEBA, DLP, and TIP integration are valuable, they are more focused on internal monitoring, data protection, and individual threat intelligence feeds, respectively, and do not provide the same industry-wide collaboration as an ISAC.
Reference:
CompTIA SecurityX CAS-005 Official Study Guide, Domain 2: Security Operations, Section 2.2: "Explain the importance of threat intelligence sharing and collaboration, including ISACs." CAS-005 Exam Objectives, 2.2: "Analyze the impact of information sharing on incident response efficiency."
質問 # 194
SIMULATION
An IPSec solution is being deployed. The configuration files for both the VPN concentrator and the AAA server are shown in the diagram.
Complete the configuration files to meet the following requirements:
- The EAP method must use mutual certificate-based authentication (with issued client certificates).
- The IKEv2 cipher suite must be configured to the MOST secure authenticated mode of operation.
- The secret must contain at least one uppercase character, one lowercase character, one numeric character, and one special character, and it must meet a minimum length requirement of eight characters.
INSTRUCTIONS
Click on the AAA server and VPN concentrator to complete the configuration. Fill in the appropriate fields and make selections from the drop-down menus.
If at any time you would like to bung back the initial state of the simulation, please click the Reset All button.
正解：
解説：
質問 # 195
Source code snippets for two separate malware samples are shown below:
Sample 1:
knockEmDown(String e) {
if(target.isAccessed()) {
target.toShell(e);
System.out.printIn(e.toString());
c2.sendTelemetry(target.hostname.toString + " is " + e.toString());
} else {
target.close();
}
}
Sample 2:
targetSys(address a) {
if(address.islpv4()) {
address.connect(1337);
address.keepAlive("paranoid");
String status = knockEmDown(address.current);
remote.sendC2(address.current + " is " + status);
} else {
throw Exception e;
}
}
Which of the following describes the most important observation about the two samples?
- A. Sample 1 is the target agent while Sample 2 is the C2 server.
- B. Both samples use IP connectivity for command and control.
- C. The samples were probably written by the same developer.
- D. Telemetry is first buffered and then transmitted in paranoid mode.
正解：C
解説：
Comprehensive and Detailed Step-by-Step Explanation:
Both samples share similar function names, variable naming styles, and logic flow, indicating that they were likely written by the same developer. This is a key observation in malware attribution, as cyber threat analysts often look for unique coding styles to link malware to specific threat actors.
The presence of C2 (Command and Control) communication in both samples supports this theory, as attackers often reuse parts of their own malware code across different attacks.
質問 # 196
During a periodic internal audit, a company identifies a few new, critical security controls that are missing.
The company has a mature risk management program in place, and the following requirements must be met:
* The stakeholders should be able to see all the risks.
* The risks need to have someone accountable for them.
Which of the following actions should the GRC analyst take next?
- A. Add the risk to the risk register and assign the owner and severity.
- B. Review the risk to decide whether to accept or reject it.
- C. Mitigate the risk and change the status to accepted.
- D. Change the risk appetite and assign an owner to it.
正解：A
解説：
A risk register is atool commonly used in risk management to document all identified risks, their assessment in terms of likelihood and impact, and the actions steps to manage them. By adding the newly identified risks to the risk register and assigning an owner and severity, the organization ensures that each risk is visible to stakeholders and has a designated individual responsible for its management. This aligns with the company's requirements for transparency and accountability in risk management.
Reference:CompTIA SecurityX CAS-005 Official Study Guide, Chapter 6: "Risk Management," Section 6.4:
"Risk Register and Risk Ownership."
質問 # 197
A security engineer is given the following requirements:
- An endpoint must only execute Internally signed applications
- Administrator accounts cannot install unauthorized software.
- Attempts to run unauthorized software must be logged
Which of the following best meets these requirements?
- A. Deploying an EDR solution to monitor and respond to software installation attempts
- B. Maintaining appropriate account access through directory management and controls
- C. Implementing a CSPM platform to monitor updates being pushed to applications
- D. Configuring application control with blocked hashes and enterprise-trusted root certificates
正解：D
解説：
To meet the requirements of only allowing internally signed applications, preventing unauthorized software installations, and logging attempts to run unauthorized software, configuring application control with blocked hashes and enterprise-trusted root certificates is the best solution. This approach ensures that only applications signed by trusted certificates are allowed to execute, while all other attempts are blocked and logged. It effectively prevents unauthorized software installations by restricting execution to pre-approved applications.
質問 # 198
A security analyst detects a possible RAT infection on a computer in the internal network. After reviewing the details of the alert, the analyst identifies the initial vector of the attack was an email that was forwarded to multiple recipients in the same organizational unit. Which of the following should the analyst do first to minimize this type of threat in the future?
- A. Move from an anti-malware software to an EDR solution.
- B. Configure an IPS solution in the internal network to mitigate infections.
- C. Perform a penetration test to detect technology gaps on the anti-spam solution.
- D. Implement a security awareness program in the organization.
正解：D
質問 # 199
An organization has noticed an increase in phishing campaigns utilizing typosquatting. A security analyst needs to enrich the data for commonly used domains against the domains used in phishing campaigns. The analyst uses a log forwarder to forward network logs to the SIEM. Which of the following would allow the security analyst to perform this analysis?
- A. Create a parser that matches domains.
- B. Use a cron job to regularly update and compare domains.
- C. Develop a query that filters out all matching domain names.
- D. Implement a dashboard on the SIEM that shows the percentage of traffic by domain.
正解：A
解説：
Comprehensive and Detailed
The question addresses how a security analyst can compare legitimate domains with typosquatted domains using a SIEM (Security Information and Event Management) system.
Understanding Typosquatting:
Typosquatting involves registering domains with minor spelling changes to deceive users (e.g., goog1e.com instead of google.com).
Attackers use these domains in phishing emails or malicious ads.
Security analysts need to match legitimate domains against typosquatted domains in real-time.
Why Option B is Correct:
A parser is a tool that extracts structured data from logs.
In this case, a custom parser can identify domain names in network traffic logs and compare them to known typosquatted domains.
This approach enables real-time detection of suspicious domains in SIEM.
Why Other Options Are Incorrect:
A (Cron job for updates): A cron job automates scheduled tasks but does not perform real-time matching. It is inefficient for immediate detection.
C (Query to filter matching domains): A query alone can search for known domains, but it does not continuously enrich data or handle variations of domain names dynamically.
D (Dashboard to show domain traffic percentages): A dashboard provides visualization, not active threat detection. It does not analyze logs for typosquatting.
Reference:
CompTIA SecurityX CAS-005 Official Study Guide: Section on Threat Intelligence and SIEM Correlation MITRE ATT&CK Framework (T1583.006): Typosquatting & Domain Spoofing Techniques
質問 # 200
An organization that performs real-time financial processing is implementing a new backup solution. Given the following business requirements:
* The backup solution must reduce the risk of potential backup compromise.
* The backup solution must be resilient to a ransomware attack.
* The time to restore from backups is less important than backup data integrity.
* Multiple copies of production data must be maintained.
Which of the following backup strategies best meets these requirements?
- A. Creating a secondary, immutable database and adding live data on a continuous basis
- B. Setting up anti-tampering on the databases to ensure data cannot be changed unintentionally
- C. Utilizing two connected storage arrays and ensuring the arrays constantly sync
- D. Enabling remote journaling on the databases to ensure real-time transactions are mirrored
正解：A
解説：
An immutable database prevents modifications or deletions, ensuring resilience against ransomware while maintaining multiple copies of data.
質問 # 201
A company wants to install a three-tier approach to separate the web. database, and application servers A security administrator must harden the environment which of the following is the best solution?
- A. Configuring a SASb solution to restrict users to server communication
- B. Implementing microsegmentation on the server VLANs
- C. Deploying a VPN to prevent remote locations from accessing server VLANs
- D. installing a firewall and making it the network core
正解：B
解説：
The best solution to harden a three-tier environment (web, database, and application servers) is to implement microsegmentation on the server VLANs. Here's why:
Enhanced Security: Microsegmentation creates granular security zones within the data center, allowing for more precise control over east-west traffic between servers. This helps prevent lateral movement by attackers who may gain access to one part of the network.
Isolation of Tiers: By segmenting the web, database, and application servers, the organization can apply specific security policies and controls to each segment, reducing the risk of cross-tier attacks.
Compliance and Best Practices: Microsegmentation aligns with best practices for network security and helps meet compliance requirements by ensuring that sensitive data and systems are properly isolated and protected.
References:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
NIST Special Publication 800-125: Guide to Security for Full Virtualization Technologies CIS Controls: Control 12 - Boundary Defense
質問 # 202
Engineers are unable to control pumps at Site A from Site B when the SCADA controller at Site A experiences an outage. A security analyst must provide a secure solution that ensures Site A pumps can be controlled by a SCADA controller at Site B if a similar outage occurs again. Which of the following represents the most cost-effective solution?
- A. Configure VPN concentrators inside the OT network segments at Site A and Site B and allow the controllers to act as secondary devices for the other site's pumps across this encrypted tunnel.
- B. Procure direct fiber connectivity between Site A and Site B and limit its use to the critical SCADA controller traffic only
- C. Isolate the OT environment by providing an air-gapped network segment. Place the SCADA controller for each site in this network segment to minimize outages.
- D. Install backup SCADA controllers at each site, isolate them from the OT network, and assign these backup controllers as high-availability pairs.
正解：A
解説：
The most cost-effective and secure solution is to configure VPN concentrators inside the OT networks at both sites (Option D). This setup allows encrypted communications between Site A and Site B, enabling controllers at either site to serve as secondary or failover devices for the other. By leveraging VPN tunnels, the organization avoids the expensive and time-consuming process of laying new fiber infrastructure, while still ensuring secure, authenticated, and encrypted connections across sites.
Option A, direct fiber connectivity, provides high performance but is extremely costly and less flexible than VPN solutions. Option B, deploying redundant SCADA controllers at each site, increases hardware, licensing, and management costs while still requiring interconnectivity. Option C, air-gapping the OT network, may improve isolation but would prevent remote failover capabilities, contradicting the requirement for cross-site control.
By implementing VPN concentrators, the organization achieves secure cross-site redundancy, supports operational continuity in case of controller outages, and does so in a cost-effective manner aligned with common OT security practices.
質問 # 203
Audit findings indicate several user endpoints are not utilizing full disk encryption During me remediation process, a compliance analyst reviews the testing details for the endpoints and notes the endpoint device configuration does not support full disk encryption Which of the following is the most likely reason me device must be replaced'
- A. The motherboard was not configured with a TPM from the OEM supplier.
- B. The HSM is outdated and no longer supported by the manufacturer
- C. The vTPM was not properly initialized and is corrupt.
- D. The HSM is vulnerable to common exploits and a firmware upgrade is needed
- E. The HSM does not support sealing storage
正解：A
解説：
The most likely reason the device must be replaced is that the motherboard was not configured with a TPM (Trusted Platform Module) from the OEM (Original Equipment Manufacturer) supplier.
Why TPM is Necessary for Full Disk Encryption:
Hardware-Based Security: TPM provides a hardware-based mechanism to store encryption keys securely, which is essential for full disk encryption.
Compatibility: Full disk encryption solutions, such as BitLocker, require TPM to ensure that the encryption keys are securely stored and managed.
Integrity Checks: TPM enables system integrity checks during boot, ensuring that the device has not been tampered with.
Other options do not directly address the requirement for TPM in supporting full disk encryption:
A . The HSM is outdated: While HSM (Hardware Security Module) is important for security, it is not typically used for full disk encryption.
B . The vTPM was not properly initialized: vTPM (virtual TPM) is less common and not typically a reason for requiring hardware replacement.
C . The HSM is vulnerable to common exploits: This would require a firmware upgrade, not replacement of the device.
E . The HSM does not support sealing storage: Sealing storage is relevant but not the primary reason for requiring TPM for full disk encryption.
Reference:
CompTIA SecurityX Study Guide
"Trusted Platform Module (TPM) Overview," Microsoft Documentation
"BitLocker Deployment Guide," Microsoft Documentation
質問 # 204
A security analyst received a report that an internal web page is down after a company-wide update to the web browser Given the following error message:
Which of the following is the best way to fix this issue?
- A. Disabling all deprecated ciphers
- B. Blocking all non-essential pons
- C. Rewriting any legacy web functions
- D. Discontinuing the use of self-signed certificates
正解：D
解説：
The error message"NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM" indicates that the web browser is rejecting the certificate because it uses a weak signature algorithm. This commonly happens with self-signed certificates, which often use outdated or insecure algorithms.
Why Discontinue Self-Signed Certificates?
Security Compliance: Modern browsers enforce strict security standards and may reject certificates that do not comply with these standards.
Trusted Certificates: Using certificates from a trusted Certificate Authority (CA) ensures compliance with security standards and is less likely to be flagged as insecure.
Weak Signature Algorithm: Self-signed certificates might use weak algorithms like MD5 or SHA-1, which are considered insecure.
Other options do not address the specific cause of the certificate error:
A . Rewriting legacy web functions: Does not address the certificate issue.
B . Disabling deprecated ciphers: Useful for improving security but not related to the certificate error.
C . Blocking non-essential ports: This is unrelated to the issue of certificate validation.
Reference:
CompTIA SecurityX Study Guide
"Managing SSL/TLS Certificates," OWASP
"Best Practices for Certificate Management," NIST Special Publication 800-57
質問 # 205
An organization is planning for disaster recovery and continuity ofoperations, and has noted the following relevant findings:
1. A natural disaster may disrupt operations at Site A, which would then cause an evacuation. Users are unable to log into the domain from-their workstations after relocating to Site B.
2. A natural disaster may disrupt operations at Site A, which would then cause the pump room at Site B to become inoperable.
3. A natural disaster may disrupt operations at Site A, which would then cause unreliable internet connectivity at Site B due to route flapping.
INSTRUCTIONS
Match each relevant finding to the affected host by clicking on the host name and selecting the appropriate number.
For findings 1 and 2, select the items that should be replicated to Site B. For finding 3, select the item requiring configuration changes, then select the appropriate corrective action from the drop-down menu.
正解：
解説：
See the complete solution below in Explanation
Explanation:
Matching Relevant Findings to the Affected Hosts:
Finding 1:
Affected Host: DNS
Reason: Users are unable to log into the domain from their workstations after relocating to Site B, which implies a failure in domain name services that are critical for user authentication and domain login.
Finding 2:
Affected Host: Pumps
Reason: Thepump room at Site B becoming inoperable directly points to the critical infrastructure components associated with pumping operations.
Finding 3:
Affected Host: VPN Concentrator
Reason: Unreliable internet connectivity at Site B due to route flapping indicates issues with network routing, which is often managed by VPN concentrators that handle site-to-site connectivity.
Corrective Actions for Finding 3:
Finding 3 Corrective Action:
Action: Modify the BGP configuration
Reason: Route flapping is often related to issues with Border Gateway Protocol (BGP) configurations. Adjusting BGP settings can stabilize routes and improve internet connectivity reliability.
Replication to Site B for Finding 1:
Affected Host: DNS
Domain Name System (DNS) services are essential for translating domain names into IP addresses, allowing users to log into the network. Replicating DNS services ensures that even if Site A is disrupted, users at Site B can still authenticate and access necessary resources.
Replication to Site B for Finding 2:
Affected Host: Pumps
The operation of the pump room is crucial for maintaining various functions within the infrastructure. Replicating the control systems and configurations for the pumps at Site B ensures that operations can continue smoothly even if Site A is affected.
Configuration Changes for Finding 3:
Affected Host: VPN Concentrator
Route flapping is a situation where routes become unstable, causing frequent changes in the best path for data to travel. This instability can be mitigated by modifying BGP configurations to ensure more stable routing. VPN concentrators, which manage connections between sites, are typically configured with BGP for optimal routing.
Reference:
CompTIA Security+ Study Guide: This guide provides detailed information on disaster recovery and continuity of operations, emphasizing the importance of replicating critical services and making necessary configuration changes to ensure seamless operation during disruptions.
CompTIA Security+ Exam Objectives: These objectives highlight key areas in disaster recovery planning, including the replication of critical services and network configuration adjustments.
Disaster Recovery and Business Continuity Planning (DRBCP): This resource outlines best practices for ensuring that operations can continue at an alternate site during a disaster, including the replication of essential services and network stability measures.
By ensuring that critical services like DNS and control systems for pumps are replicated at the alternate site, and by addressing network routing issues through proper BGP configuration, the organization can maintain operational continuity and minimize the impact of natural disasters on their operations.
質問 # 206
A company plans to implement a research facility with Intellectual property data that should be protected The following is the security diagram proposed by the security architect
Which of the following security architect models is illustrated by the diagram?
- A. Zero Trust security model
- B. Perimeter protection security model
- C. Identity and access management model
- D. Agent based security model
正解：A
解説：
The security diagram proposed by the security architect depicts a Zero Trust security model. Zero Trust is a security framework that assumes all entities, both inside and outside the network, cannot be trusted and must be verified before gaining access to resources.
Key Characteristics of Zero Trust in the Diagram:
* Role-based Access Control: Ensures that users have access only to the resources necessary for their role.
* Mandatory Access Control: Additional layer of security requiring authentication for access to sensitive areas.
* Network Access Control: Ensures that devices meet security standards before accessing the network.
* Multi-factor Authentication (MFA): Enhances security by requiring multiple forms of verification.
This model aligns with the Zero Trust principles of never trusting and always verifying access requests, regardless of their origin.
References:
* CompTIA SecurityX Study Guide
* NIST Special Publication 800-207, "Zero Trust Architecture"
* "Implementing a Zero Trust Architecture," Forrester Research
質問 # 207
A security analyst reviews the following report:
Which of the following assessments is the analyst performing?
- A. System
- B. Organizational
- C. Quantitative
- D. Supply chain
正解：D
解説：
The table shows detailed information about products, including location, chassis manufacturer, OS, application developer, and vendor. This type of information is typically assessed in a supply chain assessment to evaluate the security and reliability of components and services from different suppliers.
Why Supply Chain Assessment?
Component Evaluation: Assessing the origin and security of each component used in the products, including hardware, software, and third-party services.
Vendor Reliability: Evaluating the security practices and reliability of vendors involved in providing components or services.
Risk Management: Identifying potential risks associated with the supply chain, such as vulnerabilities in third-party components or insecure development practices.
質問 # 208
A SOC analyst is investigating an event in which a penetration tester was able to successfully create and execute a payload. The analyst pulls the following command history from the affected server-
Which of the following should the analyst implement lo improve the security of the server?
- A. Application controls with allow lists
- B. OS restrictions of globally writable folders
- C. EDR signatures that terminate specific processes
- D. Kernel-supported ASLR controls
正解：A
解説：
The best way to mitigate the ability of attackers or penetration testers to execute arbitrary payloads is to enforce application controls with allow lists (B). Application allow listing ensures that only pre-approved, trusted software and scripts can be executed on the system. This prevents attackers from dropping or running malicious binaries, even if they exploit vulnerabilities to gain access. CAS-005 emphasizes allow listing as a preventive control against post-exploitation persistence and lateral movement.
Option A (ASLR) randomizes memory addresses and helps mitigate buffer overflow exploits but does not directly prevent execution of unauthorized programs. Option C (OS restrictions of globally writable folders) improves security hygiene but still does not stop attackers from executing already placed payloads in non-restricted locations. Option D (EDR signatures) are reactive and limited, since attackers often use novel or obfuscated payloads not yet captured by signature databases.
Therefore, implementing application controls with allow lists provides the strongest defense against unauthorized payload execution in this context.
質問 # 209
A large organization deployed a generative AI platform for its global user population to use. Based on feedback received during beta testing, engineers have identified issues with user interface latency and page- loading performance for international users. The infrastructure is currently maintained within two separate data centers, which are connected using high-availability networking and load balancers. Which of the following is the best way to address the performance issues?
- A. Configuring the application to use a CDN
- B. Remote journaling within a third data center
- C. Traffic shaping through the use of a SASE
- D. Implementing RASP to enable large language models queuing
正解：A
解説：
Comprehensive and Detailed Explanation:
A Content Delivery Network (CDN) caches and distributes static and dynamic web content across multiple geographically distributed edge servers, reducing latency for global users. This directly addresses page- loading delays caused by distance from the primary data centers.
* RASP is for runtime application security, not latency.
* Remote journaling is for data replication, not performance optimization.
* SASE can improve security and WAN routing, but a CDN is purpose-built for content delivery performance.
質問 # 210
During a vendor assessment, an analyst reviews a listing of the complementary user entity controls included in the audit report. Which of the following is the most important aspect to consider when reviewing this list with the security team?
- A. How the CSP performs the controls on behalf of the user entity
- B. How the organization will implement and monitor the user entity controls
- C. How the organization should monitor the CSP's execution of the user entity controls
- D. How the user entity will audit the CSP's implementation of the user entity controls
正解：B
解説：
User entity controls are responsibilities that must be implemented by the organization, so determining how to implement and monitor them is critical.
Monitoring the CSP or auditing their implementation pertains to the CSP's responsibilities, not complementary user entity controls.
質問 # 211
A company's help desk is experiencing a large number of calls from the finance department slating access issues to www bank com The security operations center reviewed the following security logs:
Which of the following is most likely the cause of the issue?
- A. DNS traffic is being sinkholed.
- B. Recursive DNS resolution is failing
- C. The DNS was set up incorrectly.
- D. The DNS record has been poisoned.
正解：A
解説：
Sinkholing, or DNS sinkholing, is a method used to redirect malicious traffic to a safe destination. This technique is often employed by security teams to prevent access to malicious domains by substituting a benign destination IP address.
In the given logs, users from the finance department are accessing www.bank.com and receiving HTTP status code 495. This status code is typically indicative of a client certificate error, which can occur if the DNS traffic is being manipulated or redirected incorrectly. The consistency in receiving the same HTTP status code across different users suggests a systematic issue rather than an isolated incident.
Recursive DNS resolution failure (A) would generally lead to inability to resolve DNS at all, not to a specific HTTP error.
DNS poisoning (B) could result in usersbeing directed to malicious sites, but again, would likely result in a different set of errors or unusual activity.
Incorrect DNS setup (D) would likely cause broader resolution issues rather than targeted errors like the one seen here.
By reviewing the provided data, it is evident that the DNS traffic for www.bank.com is being rerouted improperly, resulting in consistent HTTP 495 errors for the finance department users. Hence, the most likely cause is that the DNS traffic is being sinkholed.
References:
CompTIA SecurityX study materials on DNS security mechanisms.
Standard HTTP status codes and their implications.
質問 # 212
A company that uses several cloud applications wants to properly identify:
All the devices potentially affected by a given vulnerability.
All the internal servers utilizing the same physical switch.
The number of endpoints using a particular operating system.Which of the following is the best way to meet the requirements?
- A. CMDB
- B. CASB
- C. SBoM
- D. GRC
正解：A
解説：
The requirements demand detailed asset tracking and inventory management. Let's analyze:
A). SBoM (Software Bill of Materials):Tracks software components, not hardware or network topology.
B). CASB (Cloud Access Security Broker):Secures cloud apps but doesn't map physical switches or OS counts.
C). GRC(Governance, Risk, and Compliance):Focuses on risk management, not detailed asset tracking.
Reference:CompTIA SecurityX (CAS-005) objectives, Domain 4: Governance, Risk, and Compliance, covering asset management.
質問 # 213
......
リアル問題集で100%無料CAS-005試験問題集を試そう：https://jp.fast2test.com/CAS-005-premium-file.html
実際のCAS-005問題集最新練習テスト問題集：https://drive.google.com/open?id=1YdrDI0qdbomTtf5TiblD4IAo0doMkkzk