CompTIA Advanced Security Practitioner 認定 CAS-001 試験問題:

1. As part of the ongoing information security plan in a large software development company, the Chief Information officer (CIO) has decided to review and update the company's privacy policies and procedures to reflect the changing business environment and business requirements.
Training and awareness of the new policies and procedures has been incorporated into the security awareness program which should be:

A) customized for the various departments and staff roles.
B) presented by top level management to only data handling staff.
C) technical in nature to ensure all development staff understand the procedures.
D) used to promote the importance of the security department.

2. A growing corporation is responding to the needs of its employees to access corporate email and other resources while traveling. The company is implementing remote access for company laptops. Which of the following security systems should be implemented for remote access? (Select TWO).

A) Multifactor authentication for users
B) Network monitoring
C) Full disk encryption
D) Virtual Private Network
E) Intrusion detection systems
F) Secure Sockets Layer for web servers

3. The risk manager has requested a security solution that is centrally managed, can easily be updated, and protects end users' workstations from both known and unknown malicious attacks when connected to either the office or home network. Which of the following would BEST meet this requirement?

A) NIPS
B) HIPS
C) UTM
D) Antivirus
E) DLP

4. A replacement CRM has had its business case approved. In preparation for a requirements workshop, an architect is working with a business analyst to ensure that appropriate security requirements have been captured. Which of the following documents BEST captures the security requirements?

A) Requirements traceability matrix document
B) Business requirements document
C) Use case and viewpoints document
D) Solution overview document

5. Company XYZ has purchased and is now deploying a new HTML5 application. The company wants to hire a penetration tester to evaluate the security of the client and server components of the proprietary web application before launch. Which of the following is the penetration tester MOST likely to use while performing black box testing of the security of the company's purchased application? (Select TWO).

A) Fuzzer
B) Sandbox
C) Local proxy
D) Code review
E) Web vulnerability scanner

質問と回答：