1175 お客様のコメント
クリック」
質問 1：
A business stores personal client data of individuals residing in the EU in order to process requests for mortgage loan approvals.
Which of the following does the business's IT manager need to consider?
A. The availability of personal data
B. The company's annual revenue
C. The language of the web application
D. The right to personal data erasure
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 2：
A security analyst is trying to identify the source of a recent data loss incident. The analyst has reviewed all the for the time surrounding the identified all the assets on the network at the timeof the data loss. The analyst suspects the key to finding the source was obfuscated in an application. Which of the following tools should the analyst use NEXT?
A. Log reduction and analysis tool
B. Software Decomplier
C. Static code analysis
D. Network enurrerator
正解：C
質問 3：
You have received a report that some users are unable to use their personal devices to authenticate to a protected corporate website. The users have stated that no changes have been made on their personal devices since the last time they were able to authenticate successfully.
INSTRUCTIONS
Examine the device health policy for the MFA solution, the MFA usage logs, and the device telemetry. Using that information:
. Select the policy/policies that were violated.
. Select the telemetry log(s) that
explain(s) the policy violations.
正解：
See the solution below in explanation part.
Explanation:
Step 1: Understand the Scenario
Issue:Userscannot authenticateusing personal devices.User claim:No changes have been made to their devices since they were last able to authenticate.
Step 2: Review the Policy Settings
From theGlobal settingstable:
#Enabled Policies:
Anonymous networks:Blocks Tor (#)
Operating systems:Blocks:
Android 8.1.0 and below
iOS 13.7 and below
Windows 7 and below
Chrome OS (all)
BlackBerry (all)
Authentication method:Push only (#)
User location:Only allows regions:
NORTHAMERICA-REGION-7
NORTHAMERICA-REGION-10
NORTHAMERICA-REGION-11
NORTHAMERICA-REGION-12
Disabled Policies:
Browser restriction(Chrome, Firefox, Edge) isdisabled(i.e., any browser is allowed) New user policyisdisabled
#Step 3: Examine the Authentication Results Table
From the access log table:
Subject
Result
Access object
Jacob
Deny - context
Sales_application
Bob
Time-out
IT_intelligence_svc
Jane
Deny - context
Accounting_database
Jenny
Time-out
Sales_application
These four failed. Let's match them with policies.
#Step 4: Correlate With Telemetry Logs
#Jacob:
OS:iOS 13.0 #Below 13.7##Violation ofOperating System policy
Location:REGION not specified fully, assume okay unless proven otherwise#Policy violated:Operating system
#Bob:
OS:Android 10 ##Allowed
Location:NORTHAMERICA-REGION-12 ##Allowed
Behavior:Time-outThis could be aconnectivityorpush timeout, not policy violation.##Not due to policy violation
#Jane:
OS:iOS 14.2 ##Allowed
Location:NORTHAMERICA-REGION-6 ##Not in allowed regions#Policy violated:User location
#Jenny:
OS:Android 10 ##Allowed
Location:NORTHAMERICA-REGION-6 ##Not in allowed regions#Policy violated:User location
#Step 5: Final Answer
Violated Policies:
#Operating Systems# Violated byJacob
#User Location# Violated byJaneandJenny
Telemetry Logs that explain violations:
#Log 3- Jacob (OS iOS 13.0 # blocked)
#Log 6- Jane (Region 6 # blocked)
#Log 7- Jenny (Region 6 # blocked)
##Final Answer Summary:
Policies Violated:
#Operating systems
#User location
Relevant Telemetry Logs:
#Jacob # Log 3
#Jane # Log 6
#Jenny # Log 7
質問 4：
An administrator completed remediation for all the findings of a penetration test and notifies the management team that the systems are ready to be placed back into production. Which of the following steps should the management team require the analyst to perform immediately before placing the systems back into production?
A. Ensure a host-based IPS is in place.
B. Conduct the entire penetration test again.
C. Harden the targeted systems.
D. Rescan for corrections/changes.
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 5：
A security engineer is creating a single CSR for the following web server hostnames:
* wwwint internal
* www company com
* home.internal
* www internal
Which of the following would meet the requirement?
A. Issuer
B. CN
C. SAN
D. CA
E. CRL
正解：C
解説: (Pass4Test メンバーにのみ表示されます)
質問 6：
A security analyst wants to keep track of alt outbound web connections from workstations. The analyst's company uses an on-premises web filtering solution that forwards the outbound traffic to a perimeter firewall.
When the security analyst gets the connection events from the firewall, the source IP of the outbound web traffic is the translated IP of the web filtering solution. Considering this scenario involving source NAT.
which of the following would be the BEST option to inject in the HTTP header to include the real source IP from workstations?
A. X-Forwarded-Proto
B. Content-Security-Policy
C. Cache-Control
D. X-Forwarded-For
E. Strict-Transport-Security
正解：D
質問 7：
A security engineer is reviewing a record of events after a recent data breach incident that Involved the following:
* A hacker conducted reconnaissance and developed a footprint of the company s Internet-facing web application assets.
* A vulnerability in a third-party horary was exploited by the hacker, resulting in the compromise of a local account.
* The hacker took advantage of the account's excessive privileges to access a data store and exfiltrate the data without detection.
Which of the following is the BEST solution to help prevent this type of attack from being successful in the future?
A. Secure web gateway
B. Stateful firewall
C. Software composition analysis
D. Dynamic analysis
E. User behavior analysis
正解：C
解説: (Pass4Test メンバーにのみ表示されます)
質問 8：
Law enforcement officials informed an organization that an investigation has begun. Which of the following is the FIRST step the organization should take?
A. Perform e-discovery.
B. Review the subpoena
C. Refer to the retention policy
D. Initiate a legal hold.
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 9：
A security team received a regulatory notice asking for information regarding collusion and pricing from staff members who are no longer with the organization. The legal department provided the security team with a list of search terms to investigate.
This is an example of:
A. legal hold.
B. due care.
C. e-discovery.
D. due intelligence
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
A business stores personal client data of individuals residing in the EU in order to process requests for mortgage loan approvals.
Which of the following does the business's IT manager need to consider?
A. The availability of personal data
B. The company's annual revenue
C. The language of the web application
D. The right to personal data erasure
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 2：
A security analyst is trying to identify the source of a recent data loss incident. The analyst has reviewed all the for the time surrounding the identified all the assets on the network at the timeof the data loss. The analyst suspects the key to finding the source was obfuscated in an application. Which of the following tools should the analyst use NEXT?
A. Log reduction and analysis tool
B. Software Decomplier
C. Static code analysis
D. Network enurrerator
正解：C
質問 3：
You have received a report that some users are unable to use their personal devices to authenticate to a protected corporate website. The users have stated that no changes have been made on their personal devices since the last time they were able to authenticate successfully.
INSTRUCTIONS
Examine the device health policy for the MFA solution, the MFA usage logs, and the device telemetry. Using that information:
. Select the policy/policies that were violated.
. Select the telemetry log(s) that
explain(s) the policy violations.
正解：
See the solution below in explanation part.
Explanation:
Step 1: Understand the Scenario
Issue:Userscannot authenticateusing personal devices.User claim:No changes have been made to their devices since they were last able to authenticate.
Step 2: Review the Policy Settings
From theGlobal settingstable:
#Enabled Policies:
Anonymous networks:Blocks Tor (#)
Operating systems:Blocks:
Android 8.1.0 and below
iOS 13.7 and below
Windows 7 and below
Chrome OS (all)
BlackBerry (all)
Authentication method:Push only (#)
User location:Only allows regions:
NORTHAMERICA-REGION-7
NORTHAMERICA-REGION-10
NORTHAMERICA-REGION-11
NORTHAMERICA-REGION-12
Disabled Policies:
Browser restriction(Chrome, Firefox, Edge) isdisabled(i.e., any browser is allowed) New user policyisdisabled
#Step 3: Examine the Authentication Results Table
From the access log table:
Subject
Result
Access object
Jacob
Deny - context
Sales_application
Bob
Time-out
IT_intelligence_svc
Jane
Deny - context
Accounting_database
Jenny
Time-out
Sales_application
These four failed. Let's match them with policies.
#Step 4: Correlate With Telemetry Logs
#Jacob:
OS:iOS 13.0 #Below 13.7##Violation ofOperating System policy
Location:REGION not specified fully, assume okay unless proven otherwise#Policy violated:Operating system
#Bob:
OS:Android 10 ##Allowed
Location:NORTHAMERICA-REGION-12 ##Allowed
Behavior:Time-outThis could be aconnectivityorpush timeout, not policy violation.##Not due to policy violation
#Jane:
OS:iOS 14.2 ##Allowed
Location:NORTHAMERICA-REGION-6 ##Not in allowed regions#Policy violated:User location
#Jenny:
OS:Android 10 ##Allowed
Location:NORTHAMERICA-REGION-6 ##Not in allowed regions#Policy violated:User location
#Step 5: Final Answer
Violated Policies:
#Operating Systems# Violated byJacob
#User Location# Violated byJaneandJenny
Telemetry Logs that explain violations:
#Log 3- Jacob (OS iOS 13.0 # blocked)
#Log 6- Jane (Region 6 # blocked)
#Log 7- Jenny (Region 6 # blocked)
##Final Answer Summary:
Policies Violated:
#Operating systems
#User location
Relevant Telemetry Logs:
#Jacob # Log 3
#Jane # Log 6
#Jenny # Log 7
質問 4：
An administrator completed remediation for all the findings of a penetration test and notifies the management team that the systems are ready to be placed back into production. Which of the following steps should the management team require the analyst to perform immediately before placing the systems back into production?
A. Ensure a host-based IPS is in place.
B. Conduct the entire penetration test again.
C. Harden the targeted systems.
D. Rescan for corrections/changes.
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 5：
A security engineer is creating a single CSR for the following web server hostnames:
* wwwint internal
* www company com
* home.internal
* www internal
Which of the following would meet the requirement?
A. Issuer
B. CN
C. SAN
D. CA
E. CRL
正解：C
解説: (Pass4Test メンバーにのみ表示されます)
質問 6：
A security analyst wants to keep track of alt outbound web connections from workstations. The analyst's company uses an on-premises web filtering solution that forwards the outbound traffic to a perimeter firewall.
When the security analyst gets the connection events from the firewall, the source IP of the outbound web traffic is the translated IP of the web filtering solution. Considering this scenario involving source NAT.
which of the following would be the BEST option to inject in the HTTP header to include the real source IP from workstations?
A. X-Forwarded-Proto
B. Content-Security-Policy
C. Cache-Control
D. X-Forwarded-For
E. Strict-Transport-Security
正解：D
質問 7：
A security engineer is reviewing a record of events after a recent data breach incident that Involved the following:
* A hacker conducted reconnaissance and developed a footprint of the company s Internet-facing web application assets.
* A vulnerability in a third-party horary was exploited by the hacker, resulting in the compromise of a local account.
* The hacker took advantage of the account's excessive privileges to access a data store and exfiltrate the data without detection.
Which of the following is the BEST solution to help prevent this type of attack from being successful in the future?
A. Secure web gateway
B. Stateful firewall
C. Software composition analysis
D. Dynamic analysis
E. User behavior analysis
正解：C
解説: (Pass4Test メンバーにのみ表示されます)
質問 8：
Law enforcement officials informed an organization that an investigation has begun. Which of the following is the FIRST step the organization should take?
A. Perform e-discovery.
B. Review the subpoena
C. Refer to the retention policy
D. Initiate a legal hold.
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 9：
A security team received a regulatory notice asking for information regarding collusion and pricing from staff members who are no longer with the organization. The legal department provided the security team with a list of search terms to investigate.
This is an example of:
A. legal hold.
B. due care.
C. e-discovery.
D. due intelligence
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
いし** -
CAS-004習得しやすいですね。今回は合格なので、次回受験するCAS-005もここPass4Testで購入させて頂きます。