万が一CAS-003試験に不合格となった場合、再受験には改めて受験料が必要になり、費用面の負担も無視できません。PassTestのCompTIA Advanced Security Practitioner (CASP)練習問題で本番さながらの演習を重ね、一度で合格に近づく準備を整えましょう。

CompTIA CAS-003 試験概要:

CompTIA CAS-003 試験シラバストピック:

CAS-003 試験に関してよくいただくご質問

CompTIA Advanced Security Practitioner (CASP) 認定 CAS-003 試験問題：

問題 #1

An organization, which handles large volumes of PII, allows mobile devices that can process, store, and transmit PII and other sensitive data to be issued to employees. Security assessors can demonstrate recovery and decryption of remnant sensitive data from device storage after MDM issues a successful wipe command. Assuming availability of the controls, which of the following would BEST protect against the loss of sensitive data in the future?

A. Implement a container that wraps PII data and stores keying material directly in the container's encrypted application space.
B. Use encryption keys for sensitive data stored in an eF use-backed memory space that is blown during remote wipe.
C. Issue devices that employ a stronger algorithm for the authentication of sensitive data stored on them.
D. Procure devices that remove the bootloader binaries upon receipt of an MDM-issued remote wipe command.

問題 #2

A new security policy states all wireless and wired authentication must include the use of certificates when connecting to internal resources within the enterprise LAN by all employees.
Which of the following should be configured to comply with the new security policy? (Choose two.)

A. Push-based authentication
B. New pre-shared key
C. 802.1X
D. OAuth
E. SSO
F. PKI

問題 #3

A systems administrator has installed a disk wiping utility on all computers across the organization and configured it to perform a seven-pass wipe and an additional pass to overwrite the disk with zeros. The company has also instituted a policy that requires users to erase files containing sensitive information when they are no longer needed.
To ensure the process provides the intended results, an auditor reviews the following content from a randomly selected decommissioned hard disk:

Which of the following should be included in the auditor's report based on the above findings?

A. The data represents part of the disk BIOS.
B. The disk has been degaussed.
C. The hard disk contains bad sectors
D. Sensitive data might still be present on the hard drives.

問題 #4

The government is concerned with remote military missions being negatively impacted by the use of technology that may fail to protect operational security. To remediate this concern, a number of solutions have been implemented, including the following:
* End-to-end encryption of all inbound and outbound communication, including personal email and chat sessions that allow solders to securely communicate with families
* Layer 7 inspection and TCP/UDP port restriction, including firewall rules to only allow TCP port 80 and 443 and approved applications
* A host-based whitelist of approved websites and applications that only allow mission-related tools and sites
* The use of satellite communication to include multiple proxy servers to scramble the source IP address Which of the following is of MOST concern in this scenario?

A. The use of centrally managed military network and computers by solders when communicating with external parties
B. The effect of communication latency that may negatively impact real-time communication with mission control
C. The unsecure port 80 being used for general web traffic
D. Family members posting geotagged images on social media that were received via email from solders

問題 #5

Given the following:

Which of the following vulnerabilities is present in the above code snippet?

A. DOM-based injection
B. SQL-based string concatenation
C. Information disclosure in comments
D. Disclosure of database credential

解説：