最新のCAP実際の無料試験問題更新された60問あります
無料で使えるCAP試験ブレーン問題集認定ガイドの問題と解答
The SecOps Group CAP 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
| トピック 6 |
|
| トピック 7 |
|
| トピック 8 |
|
| トピック 9 |
|
| トピック 10 |
|
| トピック 11 |
|
| トピック 12 |
|
| トピック 13 |
|
| トピック 14 |
|
| トピック 15 |
|
| トピック 16 |
|
| トピック 17 |
|
| トピック 18 |
|
| トピック 19 |
|
質問 # 10
You are the project manager of a large construction project. Part of the project involves the wiring of the electricity in the building your project is creating. You and the project team determine the electrical work is too dangerous to perform yourself so you hire an electrician to perform the work for the project. This is an example of what type of risk response?
- A. Mitigation
- B. Transference
- C. Avoidance
- D. Acceptance
正解：B
質問 # 11
The Phase 2 of DITSCAP C&A is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and accreditation. What are the process activities of this phase?
Each correct answer represents a complete solution. Choose all that apply.
- A. Configuring refinement of the SSAA
- B. Registration
- C. Assessment of the Analysis Results
- D. System development
- E. Certification analysis
正解：A、C、D、E
解説：
Section: Volume A
質問 # 12
You are the project manager of the GGG project. You have completed the risk identification process for the initial phases of your project. As you begin to document the risk events in the risk register what additional information can you associate with the identified risk events?
- A. Risk cost
- B. Risk schedule
- C. Risk owner
- D. Risk potential responses
正解：D
解説：
Section: Volume B
質問 # 13
Bill is the project manager of the JKH Project. He and the project team have identified a risk event in the project with a high probability of occurrence and the risk event has a high cost impact on the project. Bill discusses the risk event with Virginia, the primary project customer, and she decides that the requirements surrounding the risk event should be removed from the project. The removal of the requirements does affect the project scope, but it can release the project from the high risk exposure. What risk response has been enacted in this project?
- A. Avoidance
- B. Mitigation
- C. Transference
- D. Acceptance
正解：A
解説：
Section: Volume B
Explanation/Reference:
質問 # 14
Which of the following acts promote a risk-based policy for cost effective security?
Each correct answer represents a part of the solution. Choose all that apply.
- A. Paperwork Reduction Act (PRA)
- B. Lanham Act
- C. Computer Misuse Act
- D. Clinger-Cohen Act
正解：A、D
質問 # 15
Which of the following assessment methods involves observing or conducting the operation of physical devices?
- A. Testing
- B. Examination
- C. Interview
- D. Deviation
正解：A
質問 # 16
The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE?
Each correct answer represents a complete solution. Choose all that apply.
- A. An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).
- B. An ISSE manages the security of the information system that is slated for Certification & Accreditation (C&A).
- C. An ISSE provides advice on the continuous monitoring of the information system.
- D. An ISSO takes part in the development activities that are required to implement system changes.
- E. An ISSE provides advice on the impacts of system changes.
正解：A、C、E
解説：
Section: Volume A
Explanation/Reference:
質問 # 17
In which of the following DIACAP phases is residual risk analyzed?
- A. Phase 1
- B. Phase 4
- C. Phase 2
- D. Phase 5
- E. Phase 3
正解：B
質問 # 18
Wendy is about to perform qualitative risk analysis on the identified risks within her project. Which one of the following will NOT help Wendy to perform this project management activity?
- A. Project scope statement
- B. Risk register
- C. Stakeholder register
- D. Risk management plan
正解：C
質問 # 19
Which of the following individuals makes the final accreditation decision?
- A. CIO
- B. ISSO
- C. CISO
- D. DAA
正解：D
質問 # 20
Courtney is the project manager for her organization. She is working with the project team to complete the qualitative risk analysis for her project. During the analysis Courtney encourages the project team to begin the grouping of identified risks by common causes. What is the primary advantage to group risks by common causes during qualitative risk analysis?
- A. It helps the project team realize the areas of the project most laden with risks.
- B. It can lead to the creation of risk categories unique to each project.
- C. It saves time by collecting the related resources, such as project team members, to analyze the risk events.
- D. It can lead to developing effective risk responses.
正解：D
解説：
Section: Volume B
質問 # 21
Which of the following statements correctly describes DIACAP residual risk?
- A. It is the technical implementation of the security design.
- B. It is the remaining risk to the information system after risk palliation has occurred.
- C. It is used to validate the information system.
- D. It is a process of security authorization.
正解：B
解説：
Section: Volume D
Explanation/Reference:
質問 # 22
You found the xmrpc.php endpoint while performing a security assessment on a web application. The target application is most likely using which of the following Content Management Systems (CMS)?
- A. Both A and B
- B. None of the above
- C. WordPress
- D. Drupal
正解：C
解説：
The xmlrpc.php endpoint is a file commonly associated with WordPress, a popular Content Management System (CMS). XML-RPC (XML Remote Procedure Call) is a protocol used for remote communication, and in WordPress, xmlrpc.php enables features like remote publishing, pingbacks, and trackbacks. However, it is also a frequent target for attacks (e.g., brute-force attacks, DDoS) if not properly secured or disabled when unnecessary. While other CMS platforms like Drupal may support XML-RPC, they typically do not use a file named xmlrpc.php by default; Drupal's XML-RPC functionality is often integrated into its core or modules (e.
g., via xmlrpc.module) and uses different endpoints.
* Option A ("WordPress"): Correct, as xmlrpc.php is a hallmark of WordPress installations.
* Option B ("Drupal"): Incorrect, as Drupal does not use xmlrpc.php by default; its XML-RPC endpoints are different.
* Option C ("Both A and B"): Incorrect, as xmlrpc.php is specific to WordPress.
* Option D ("None of the above"): Incorrect, as WordPress is the correct match.
The correct answer is A, aligning with the CAP syllabus under "CMS Security" and "WordPress Vulnerabilities."References: SecOps Group CAP Documents - "Content Management System Security,"
"WordPress Hardening," and "OWASP CMS Security Guide" sections.
質問 # 23
In the screenshot below, an attacker is attempting to exploit which vulnerability?
POST /upload.php HTTP/1.1
Host: example.com
Cookie: session=xyz123;JSESSIONID=abc123
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) rv:107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW Content-Length: 12345 Connection: keep-alive Content-Disposition: form-data; name="avatar"; filename="malicious.php" Content-Type: image/jpeg
<?php
phpinfo();
?>
- A. File Upload Vulnerability
- B. HTTP Desync Attack
- C. Server-Side Request Forgery
- D. File Path Traversal Attack
正解：A
解説：
The screenshot shows an HTTP POST request to /upload.php with a multipart/form-data payload, where the attacker uploads a file named malicious.php disguised as an image/jpeg but containing PHP code (<?php phpinfo(); ?>). This indicates an attempt to exploit aFile Upload Vulnerability. Such vulnerabilities occur when an application allows users to upload files without proper validation or sanitization, enabling attackers to upload malicious scripts (e.g., PHP) that can be executed on the server. In this case, if the server executes the uploaded malicious.php, it could expose server information via phpinfo() or perform other malicious actions.
Option A ("HTTP Desync Attack") involves manipulating HTTP request pipelines, which is not relevant here as the request appears standard. Option B ("File Path Traversal Attack") involves accessing unauthorized files using ../, which is not evident in this request. Option D ("Server-Side Request Forgery") involves tricking the server into making unintended requests, which does not apply to file uploads. Thus, C is the correct answer, aligning with the CAP syllabus under "File Handling Security" and "OWASP Top 10 (A05:2021 - Security Misconfiguration)."References: SecOps Group CAP Documents - "File Upload Vulnerabilities," "Input Validation," and "OWASP Top 10" sections.
質問 # 24
Which HTTP header is used by the CORS (Cross-origin resource sharing) standard to control access to resources on a server?
- A. None of the above
- B. Access-Control-Allow-Headers
- C. Access-Control-Request-Method
- D. Access-Control-Request-Headers
正解：B
解説：
Cross-Origin Resource Sharing (CORS) is a security mechanism that allows servers to specify which origins can access their resources, relaxing the Same-Origin Policy (SOP) for legitimate cross-origin requests. CORS uses specific HTTP headers to control this access. The key header for controlling access to resources isAccess- Control-Allow-Origin, which specifies which origins are permitted to access the resource. However, among the provided options, the closest related header isAccess-Control-Allow-Headers, which is part of the CORS standard and controls which request headers can be used in the actual request (e.g., during a preflight OPTIONS request).
* Option A ("Access-Control-Request-Method"): This header is sent by the client in a preflight request to indicate the HTTP method (e.g., GET, POST) that will be used in the actual request. It is not used by the server to control access.
* Option B ("Access-Control-Request-Headers"): This header is sent by the client in apreflight request to list the headers it plans to use in the actual request. It is not used by the server to control access.
* Option C ("Access-Control-Allow-Headers"): This header is sent by the server in response to a preflight request, specifying which headers are allowed in the actual request. While Access-Control- Allow-Origin is the primary header for controlling access, Access-Control-Allow-Headers is part of the CORS standard to manage header-based access control, making this the best match among the options.
* Option D ("None of the above"): Incorrect, as Access-Control-Allow-Headers is a CORS header.
The correct answer is C, aligning with the CAP syllabus under "CORS Security" and "HTTP Headers." References: SecOps Group CAP Documents - "CORS Configuration," "Security Headers," and "OWASP Secure Headers Guide" sections.
質問 # 25
There are seven risk responses for any project. Which one of the following is a valid risk response for a negative risk event?
- A. Exploit
- B. Acceptance
- C. Enhance
- D. Share
正解：B
解説：
Section: Volume C
質問 # 26
......
CAP認定概要最新のCAPのPDF問題集：https://www.passtest.jp/The-SecOps-Group/CAP-shiken.html
トップクラスThe SecOps Group CAP試験材料で学習ガイド！練習問題バージョン：https://drive.google.com/open?id=1hlWPeC06-vOX6m-TBubMWrzUKWl8tLX7