CS0-004問題集、CompTIA実際の試験問題

質問 1

Which of the following contains stakeholder contact information for incident response reporting?

A. The communication plan

B. The standard operating procedures

C. The last incident report

D. The company organization chart

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 2

Which of the following best explains the purpose of the Pyramid of Pain in threat intelligence?

A. To measure how much operational damage a threat actor can cause before detection occurs

B. To organize attack activity into categories such as spoofing, tampering, and repudiation

C. To show that changing to different types of indicators and behaviors is difficult for an adversary

D. To compare open-source intelligence (OSINT) with closed-source intelligence based on collection cost

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 3

An incident response team investigates a possible data leak. Various IT systems collect evidence. Which of the following processes is required to ensure that evidentiary artifacts are properly recorded?

A. Post incident reporting

B. Storage and containment

C. Chain of custody

D. Packaging and labeling

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 4

A vulnerability analyst conducts a web application scan on an asset sitting behind a load balancer configured as a pass through:
http://10.203.20.10
The analyst launches the Zed Attack Proxy (ZAP) utility, conducts a scan, and receives the following alert:

Which of the following should the analyst propose as a remediation to the finding while keeping the site operational?

A. Ensure the web server host-based firewall is configured to block HTTP incoming traffic.

B. Ensure the web application is configured to suppress the "Server" header.

C. Ensure the load balancer is configured with online certificate status protocol (OCSP) stapling.

D. Ensure the Hypertext Transfer Protocol (HTTP) endpoint is protected with a network firewall with geo-blocking.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 5

Based on recent alerts, a security analyst thinks a web application server was compromised. The analyst reviews the following server output:

Which of the following best describes what has occurred?

A. High resource consumption

B. Abnormal idle times for each user

C. An initiated unauthorized session

D. Too many users logged in at the same time

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 6

A security analyst is reviewing an alert about connections from an IT member to the Chief Privacy Officer's (CPO) laptop. There was abnormal network traffic from the CPO's laptop to an unknown server located in the IT legacy network and then to an unknown internet location. Based on the following information:

Which of the following best categorizes the detected activity?

A. Service disruption

B. Unauthorized access

C. Malicious insider

D. Command-and-control

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 7

A new policy prohibits external access to database servers. A recent external port scan identified the following open Transmission Control Protocol (TCP) ports:
- 21
- 25
- 68
- 80
- 389
- 443
- 587
- 1514
- 3306
- 3389
- 8080
Which of the ports must be closed to be compliant with the new policy? (Choose two.)

A. 25

B. 3306

C. 8080

D. 587

E. 3389

F. 1514

正解: B,E

解説: (PassTest メンバーにのみ表示されます)

質問 8

A security architect reviews a report from a third-party incident response consultant and observes the following:

Which of the following frameworks did the consultant use to perform analysis?

A. Cyber Kill Chain

B. Diamond Model of Intrusion Analysis

C. Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege (STRIDE)

D. MITRE ATT&CK

E. National Institute of Standards and Technology (NIST) Cybersecurity Framework

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 9

A security operations center (SOC) manager reviews a document signed by the Chief Financial Officer (CFO), the sales director, and a customer to decide whether a contract breach occurred.
Which of the following best describes the document that includes key performance indicators (KPIs)?

A. Return on investment report

B. Service-level agreement (SLA)

C. Risk management plan

D. Tactics, techniques, and procedures (TTPs)

E. Memorandum of understanding

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 10

Which of the following is the IR activity in which process gaps are identified?

A. User training

B. Tabletop exercise

C. Root cause analysis

D. Lessons learned

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 11

A security director at a remote company is concerned about recent threat intelligence reports regarding threat actors who are hired by the company and steal intellectual property. Which of the following solutions are the best ways to identify the tactics, techniques, and procedures (TTPs) used by these threat actors? (Choose two.)

A. Validating identification information manually

B. Deploying a fully featured endpoint detection and response (EDR)

C. Utilizing user behavioral analytics-based detections implemented in the security information and event management (SIEM)

D. Conducting thorough background checks on all incoming employees

E. Subscribing to an identity proofing service for all employees

F. Installing and configuring a data loss prevention tool

正解: B,C

解説: (PassTest メンバーにのみ表示されます)

質問 12

Which of the following will most likely help decrease false positives?

A. A security operations center (SOC) dashboard

B. Threat hunting

C. Alert tuning

D. Automating escalation

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 13

A security operations center manager is concerned that after action reporting is not being completed in a timely manner. Which of the following will allow the manager to quantify this concern?

A. Mean time to respond

B. Mean time to remediate

C. Mean time between failures

D. Mean time to close

正解: D

解説: (PassTest メンバーにのみ表示されます)

CompTIA Cybersecurity Analyst (CySA+) Certification - CS0-004 模擬練習