CAS-002 試験問題を無料オンラインアクセス

The DLP solution has been showing some unidentified encrypted data being sent using FTP to a remote server. A vulnerability scan found a collection of Linux servers that are missing OS level patches. Upon further investigation, a technician notices that there are a few unidentified processes running on a number of the servers. What would be a key FIRST step for the data security team to undertake at this point?

• A.Notify upper management of a security breach.
• B.Remove a single Linux server from production and place in quarantine.
• C.Conduct a bit level image, including RAM, of one or more of the Linux servers.
• D.Reboot the Linux servers, check running processes, and install needed patches.
• E.Capture process ID data and submit to anti-virus vendor for review.

A data breach has occurred at Company A and as a result, the Chief Information Officer (CIO) has resigned. The CIO's laptop, cell phone and PC were all wiped of data per company policy. A month later, prosecutors in litigation with Company A suspect the CIO knew about the data breach long before it was discovered and have issued a subpoena requesting all the CIO's email from the last 12 months. The corporate retention policy recommends keeping data for no longer than 90 days. Which of the following should occur?

• A.Inform the litigators that the CIOs information has been deleted as per corporate policy.
• B.Restore the CIO's email from an email server backup and provide the last 90 days from the date of the CIO resignation.
• C.Restore the CIO's email from an email server backup and provide the last 90 days from the date of the subpoena request.
• D.Restore the CIO's email from an email server backup and provide whatever is available up to the last 12 months from the subpoena date.

Joe is a security architect who is tasked with choosing a new NIPS platform that has the ability to perform SSL inspection, analyze up to 10Gbps of traffic, can be centrally managed and only reveals inspected application payload data to specified internal security employees. Which of the following steps should Joe take to reach the desired outcome?

• A.Ensure that the NIPS platform can also deal with recent technological advancements, such as threats emerging from social media, BYOD and cloud storage prior to purchasing the product.
• B.Consider outsourcing the product evaluation and ongoing management to an outsourced provider on the basis that each of the requirements are met and a lower total cost of ownership (TCO) is achieved.
• C.Research new technology vendors to look for potential products. Contribute to an RFP and then evaluate RFP responses to ensure that the vendor product meets all mandatory requirements. Test the product and make a product recommendation.
• D.Choose a popular NIPS product and then consider outsourcing the ongoing device management to a cloud provider. Give access to internal security employees so that they can inspect the application payload data.
• E.Evaluate relevant RFC and ISO standards to choose an appropriate vendor product.
  Research industry surveys, interview existing customers of the product and then recommend that the product be purchased.

A new company requirement mandates the implementation of multi-factor authentication to access network resources. The security administrator was asked to research and implement the most cost-effective solution that would allow for the authentication of both hardware and users. The company wants to leverage the PKI infrastructure which is already well established. Which of the following solutions should the security administrator implement?

• A.Issue each user one hardware token. Configure the token serial number in the user properties of the central authentication system for each user and require token authentication with PIN for network logon.
• B.Deploy USB fingerprint scanners on all desktops, and enable the fingerprint scanner on all laptops. Require all network users to register their fingerprint using the reader and store the information in the central authentication system.
• C.Issue individual private/public key pairs to each user, install the private key on the central authentication system, and protect the private key with the user's credentials.
  Require each user to install the public key on their computer.
• D.Issue individual private/public key pairs to each user, install the public key on the central authentication system, and require each user to install the private key on their computer and protect it with a password.

After connecting to a secure payment server at https://pay.xyz.com, an auditor notices that the SSL certificate was issued to *.xyz.com. The auditor also notices that many of the internal development servers use the same certificate. After installing the certificate on dev1.xyz.com, one of the developers reports misplacing the USB thumb-drive where the SSL certificate was stored. Which of the following should the auditor recommend FIRST?

• A.Generate a new public key on both servers.
• B.Replace the SSL certificate on dev1.xyz.com.
• C.Generate a new private key password for both servers.
• D.Replace the SSL certificate on pay.xyz.com.