CAS-002 試験問題を無料オンラインアクセス

A company is in the process of outsourcing its customer relationship management system to a cloud provider. It will host the entire organization's customer database. The database will be accessed by both the company's users and its customers. The procurement department has asked what security activities must be performed for the deal to proceed.
Which of the following are the MOST appropriate security activities to be performed as part of due diligence? (Select TWO).

• A.Physical penetration test of the datacenter to ensure there are appropriate controls.
• B.Review of the organizations security policies, procedures and relevant hosting certifications.
• C.Penetration testing of the solution to ensure that the customer data is well protected.
• D.Code review of the solution to ensure that there are no back doors located in the software.
• E.Security clauses are implemented into the contract such as the right to audit.

The audit department at a company requires proof of exploitation when conducting internal network penetration tests. Which of the following provides the MOST conclusive proof of compromise without further compromising the integrity of the system?

• A.Provide a list of grabbed service banners.
• B.Modify a file on the system and include the path in the test's report.
• C.Take a packet capture of the test activity.
• D.Add a new test user account on the system.

The sales team is considering the deployment of a new CRM solution within the enterprise.
The IT and Security teams are members of the project; however, neither team has expertise or experience with the proposed system. Which of the following activities should be performed FIRST?

• A.Work with Finance to do a second ROI calculation before continuing further with the project.
• B.Research the market, select the top vendors and solicit RFPs from those vendors.
• C.Visit a company who already has the technology, sign an NDA, and read their latest risk assessment.
• D.Contact the top vendor, assign IT and Security to work together to implement a demo and pen test the system.

A system administrator is troubleshooting a possible denial of service on a sensitive system. The system seems to run properly for a few hours after it is restarted, but then it suddenly stops processing transactions. The system administrator suspects an internal DoS caused by a disgruntled developer who is currently seeking a new job while still working for the company. After looking into various system logs, the system administrator looks at the following output from the main system service responsible for processing incoming transactions.
DATE/TIMEPIDCOMMAND%CPUMEM
031020141030002055com.proc10.2920K
031020141100002055com.proc12.35.2M
031020141230002055com.proc22.022M
031020141300002055com.proc33.01.6G
031020141330002055com.proc30.28.0G
Which of the following is the MOST likely cause for the DoS?

• A.The system is susceptible to integer overflow.
• B.The system does not implement proper garbage collection.
• C.The system does not protect against buffer overflows properly.
• D.The system does not implement input validation.

A security administrator wants to calculate the ROI of a security design which includes the purchase of new equipment. The equipment costs $50,000 and it will take 50 hours to install and configure the equipment. The administrator plans to hire a contractor at a rate of
$100/hour to do the installation. Given that the new design and equipment will allow the company to increase revenue and make an additional $100,000 on the first year, which of the following is the ROI expressed as a percentage for the first year?

• A.45 percent
• B.-45 percent
• C.5.5 percent
• D.82 percent