無料提供中のCAS-005試験問題集で（2026年最新のPDF問題集）信頼度の高いテストエンジン [Q176-Q191]

無料提供中のCAS-005試験問題集で（2026年最新のPDF問題集）信頼度の高いテストエンジン

CAS-005のPDFで最近更新された問題です集試験点数を伸ばそう

質問 # 176
An organization is developing on Al-enabled digital worker to help employees complete common tasks such as template development, editing, research, and scheduling. As part of the Al workload the organization wants to Implement guardrails within the platform. Which of the following should the company do to secure the Al environment?

• A. Grant the system the ability to self-govern
• B. Enhance the training model's effectiveness.
• C. Require end-user acknowledgement of organizational policies.
• D. Limn the platform's abilities to only non-sensitive functions

正解：D

解説：
Limiting the platform's abilities to only non-sensitive functions helps to mitigate risks associated with AI operations. By ensuring that the AI-enabled digital worker is only allowed to perform tasks that do not involve sensitive or critical data, the organization reduces the potential impact of any security breaches or misuse.
Enhancing the training model's effectiveness (Option B) is important but does not directly address security guardrails. Granting the system the ability to self-govern (Option C) could increase risk as it may act beyond the organization's control. Requiring end-user acknowledgement of organizational policies (Option D) is a good practice but does not implement technical guardrails to secure the AI environment.
Reference:
CompTIA Security+ Study Guide
NIST SP 800-53 Rev. 5, "Security and Privacy Controls for Information Systems and Organizations" ISO/IEC 27001, "Information Security Management"

質問 # 177
During DAST scanning, applications are consistently reporting code defects in open-source libraries that were used to build web applications. Most of the code defects are from using libraries with known vulnerabilities.
The code defects are causing product deployment delays. Which of the following is the best way to uncover these issues earlier in the life cycle?

• A. Completing an IAST scan against the web application
• B. Modifying the WAF policies to block against known vulnerabilities
• C. Directing application logs to the SIEM for continuous monitoring
• D. Using a software dependency management solution

正解：D

解説：
SecurityX CAS-005 exam content emphasizes integrating security into the SDLC and using automated tools to identify vulnerabilities early.
* Software dependency management solutions track and analyze libraries and components for known vulnerabilities before deployment, using vulnerability databases such as NVD or OSS Index.
* IAST scanning still requires the application to be running and may detect issues later.
* WAF policies help block attacks in production but do not prevent vulnerable code from being deployed.
* SIEM monitoring is reactive and identifies issues after they occur.By detecting vulnerable dependencies early, software dependency management solutions prevent late-stage deployment delays and reduce security risk.

質問 # 178
A nation-state actor is exposed for attacking large corporations by establishing persistence in smaller companies that are likely to be acquired by these large corporations. The actor then provisions user accounts in the companies for use post-acquisition. Before an upcoming acquisition, a security officer conducts threat modeling with this attack vector. Which of the following practices is the best way to investigate this threat?

• A. Restricting internet traffic originating from countries in which the nation-state actor is known to operate
• B. Placing a hold on all information about corporate interest in acquisitions
• C. Auditing vendors to mitigate supply chain risk during the acquisition
• D. Comparing all existing credentials to personnel and services

正解：D

質問 # 179
A Chief Information Security Officer requests an action plan to remediate vulnerabilities. A security analyst reviews the output from a recent vulnerability scan and notices hundreds of unique vulnerabilities. The output includes the CVSS score, IP address, hostname, and the list of vulnerabilities. The analyst determines more information is needed in order to decide which vulnerabilities should be fixed immediately. Which of the following is the best source for this information?

• A. Business impact analysis
• B. Third-party risk review
• C. Crisis management plan
• D. Incident response playbook

正解：A

解説：
The correct source is the Business Impact Analysis (BIA). A BIA provides context about which systems and applications are most critical to business operations, regulatory compliance, and customer obligations. While CVSS scores indicate severity in technical terms, they do not reflect the business impact of exploitation. For example, a medium-severity vulnerability on a critical payment system may pose more business risk than a high-severity vulnerability on a test server.
Option A (third-party risk review) focuses on vendor security posture, not internal remediation priorities. Option C (incident response playbook) guides response during active incidents, not vulnerability prioritization. Option D (crisis management plan) addresses executive-level communications during crises, not technical risk assessment.
By combining vulnerability scan data with BIA context, security teams can prioritize remediation efforts based on business-critical systems, ensuring the highest-risk vulnerabilities are remediated first. This aligns with CAS-005's guidance on risk-based prioritization of remediation efforts.

質問 # 180
During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.
INSTRUCTIONS
Review each of the events and select the appropriate analysis and remediation options for each IoC.

正解：

解説：
Analysis and Remediation Options for Each IoC:
IoC 1:
Evidence:
Source: Apache_httpd
Type: DNSQ
Dest: @10.1.1.1:53,@10.1.2.5
Data: update.s.domain, CNAME 3a129sk219r9slmfkzzz000.s.domain, 108.158.253.253 Analysis:
Analysis: The service is attempting to resolve a malicious domain.
Reason: The DNS queries and the nature of the CNAME resolution indicate that the service is trying to resolve potentially harmful domains, which is a common tactic used by malware to connect to command-and- control servers.
Remediation:
Remediation: Implement a blocklist for known malicious ports.
Reason: Blocking known malicious domains at the DNS level prevents the resolution of harmful domains, thereby protecting the network from potential connections to malicious servers.
IoC 2:
Evidence:
Src: 10.0.5.5
Dst: 10.1.2.1, 10.1.2.2, 10.1.2.3, 10.1.2.4, 10.1.2.5
Proto: IP_ICMP
Data: ECHO
Action: Drop
Analysis:
Analysis: Someone is footprinting a network subnet.
Reason: The repeated ICMP ECHO requests to different addresses within a subnet indicate that someone is scanning the network to discover active hosts, a common reconnaissance technique used by attackers.
Remediation:
Remediation: Block ping requests across the WAN interface.
Reason: Blocking ICMP ECHO requests on the WAN interface can prevent attackers from using ping sweeps to gather information about the network topology and active devices.
IoC 3:
Evidence:
Proxylog:
GET /announce?info_hash=%01dff%27f%21%10%c5%wp%4e%1d%6f%63%3c%49%6d&peer_id%3dxJFS Uploaded=0&downloaded=0&left=3767869&compact=1&ip=10.5.1.26&event=started User-Agent: RAZA 2.1.0.0 Host: localhost Connection: Keep-Alive HTTP200 OK Analysis:
Analysis: An employee is using P2P services to download files.
Reason: The HTTP GET request with parameters related to a BitTorrent client indicates that the employee is using peer-to-peer (P2P) services, which can lead to unauthorized data transfer and potential security risks.
Remediation:
Remediation: Enforce endpoint controls on third-party software installations.
Reason: By enforcing strict endpoint controls, you can prevent the installation and use of unauthorized software, such as P2P clients, thereby mitigating the risk of data leaks and other security threats associated with such applications.
References:
CompTIA Security+ Study Guide: This guide offers detailed explanations on identifying and mitigating various types of Indicators of Compromise (IoCs) and the corresponding analysis and remediation strategies.
CompTIA Security+ Exam Objectives: These objectives cover key concepts in network security monitoring and incident response, providing guidelines on how to handle different types of security events.
Security Operations Center (SOC) Best Practices: This resource outlines effective strategies for analyzing and responding to anomalous events within a SOC, including the use of blocklists, endpoint controls, and network configuration changes.
By accurately analyzing the nature of each IoC and applying the appropriate remediation measures, the organization can effectively mitigate potential security threats and maintain a robust security posture.

質問 # 181
Which of the following is a security concern for DNP3?

• A. It is an open source protocol.
• B. Authentication is not allocated.
• C. Available function codes are not standardized.
• D. Free-form messages require support.

正解：B

解説：
Original DNP3 lacks built-in authentication for its messages, making it vulnerable to spoofing and replay attacks. Secure extensions (Secure DNP3) add cryptographic authentication, but legacy deployments without these extensions remain at risk.

質問 # 182
A company wants to improve and automate the compliance of its cloud environments to meet industry standards. Which of the following resources should the company use to best achieve this goal?

• A. Ansible
• B. PowerShell
• C. Jenkins
• D. Python

正解：A

解説：
Automating compliance in cloudenvironments requires a tool that can enforce configurations, manage infrastructure as code, and align with industry standards (e.g., NIST, ISO). Let's evaluate:
A). Jenkins:A CI/CD tool for automating software builds and deployments. It's not designed for compliance enforcement or infrastructure management.
B). Python:A programming language that can be scripted for automation but lacks built-in compliance-focused features without significant custom development.
C). Ansible:An automation tool for configuration management, application deployment, and compliance enforcement. It uses playbooks to define desired states, making it ideal for automating compliance checks and remediation in cloud environments (e.g., AWS, Azure). CAS-005 emphasizes automation tools for security and compliance, and Ansible fits perfectly.
Reference:CompTIA SecurityX (CAS-005) objectives, Domain 3: Security Engineering and Cryptography, focusing on automation for compliance in cloud environments.

質問 # 183
A security analyst needs to ensure email domains that send phishing attempts without previous communications are not delivered to mailboxes The following email headers are being reviewed

Which of thefollowing is the best action for the security analyst to take?

• A. Reroute all messages with unusual security warning notices to the IT administrator
• B. Quarantine all messages with sales-mail.com in the email header
• C. Block messages from hr-saas.com because it is not a recognized domain.
• D. Block vendor com for repeated attempts to send suspicious messages

正解：D

解説：
In reviewing email headers and determining actions to mitigate phishing attempts, the security analyst should focus on patterns of suspicious behavior and the reputation of the sending domains. Here's the analysis of the options provided:
A). Block messages from hr-saas.com because it is not a recognized domain: Blocking a domain solely because it is not recognized can lead to legitimate emails being missed. Recognition alone should not be the criterion for blocking.
B). Reroute all messages with unusual security warning notices to the IT administrator: While rerouting suspicious messages can be a good practice, it is not specific to the domain sending repeated suspicious messages.
C). Quarantine all messages with sales-mail.com in the email header: Quarantining messages based on the presence of a specific domain in the email header can be too broad and may capture legitimate emails.
D). Block vendor com for repeated attempts to send suspicious messages: This option is the most appropriate because it targets a domain that has shown a pattern of sending suspicious messages. Blocking a domain that repeatedly sends phishing attempts without previous communications helps in preventing future attempts from the same source and aligns with the goal of mitigating phishing risks.
References:
CompTIA SecurityX Study Guide: Details best practices for handling phishing attempts, including blocking domains with repeated suspicious activity.
NIST Special Publication 800-45 Version 2, "Guidelines on Electronic Mail Security": Provides guidelines on email security, including the management of suspicious email domains.
"Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft" by Markus Jakobsson and Steven Myers: Discusses effective measures to counter phishing attempts, including blocking persistent offenders.
By blocking the domain that has consistently attempted to send suspicious messages, the security analyst can effectively reduce the risk of phishing attacks.

質問 # 184
Which of the following key management practices ensures that an encryption key is maintained within the organization?

• A. Encrypting using server-side encryption capabilities provided by the cloud provider
• B. Encrypting using encryption and key storage systems provided by the cloud provider
• C. Encrypting using a key escrow process for storage of the encryption key
• D. Encrypting using a key stored in an on-premises hardware security module

正解：D

解説：
Step by Step Explanation:
Understanding the Scenario: The question is about ensuring that an organization retains control over its encryption keys. It focuses on different key storage and management methods.
Analyzing the Answer Choices:
A). Encrypting using a key stored in an on-premises hardware security module (HSM): This is thebest option for maintaining complete control over encryption keys. An HSM is a dedicated, tamper-resistant hardware device specifically designed for secure key storage and cryptographic operations. Storing keys on-premises within an HSM ensures the organization has exclusive access.
Reference: HSMs are a core component of strong key management practices, often discussed in CASP+ material related to cryptography and data protection.
B). Encrypting using server-side encryption capabilities provided by the cloud provider: With server-side encryption, the cloud provider typically manages the encryption keys. This means the organization is relinquishing some control over the keys.
C). Encrypting using encryption and key storage systems provided by the cloud provider: Similar to option B, using cloud-provider-managed key storage systems means the organization doesn't have full, exclusive control over the keys.
D). Encrypting using a key escrow process for storage of the encryption key: Key escrow involves entrusting a third party with a copy of the encryption key. This introduces a potential security risk, as the organization no longer has sole control over the key. Also, the key is not maintained within the organization.
Reference: Key escrow is sometimes used for data recovery, but it's generally not recommended for maintaining the highest level of security and control over encryption keys. This is relevant to CASP+ discussions on risk assessment and key management best practices.
Why A is the Correct answer:
Control: On-premises HSMs provide the highest level of control over encryption keys. The organization has physical and logical control over the HSM and the keys stored within it.
Security: HSMs are designed to be tamper-resistant and protect keys from unauthorized access, even if the surrounding systems are compromised.
Compliance: In some industries, regulatory requirements may mandate that organizations maintain direct control over their encryption keys. On-premises HSMs can help meet these requirements.
CASP+ Relevance: HSMs, key management, and data encryption are fundamental topics in CASP+. The exam emphasizes understanding the security implications of different key management approaches.
Elaboration on Key Management Principles:
Key LifecycleManagement: Proper key management involves managing the entire lifecycle of a key, from generation and storage to rotation and destruction.
Separation of Duties: It's generally a good practice to separate the roles of key management and data encryption to enhance security.
Access Control: Strict access controls should be in place to limit who can access and use encryption keys.
In conclusion, using an on-premises HSM for key storage is the best way to ensure that an organization maintains control over its encryption keys. It provides the highest level of security and control, aligning with best practices in cryptography and key management as emphasized in the CASP+ exam objectives.

質問 # 185
Within a SCADA a business needs access to the historian server in order together metric about the functionality of the environment. Which of the following actions should be taken to address this requirement?

• A. Publishing the C$ share from SCADA to the enterprise
• B. Isolating the historian server for connections only from The SCADA environment
• C. Deploying a screened subnet between 11 and SCADA
• D. Adding the business workstations to the SCADA domain

正解：B

解説：
The best action to address the requirement of accessing the historian server within a SCADA system is to isolate the historian server for connections only from the SCADA environment.
Security and Isolation: Isolating the historian server ensures that only authorized devices within the SCADA environment can connect to it. This minimizes the attack surface and protects sensitive data from unauthorized access.
Access Control: By restricting access to the historian server to only SCADA devices, the organization can better control and monitor interactions, ensuring that only legitimate queries and data retrievals occur.
Best Practices for Critical Infrastructure: Following the principle of least privilege, isolating critical components like the historian server is a standard practice in securing SCADA systems, reducing the risk of cyberattacks.

質問 # 186
A company wants to protect against the most common attacks and rapidly integrate with different programming languages. Which of the following technologies is most likely to meet this need?

• A. Cloud-based IDE
• B. RASP
• C. DAST
• D. NIPS

正解：B

解説：
Comprehensive and Detailed Step-by-Step Explanation:
Runtime Application Self-Protection (RASP) (A) monitors and protects applications in real time by detecting and blocking attacks as they occur. Unlike traditional security solutions, RASP is integrated into the application itself, meaning it works regardless of the programming language used. It effectively mitigates common vulnerabilities such as SQL injection, XSS, and buffer overflows.
Dynamic Application Security Testing (DAST) (C) is a passive scanning approach that may not prevent attacks in real-time, while Network Intrusion Prevention Systems (NIPS) (D) focuses on network traffic, not application-layer security.

質問 # 187
A company is migrating from company-owned phones to a BYOD strategy for mobile devices.
The pilot program will start with the executive management team and be rolled out to the rest of the staff in phases. The company's Chief Financial Officer loses a phone multiple times a year.
Which of the following will most likely secure the data on the lost device?

• A. Require MFA to access company applications.
• B. Require a VPN to be active to access company data.
• C. Set up different profiles based on the person's risk.
• D. Remotely wipe the device.

正解：D

解説：
Remotely wiping a lost mobile device ensures that any company data or credentials stored locally are erased, preventing unauthorized access even if the phone falls into the wrong hands. This control directly addresses the risk of data exposure on a lost device.

質問 # 188
SIMULATION
[Security Architecture]
A security engineer needs to review the configurations of several devices on the network to meet the following requirements:
* The PostgreSQL server must only allow connectivity in the 10.1.2.0/24 subnet.
* The SSH daemon on the database server must be configured to listen
to port 4022.
* The SSH daemon must only accept connections from a Single
workstation.
* All host-based firewalls must be disabled on all workstations.
* All devices must have the latest updates from within the past eight
days.
* All HDDs must be configured to secure data at rest.
* Cleartext services are not allowed.
* All devices must be hardened when possible.
Instructions:
Click on the various workstations and network devices to review the posture assessment results. Remediate any possible issues or indicate that no issue is found.
Click on Server A to review output data. Select commands in the appropriate tab to remediate connectivity problems to the pOSTGREsql DATABASE VIA ssh

WAP A

PC A

Laptop A

Switch A

Switch B:

Laptop B

PC B

PC C

Server A

正解：

解説：
See the solution below in Explanation
Explanation:
WAP A: No issue found. The WAP A is configured correctly and meets therequirements.
PC A = Enable host-based firewall to block all traffic
This option will turn off the host-based firewall and allow all traffic to pass through. This will comply with the requirement and also improve the connectivity of PC A to other devices on the network. However, this option will also reduce the security of PC A and make it more vulnerable to attacks. Therefore, it is recommended to use other security measures, such as antivirus, encryption, and password complexity, to protect PC A from potential threats.
Laptop A: Patch management
This option will install the updates that are available for Laptop A and ensure that it has the most recent security patches and bug fixes. This will comply with the requirement and also improve the performance and stability of Laptop A. However, this option may also require a reboot of Laptop A and some downtime during the update process. Therefore, it is recommended to backup any important data and close any open applications before applying the updates.
Switch A: No issue found. The Switch A is configured correctly and meets the requirements.
Switch B: No issue found. The Switch B is configured correctly and meets the requirements.
Laptop B: Disable unneeded services
This option will stop and disable the telnet service that is using port 23 on Laptop B. Telnet is a cleartext service that transmits data in plain text over the network, which exposes it to eavesdropping, interception, and modification by attackers. By disabling the telnet service, you will comply with the requirement and also improve the security of Laptop B. However, this option may also affect the functionality of Laptop B if it needs to use telnet for remote administration or other purposes. Therefore,it is recommended to use a secure alternative to telnet, such as SSH or HTTPS, that encrypts the data in transit.
PC B: Enable disk encryption
This option will encrypt the HDD of PC B using a tool such as BitLocker or VeraCrypt. Disk encryption is a technique that protects data at rest by converting it into an unreadable format that can only be decrypted with a valid key or password. By enabling disk encryption, you will comply with the requirement and also improve the confidentiality and integrity of PC B's data. However, this option may also affect the performance and usability of PC B, as it requires additional processing time and user authentication to access the encrypted data. Therefore, it is recommended to backup any important data and choose a strong key or password before encrypting the disk.
PC C: Disable unneeded services
This option will stop and disable the SSH daemon that is using port 22 on PC C. SSH is a secure service that allows remote access and command execution over an encrypted channel. However, port 22 is thedefault and well-known port for SSH, which makes it a common target for brute-force attacks and port scanning. By disabling the SSH daemon on port 22, you will comply with the requirement and also improve the security of PC C. However, this option may also affect the functionality of PC C if it needs to use SSH for remote administration or other purposes. Therefore, it is recommended to enable the SSH daemon on a different port, such as 4022, by editing the configuration file using the following command:
sudo nano /etc/ssh/sshd_config
Server A. Need to select the following:

質問 # 189
Which of the following most likely explains the reason a security engineer replaced ECC with a lattice-based cryptographic technique?

• A. It is computationally efficient and provides perfect forward secrecy.
• B. It is more resilient to brute-force attacks than ECC.
• C. It is currently considered a robust PQC technique.
• D. It supports ephemeral key exchange and digital signatures.
• E. It enables processing on data while remaining in an encrypted state.

正解：C

質問 # 190
After a cybersecurity incident, a security analyst was able to collect a binary that the attacker used on the compromised server. Then the analyst ran the following command:

Which of the following options describes what the analyst is trying to do?

• A. To replicate the attack in a secure environment
• B. To extract loCs from the binary used on the attack
• C. To reconstruct the timeline of commands executed by the binary

正解：B

解説：
The strings utility extracts human-readable text from binary files. Security analysts use it to identify Indicators of Compromise (IoCs) such as URLs, IP addresses, filenames, and commands embedded in the malware.
* Option A (reconstructing timeline) would require event logs or forensic timeline tools.
* Option C (replicating the attack) involves execution in a sandbox, not static string extraction.

質問 # 191
......

CAS-005完全版問題集には無料PDF問題で合格させる：https://www.goshiken.com/CompTIA/CAS-005-mondaishu.html

無料CompTIA CASP CAS-005公式認定ガイドPDFダウンロード：https://drive.google.com/open?id=1jX3AwnaRzMNfiJp6JqJaOhM5gksw1Vfl