[2025年04月] 無料お試しISACA Cybersecurity-Audit-Certificate問題集PDFは必ずベストの問題集オプションを使おう
Cybersecurity-Audit-Certificate試験資料ISACA学習ガイド
質問 # 51
Which of the following features of continuous auditing provides the BEST level of assurance over traditional sampling?
- A. Reports can be generated more frequently for management.
- B. Automated tools provide more reliability than an auditors personal judgment
- C. Continuous auditing tools are less complex for auditors to manage.
- D. Voluminous dale can be analyzed at a high speed to show relevant patterns.
正解：D
解説：
The feature of continuous auditing that provides the BEST level of assurance over traditional sampling is that voluminous data can be analyzed at a high speed to show relevant patterns. This is because continuous auditing is a technique that uses automated tools and processes to perform audit activities on a continuous or near-real-time basis, and to analyze large amounts of data from various sources and systems. Continuous auditing helps to provide a higher level of assurance than traditional sampling, by covering the entire population of transactions or events, rather than a subset or sample, and by identifying trends, anomalies, or exceptions that may indicate risks or issues. The other options are not features of continuous auditing that provide the best level of assurance over traditional sampling, but rather different aspects or benefits of continuous auditing, such as reporting frequency (A), reliability (B), or complexity (D).
質問 # 52
Cyber threat intelligence aims to research and analyze trends and technical developments in which of the following areas?
- A. Cybercrime, hacktism. and espionage
- B. Industry-specific security regulator
- C. Cybersecurity operations management
- D. Cybersecurity risk scenarios
正解：A
解説：
Explanation
Cyber threat intelligence aims to research and analyze trends and technical developments in the areas of cybercrime, hacktivism, and espionage. These are the main sources of malicious cyber activities that pose risks to organizations and individuals. Cyber threat intelligence helps to understand the motivations, capabilities, tactics, techniques, and procedures of various threat actors and groups.
質問 # 53
Which of the following is the MOST cost-effective technique for implementing network security for human resources (HR) desktops and internal laptop users in an organization?
- A. Layer 3 virtual private network
- B. Virtual local area network
- C. Software defined perimeter
- D. Fortified demilitarized zone
正解：B
解説：
The MOST cost-effective technique for implementing network security for human resources (HR) desktops and internal laptop users in an organization is using a virtual local area network (VLAN). A VLAN is a logical grouping of network devices that share the same broadcast domain regardless of their physical location or connection. A VLAN can enhance network security by isolating different types of traffic or users from each other and applying different security policies or rules based on the VLAN membership. For example, an organization can create a VLAN for HR desktops and internal laptop users that restricts their access to only HR-related systems or resources. A VLAN can also reduce network costs by saving bandwidth, improving performance, and simplifying management.
質問 # 54
Which of the following is a client-server program that opens a secure, encrypted command-line shell session from the Internet for remote logon?
- A. IPsec
- B. SFTP
- C. SSH
- D. VPN
正解：C
解説：
The correct answer is C. SSH.
SSH stands for Secure Shell, a client-server program that opens a secure, encrypted command-line shell session from the Internet for remote logon. SSH allows users to remotely access and execute commands on a server without exposing their credentials or data to eavesdropping, tampering or replay attacks. SSH also supports secure file transfer protocols such as SFTP and SCP1.
VPN stands for Virtual Private Network, a technology that creates a secure, encrypted tunnel between two or more devices over a public network such as the Internet. VPN allows users to access resources on a remote network as if they were physically connected to it, while protecting their privacy and identity2.
IPsec stands for Internet Protocol Security, a set of protocols that provides security at the network layer of the Internet. IPsec supports two modes: transport mode and tunnel mode. Transport mode encrypts only the payload of each packet, while tunnel mode encrypts the entire packet, including the header. IPsec can be used to secure VPN connections, as well as other applications that require data confidentiality, integrity and authentication3.
SFTP stands for Secure File Transfer Protocol, a protocol that uses SSH to securely transfer files between a client and a server over a network. SFTP provides encryption, authentication and compression features to ensure the security and reliability of file transfers.
1: SSH (Secure Shell) 2: What is a VPN? How It Works, Types of VPN | Kaspersky 3: IPsec - Wikipedia : [SFTP - Wikipedia]
質問 # 55
When passwords are tied into key generation, the strength of the encryption algorithm is:
- A. increased.
- B. maintained.
- C. voided.
- D. diminished.
正解：B
解説：
When passwords are used in key generation, they serve as a component of the encryption process. The strength of the encryption algorithm itself is not inherently affected by the use of passwords for key generation. Instead, the security of the encryption relies on the strength and complexity of the password, the key generation process, and the encryption algorithm's resilience to attacks. A strong, complex password can contribute to a robust encryption key, thereby maintaining the intended strength of the encryption algorithm.
質問 # 56
Which of the following is a MAIN benefit of using Security as a Service (SECaaS) providers?
- A. SECaaS providers are compliant with specific security requirements and new regulations.
- B. Available security services from providers are affordable to enterprises of all sizes.
- C. Significant investments and specialized security skills are not required.
- D. Enterprises can use the latest technologies to counter threats that are constantly evolving.
正解：C
解説：
Explanation
A MAIN benefit of using Security as a Service (SECaaS) providers is that significant investments and specialized security skills are not required. SECaaS is a type of cloud service model that provides security solutions and services to customers over the internet. SECaaS providers can offer various security functions such as antivirus, firewall, encryption, identity management, vulnerability scanning, and incident response. By using SECaaS providers, customers can save costs and resources on acquiring, maintaining, and updating security hardware and software. Customers can also leverage the expertise and experience of the SECaaS providers to address their security needs and challenges.
質問 # 57
Which of the following is an example of an application security control?
- A. Security operations center
- B. Intrusion detection
- C. User security awareness training
- D. Secure coding
正解：D
解説：
Explanation
An example of an application security control is secure coding. Secure coding is the practice of developing software applications that follow security principles and standards to prevent or mitigate common vulnerabilities and risks. Secure coding involves applying techniques such as input validation, output encoding, error handling, encryption, and testing.
質問 # 58
The GREATEST advantage of using a common vulnerability scoring system is that it helps with:
- A. risk aggregation.
- B. risk prioritization.
- C. risk elimination.
- D. risk quantification
正解：B
解説：
The GREATEST advantage of using a common vulnerability scoring system is that it helps with risk prioritization. This is because a common vulnerability scoring system provides a standardized and consistent way of measuring and comparing the severity of vulnerabilities, based on their impact and exploitability. This allows organizations to prioritize the remediation of the most critical vulnerabilities and allocate resources accordingly. The other options are not as advantageous as using a common vulnerability scoring system, because they either involve aggregating (A), eliminating C, or quantifying (D) risk, which are not directly related to the scoring system.
質問 # 59
Which of the following is an attack attribute of an advanced persistent threat (APT) that is designed to remove data from systems and networks?
- A. Exfiltration attack vector
- B. Infiltration attack vector
- C. Kill chain modeling
- D. Adversarial threat event
正解：A
解説：
An example of an attack attribute of an advanced persistent threat (APT) that is designed to remove data from systems and networks is an exfiltration attack vector. An exfiltration attack vector is a method or channel that an APT uses to transfer data from a compromised system or network to an external location. Examples of exfiltration attack vectors include email, FTP, DNS, HTTP, or covert channels.
質問 # 60
Which of the following security mechanisms provides the BEST protection of data when a computer is stolen?
- A. Password-based access control
- B. Digital signature
- C. Cryptographic hash function
- D. Secret key encryption
正解：D
解説：
Secret key encryption, also known as symmetric encryption, involves a single key for both encryption and decryption. This method provides the best protection for data on a computer that is stolen because it renders the data unreadable without the key. Even if the thief has access to the physical hardware, without the secret key, the data remains secure and inaccessible.
質問 # 61
Which of the following is an objective of public key infrastructure (PKI)?
- A. Independently authenticating the validity of the sender's public key
- B. Approving the algorithm to be used during data transmission
- C. Creating the private-public key pair for secure communications
- D. Securely distributing secret keys to the communicating parties
正解：A
解説：
Explanation
An objective of public key infrastructure (PKI) is to independently authenticate the validity of the sender's public key. PKI is a system that uses cryptographic keys to secure communications and transactions. PKI involves a trusted third party called a certificate authority (CA) that issues digital certificates that link a public key with an identity. The recipient can use the CA's public key to verify the sender's certificate and public key.
質問 # 62
Which of the following is the MOST cost-effective technique for implementing network security for human resources (HR) desktops and internal laptop users in an organization?
- A. Layer 3 virtual private network
- B. Virtual local area network
- C. Software defined perimeter
- D. Fortified demilitarized zone
正解：B
解説：
Explanation
The MOST cost-effective technique for implementing network security for human resources (HR) desktops and internal laptop users in an organization is using a virtual local area network (VLAN). A VLAN is a logical grouping of network devices that share the same broadcast domain regardless of their physical location or connection. A VLAN can enhance network security by isolating different types of traffic or users from each other and applying different security policies or rules based on the VLAN membership. For example, an organization can create a VLAN for HR desktops and internal laptop users that restricts their access to only HR-related systems or resources. A VLAN can also reduce network costs by saving bandwidth, improving performance, and simplifying management.
質問 # 63
A cloud service provider is used to perform analytics on an organization's sensitive data. A data leakage incident occurs in the service providers network from a regulatory perspective, who is responsible for the data breach?
- A. The service provider
- B. Dependent upon the nature of breath
- C. The organization
- D. Dependent upon specific regulatory requirements
正解：C
解説：
Explanation
A cloud service provider is used to perform analytics on an organization's sensitive data. A data leakage incident occurs in the service provider's network. From a regulatory perspective, the organization is responsible for the data breach. This is because the organization is the data owner and has the ultimate accountability and liability for the security and privacy of its data, regardless of where it is stored or processed.
The organization cannot transfer or delegate its responsibility to the service provider, even if there is a contractual agreement or service level agreement that specifies the security obligations of the service provider.
The other options are not correct, because they either imply that the service provider is responsible (A), or that the responsibility depends on the nature of breach (B) or specific regulatory requirements C, which are not relevant factors.
質問 # 64
Security awareness training is MOST effective against which type of threat?
- A. Denial of service
- B. Social injection
- C. Social engineering
- D. Command injection
正解：C
解説：
Security awareness training is MOST effective against social engineering threats. This is because social engineering is a type of attack that exploits human psychology and behavior to manipulate or trick users into revealing sensitive or confidential information, or performing actions that compromise security. Security awareness training helps to educate users about the common types and techniques of social engineering attacks, such as phishing, vishing, baiting, etc., and how to recognize and avoid them. Security awareness training also helps to foster a culture of security within the organization and empower users to report any suspicious or malicious activities. The other options are not types of threats that security awareness training is most effective against, but rather types of attacks that exploit technical vulnerabilities or flaws in systems or applications, such as command injection (A), denial of service (B), or SQL injection (D).
質問 # 65
Which of the following describes specific, mandatory controls or rules to support and comply with a policy?
- A. Frameworks
- B. Guidelines
- C. Standards
- D. Basedine
正解：C
解説：
Explanation
Specific, mandatory controls or rules to support and comply with a policy are known as standards. This is because standards define the minimum level of performance or behavior that is expected from an organization or its employees in order to achieve a policy objective or requirement. Standards also provide clear and measurable criteria for auditing and monitoring compliance with policies. The other options are not specific, mandatory controls or rules to support and comply with a policy, but rather different types of documents or tools that provide guidance or recommendations for implementing policies or controls, such as frameworks (A), guidelines (B), or baselines C.
質問 # 66
Which of the following is MOST important to ensure the successful implementation of continuous auditing?
- A. Budget for additional storage hardware
- B. Surplus processing capacity
- C. Budget for additional technical resources
- D. Top management support
正解：D
解説：
Explanation
The MOST important factor to ensure the successful implementation of continuous auditing is top management support. This is because top management support helps to provide the vision, direction, and resources for implementing continuous auditing within the organization. Top management support also helps to overcome any resistance or challenges that may arise from implementing continuous auditing, such as cultural change, stakeholder buy-in, process reengineering, etc. Top management support also helps to ensure that the results and findings of continuous auditing are communicated and acted upon by the relevant decision-makers and stakeholders. The other options are not factors that are more important than top management support for ensuring the successful implementation of continuous auditing, but rather different aspects or benefits of continuous auditing, such as storage hardware (A), technical resources (B), or processing capacity (D).
質問 # 67
Which of the following is a limitation of intrusion detection systems (IDS)?
- A. Weak passwords for the administration console
- B. Application-level vulnerabilities
- C. Limited evidence on intrusive activity
- D. Lack of Interface with system tools
正解：B
解説：
A limitation of intrusion detection systems (IDS) is that they cannot detect application-level vulnerabilities. An IDS is a tool that monitors network traffic or system activity and alerts on any suspicious or malicious events. However, an IDS cannot analyze the logic or functionality of applications and identify vulnerabilities such as SQL injection, cross-site scripting, or broken authentication.
質問 # 68
The discovery of known dangerous artifacts on a network such as IP addresses or domain names helps to identify which of the following?
- A. System vulnerabilities
- B. Indicator of compromise
- C. Unauthorized access
- D. Data breach
正解：B
解説：
The presence of known dangerous artifacts like malicious IP addresses or domain names on a network typically indicates that a security breach has occurred or is in progress. These artifacts are often recognized as indicators of compromise (IoCs), which are pieces of forensic data, such as system log entries or files, that identify potentially malicious activity on a system or network. Identifying IoCs is crucial for cybersecurity as it allows organizations to detect breaches quickly and respond to them promptly.
質問 # 69
What should be an IS auditor's GREATEST concern when an organization's virtual private network (VPN) is implemented on employees' personal mobile devices?
- A. Users may store the data in plain text on their mobile devices.
- B. Users may access services not supported by the VPN.
- C. Users may access services over the VPN that are network resource intensive.
- D. Users may access the corporate network from unauthorized devices.
正解：A
解説：
When employees use personal mobile devices to access a VPN, the greatest concern for an IS auditor is the potential for sensitive data to be stored in an unsecured manner. If data is stored in plain text, it could be easily accessed by unauthorized parties if the device is lost, stolen, or compromised. This risk is heightened when the devices are not managed by the organization's IT department, which would typically enforce security policies such as encryption.
質問 # 70
The integrity of digital assets can be controlled by:
- A. access controls, encryption, and digital signatures.
- B. read access restrictions, database normalization, and patching.
- C. redundancy, backups, and business continuity management.
- D. user awareness training and related end-user testing.
正解：A
質問 # 71
One way to control the integrity of digital assets is through the use of:
- A. caching
- B. policies.
- C. hashing.
- D. frameworks.
正解：C
解説：
One way to control the integrity of digital assets is through the use of hashing. This is because hashing is a technique that applies a mathematical function to a digital asset, such as a file or a message, and produces a unique and fixed-length value, known as a hash or a digest. Hashing helps to verify the integrity of digital assets, by comparing the hash values before and after transmission or storage, and detecting any changes or modifications to the original asset. The other options are not ways to control the integrity of digital assets, but rather different concepts or techniques that are related to information security, such as policies (A), frameworks (B), or caching C.
質問 # 72
Which of the following is MOST important to ensure the successful implementation of continuous auditing?
- A. Budget for additional storage hardware
- B. Surplus processing capacity
- C. Budget for additional technical resources
- D. Top management support
正解：D
解説：
The MOST important factor to ensure the successful implementation of continuous auditing is top management support. This is because top management support helps to provide the vision, direction, and resources for implementing continuous auditing within the organization. Top management support also helps to overcome any resistance or challenges that may arise from implementing continuous auditing, such as cultural change, stakeholder buy-in, process reengineering, etc. Top management support also helps to ensure that the results and findings of continuous auditing are communicated and acted upon by the relevant decision-makers and stakeholders. The other options are not factors that are more important than top management support for ensuring the successful implementation of continuous auditing, but rather different aspects or benefits of continuous auditing, such as storage hardware (A), technical resources (B), or processing capacity (D).
質問 # 73
......
ISACA Cybersecurity-Audit-Certificate 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
有効な問題最新版を試そうCybersecurity-Audit-Certificateテスト解釈Cybersecurity-Audit-Certificate有効な試験ガイド：https://www.jpntest.com/shiken/Cybersecurity-Audit-Certificate-mondaishu
Cybersecurity-Audit-Certificate実際の問題解答PDFは100%カバー率でリアル試験問題：https://drive.google.com/open?id=19IVQLg0TyQIdLc4-o5taPOkPvtm38Ze1