[2025年08月] ベストな問題集を使おうCompTIA CASP CAS-004専門試験問題
100%の合格率を試そう！更新されたのはCAS-004試験問題 [2025]
CASP+認定試験は、サイバーセキュリティでキャリアを促進しようとしているITの専門家にとって理想的です。 IT管理で最低10年の経験を持つ個人向けに設計されており、技術的セキュリティで少なくとも5年間の実践的な経験があります。この試験は、他のIT分野からサイバーセキュリティへの移行を検討しているIT専門家にも適しています。
質問 # 274
Which of the following are the MOST likely vectors for the unauthorized or unintentional inclusion of vulnerable code in a software company's final software releases? (Choose two.)
- A. Outdated anti-malware software
- B. Vendors/supply chain
- C. Use of penetration-testing utilities
- D. Unsecure protocols
- E. Included third-party libraries
- F. Weak passwords
正解：D、F
質問 # 275
In a cloud environment, the provider offers relief to an organization's teams by sharing in many of the operational duties. In a shared responsibility model, which of the following responsibilities belongs to the provider in a Paas implementation?
- A. Application-specific data assets
- B. Application user access management
- C. Application/platform software
- D. Application-specific logic and code
正解：C
解説：
In a PaaS implementation, the provider offers relief to the organization's teams by sharing in many of the operational duties related to the application/platform software. The provider is responsible for securing and maintaining the underlying infrastructure, operating systems, middleware, runtime environments, and other software components that support the platform and the applications running on it. The provider also handles tasks such as patching, updating, scaling, and backing up the platform software.
A) Application-specific data assets are the responsibility of the organization in a PaaS implementation. The organization owns and controls its own data and must ensure its confidentiality, integrity, and availability. The organization must also comply with any applicable data protection laws and regulations.
B) Application user access management is the responsibility of the organization in a PaaS implementation. The organization must define and enforce its own policies and procedures for granting, revoking, and monitoring access to its applications and data. The organization must also ensure that its users follow security best practices such as strong passwords and multifactor authentication.
C) Application-specific logic and code are the responsibility of the organization in a PaaS implementation. The organization must develop, test, deploy, and manage its own applications using the tools and services provided by the platform. The organization must also ensure that its applications are secure, reliable, and performant.
https://www.techtarget.com/searchcloudcomputing/feature/The-cloud-shared-responsibility-model-for-IaaS-PaaS
質問 # 276
A company recently deployed a SIEM and began importing logs from a firewall, a file server, a domain controller a web server, and a laptop. A security analyst receives a series of SIEM alerts and prepares to respond. The following is the alert information:
Which of the following should the security analyst do FIRST?
- A. Disable the jdoe account, it is likely compromised
- B. Disable Administrator on abc-uaa-fsl, the local account is compromised
- C. Shut down the abc-usa-fsl server, a plaintext credential is being used
- D. Shut down abc-usa-fw01; the remote access VPN vulnerability is exploited
正解：A
解説：
Based on the SIEM alerts, the security analyst should first disable the jdoe account, as it is likely compromised by an attacker. The alerts show that the jdoe account successfully logged on to the abc-usa-fsl server, which is a file server, and then initiated SMB (445) traffic to the abc-web01 server, which is a web server. This indicates that the attacker may be trying to exfiltrate data from the file server to the web server. Disabling the jdoe account would help stop this unauthorized activity and prevent further damage.
Disabling Administrator on abc-usa-fsl, the local account is compromised, is not the first action to take, as it is not clear from the alerts if the local account is compromised or not. The alert shows that there was a successful logon event for Administrator on abc-usa-fsl, but it does not specify if it was a local or domain account, or if it was authorized or not. Moreover, disabling the local account would not stop the SMB traffic from jdoe to abc-web01.
Shutting down the abc-usa-fsl server, a plaintext credential is being used, is not the first action to take, as it is not clear from the alerts if a plaintext credential is being used or not. The alert shows that there was RDP (3389) traffic from abc-admin1-logon to abc-usa-fsl, but it does not specify if the credential was encrypted or not. Moreover, shutting down the file server would disrupt its normal operations and affect other users.
Shutting down abc-usa-fw01; the remote access VPN vulnerability is exploited, is not the first action to take, as it is not clear from the alerts if the remote access VPN vulnerability is exploited or not. The alert shows that there was FTP (21) traffic from abc-usa-dcl to abc-web01, but it does not specify if it was related to the VPN or not. Moreover, shutting down the firewall would expose the network to other threats and affect other services. Reference: What is SIEM? | Microsoft Security, What is a SIEM Alert? | Cofense
質問 # 277
The Chief information Officer (CIO) asks the system administrator to improve email security at the company based on the following requirements:
* Transaction being requested by unauthorized individuals.
* Complete discretion regarding client names, account numbers, and investment information.
* Malicious attackers using email to malware and ransomeware.
* Exfiltration of sensitive company information.
The cloud-based email solution will provide anti-malware reputation-based scanning, signature-based scanning, and sandboxing. Which of the following is the BEST option to resolve the boar's concerns for this email migration?
- A. Endpoint detection response
- B. SSL VPN
- C. Data loss prevention
- D. Application whitelisting
正解：C
解説：
Explanation
Data loss prevention (DLP) is the best option to resolve the board's concerns for this email migration. DLP is a set of tools and policies that aim to prevent unauthorized access, disclosure, or exfiltration of sensitive data.
DLP can monitor, filter, encrypt, or block email messages based on predefined rules and criteria, such as content, sender, recipient, attachment, etc. DLP can help protect transactions, customer data, and company information from being compromised by malicious actors or accidental leaks. Verified References:
https://www.comptia.org/training/books/casp-cas-004-study-guide ,
https://www.csoonline.com/article/3245746/what-is-dlp-data-loss-prevention-and-how-does-it-work.html
質問 # 278
A client is adding scope to a project. Which of the following processes should be used when requesting updates or corrections to the client's systems?
- A. The security engineer asks the project manager to review the updates for the client's system.
- B. The information system security officer provides the systems engineer with the system updates.
- C. The change control board must review and approve a submission.
- D. The implementation engineer requests direct approval from the systems engineer and the Chief Information Security Officer.
正解：C
解説：
The change control board (CCB) is a committee that consists of subject matter experts and managers who decide whether to implement proposed changes to a project. The change control board is part of the change management plan, which defines the roles and processes for managing change within a team or organization. The change control board must review and approve a submission for any change request that affects the scope, schedule, budget, quality, or risks of the project. The change control board evaluates the impact and benefits of the change request and decides whether to accept, reject, or defer it.
A) The implementation engineer requesting direct approval from the systems engineer and the Chief Information Security Officer is not a correct process for requesting updates or corrections to the client's systems, because it bypasses the change control board and the project manager. This could lead to unauthorized changes that could compromise the project's objectives and deliverables.
C) The information system security officer providing the systems engineer with the system updates is not a correct process for requesting updates or corrections to the client's systems, because it does not involve the change control board or the project manager. This could lead to unauthorized changes that could introduce security vulnerabilities or conflicts with other system components.
D) The security engineer asking the project manager to review the updates for the client's system is not a correct process for requesting updates or corrections to the client's systems, because it does not involve the change control board. The project manager is responsible for facilitating the change management process, but not for approving or rejecting change requests.
https://www.projectmanager.com/blog/change-control-board-roles-responsibilities-processes
質問 # 279
A help desk analyst suddenly begins receiving numerous calls from remote employees who state they are unable to connect to the VPN. The employees indicate the VPN client software is warning about an expired certificate. The help desk analyst determines the VPN certificate is valid. Which of the following is the most likely cause of the issue?
- A. The NTP settings on the VPN concentrator are incorrectly configured.
- B. The end users are using outdated VPN client software.
- C. The VPN concentrator is running an old version of code and needs to be upgraded.
- D. The certificate has been compromised and needs to be replaced.
正解：A
質問 # 280
A mobile administrator is reviewing the following mobile device DHCP logs to ensure the proper mobile settings are applied to managed devices:
Which of the following mobile configuration settings is the mobile administrator verifying?
- A. Association MAC address randomization
- B. 802.1X with mutual authentication
- C. Wireless network auto joining
- D. Service set identifier authentication
正解：C
解説：
Wireless network auto joining is the mobile configuration setting that the mobile administrator is verifying by reviewing the mobile device DHCP logs. Wireless network auto joining is a feature that allows mobile devices to automatically connect to a predefined wireless network without requiring user intervention or authentication. This can be useful for corporate or trusted networks that need frequent access by mobile devices. The DHCP logs show that the mobile devices are assigned IP addresses from the wireless network with SSID "CorpWiFi", which indicates that they are auto joining this network.
質問 # 281
A bank hired a security architect to improve its security measures against the latest threats The solution must meet the following requirements
* Recognize and block fake websites
* Decrypt and scan encrypted traffic on standard and non-standard ports
* Use multiple engines for detection and prevention
* Have central reporting
Which of the following is the BEST solution the security architect can propose?
- A. NGFW
- B. CASB
- C. Web filtering
- D. EDR
正解：A
解説：
A next-generation firewall (NGFW) is a device or software that provides advanced network security features beyond the traditional firewall functions. A NGFW can provide the following capabilities:
* Recognize and block fake websites, using URL filtering and reputation-based analysis
* Decrypt and scan encrypted traffic on standard and non-standard ports, using SSL/TLS inspection and deep packet inspection
* Use multiple engines for detection and prevention, such as antivirus, intrusion prevention system (IPS), application control, and sandboxing
* Have central reporting, using a unified management console and dashboard A cloud access security broker (CASB) is a device or software that acts as an intermediary between cloud service users and cloud service providers. A CASB can provide various security functions such as visibility, compliance, data security, and threat protection, but it does not provide all the capabilities of a NGFW. Web filtering is a technique that blocks or allows web access based on predefined criteria such as categories, keywords, or reputation. Web filtering can help recognize and block fake websites, but it does not provide all the capabilities of a NGFW. Endpoint detection and response (EDR) is a technology that monitors and analyzes the activity and behavior of endpoints such as computers or mobile devices.
EDR can help detect and respond to advanced threats, but it does not provide all the capabilities of a NGFW. References: [CompTIA Advanced Security Practitioner (CASP+) Certification Exam Objectives], Domain 2: Enterprise Security Architecture, Objective 2.2: Select appropriate hardware and software solutions
質問 # 282
An engineering team has deployed a new VPN service that requires client certificates to be used in order to successfully connect. On iOS devices, however, the following error occurs after importing the .p12 certificate file:
mbedTLS: ca certificate is undefined
Which of the following is the root cause of this issue?
- A. The VPN client configuration is missing the CA private key.
- B. iOS devices have an empty root certificate chain by default.
- C. OpenSSL is not configured to support PKCS#12 certificate files.
- D. The iOS keychain imported only the client public and private keys.
正解：D
解説：
The root cause of this issue is that the iOS keychain imported only the client public and private keys, but not the CA certificate. A PKCS#12 file (.p12 or .pfx) is a file format that contains a certificate and its private key, optionally protected by a password. A PKCS#12 file can also contain intermediate certificates or root certificates that are needed to verify the certificate chain.
However, when importing a PKCS#12 file into the iOS keychain, only the certificate and its private key are imported, not the CA certificate. This means that the iOS device cannot verify the authenticity of the certificate, and displays the error message "mbedTLS: ca certificate undefined". To fix this issue, the CA certificate needs to be imported separately into the iOS keychain, either manually or using a configuration profile.
質問 # 283
A forensic investigator would use the foremostcommand for:
- A. cloning disks.
- B. extracting features such as email addresses.
- C. recovering lost files.
- D. analyzing network-captured packets.
正解：C
解説：
Foremost is a forensic program to recover lost files based on their headers, footers, and internal data structures.
質問 # 284
A penetration tester inputs the following command:
This command will allow the penetration tester to establish a:
- A. network pivot
- B. proxy chain
- C. port mirror
- D. reverse shell
正解：D
解説：
The command depicted is indicative of a reverse shell, which is a type of shell where the target system initiates an outgoing connection to a remote host, and then standard input and output of the command line interface on the target system is redirected through this connection to the remote host. This is typically used by an attacker after exploitation to open a remote command line interface to control the compromised machine.
質問 # 285
A vulnerability analyst identified a zero-day vulnerability in a company's internally developed software.
Since the current vulnerability management system does not have any checks for this vulnerability, an engineer has been asked to create one.
Which of the following would be BEST suited to meet these requirements?
- A. OVAL
- B. ARF
- C. ISACs
- D. Node.js
正解：A
解説：
OVAL (Open Vulnerability and Assessment Language) is a standard that would be best suited for creating checks for a zero-day vulnerability in an organization's internally developed software. OVAL is a standard for expressing system configuration information and vulnerabilities in an XML format, allowing interoperability and automation among different security tools and platforms. An engineer can use OVAL to create definitions or tests for specific vulnerabilities or states in the software, and then use OVAL-compatible tools to scan or evaluate the software against those definitions or tests. ARF (Asset Reporting Format) is not a standard for creating checks for vulnerabilities, but a standard for expressing information about assets and their characteristics in an XML format, allowing interoperability and automation among different security tools and platforms. ISACs (Information Sharing and Analysis Centers) are not standards for creating checks for vulnerabilities, but organizations that collect, analyze, and disseminate information about threats, vulnerabilities, incidents, or best practices among different sectors or communities. Node.js is not a standard for creating checks for vulnerabilities, but a runtime environment that allows executing JavaScript code outside of a web browser, enabling the development of scalable web applications or services. Verified References: https://www.comptia.org/blog/what-is-oval https://partners.comptia.org/docs/default-source
/resources/casp-content-guide
質問 # 286
A company that uses AD is migrating services from LDAP to secure LDAP. During the pilot phase, services are not connecting properly to secure LDAP. Block is an except of output from the troubleshooting session:
Which of the following BEST explains why secure LDAP is not working? (Select TWO.)
- A. The clients may not trust idapt by default.
- B. The clients may not trust Chicago by default.
- C. The company is using the wrong port. It should be using port 389 for secure LDAP.
- D. Secure LDAP does not support wildcard certificates.
- E. Secure LDAP should be running on UDP rather than TCP.
- F. Danvills.com is under a DDoS-inator attack and cannot respond to OCSP requests.
- G. The secure LDAP service is not started, so no connections can be made.
正解：A、D
解説：
The clients may not trust idapt by default because it is a self-signed certificate authority that is not in the trusted root store of the clients. Secure LDAP does not support wildcard certificates because they do not match the fully qualified domain name of the server. Verified References:
https://www.professormesser.com/security-plus/sy0-401/ldap-and-secure-ldap/
,https://www.comptia.org/training/books/casp-cas-004-study-guide
質問 # 287
All staff at a company have started working remotely due to a global pandemic. To transition to remote work, the company has migrated to SaaS collaboration tools. The human resources department wants to use these tools to process sensitive information but is concerned the data could be:
Leaked to the media via printing of the documents
Sent to a personal email address
Accessed and viewed by systems administrators
Uploaded to a file storage site
Which of the following would mitigate the department's concerns?
- A. VDI, proxy, CASB, and DRM
- B. Watermarking, forward proxy, DLP, and MFA
- C. Proxy, secure VPN, endpoint encryption, and AV
- D. Data loss detection, reverse proxy, EDR, and PGP
正解：A
質問 # 288
A company wants to refactor a monolithic application to take advantage of cloud native services and service microsegmentation to secure sensitive application components. Which of the following should the company implement to ensure the architecture is portable?
- A. Containerization
- B. Type 2 hypervisors
- C. Orchestration
- D. Virtualized emulators
正解：A
解説：
Containerization would allow the company to refactor a monolithic application to take advantage of cloud native services and service microsegmentation to secure sensitive application components, because containerization would:
Enable the application to be split into smaller and independent components (microservices) that can communicate with each other through APIs or message queues.
Allow the application to leverage cloud native services, such as load balancers, databases, or serverless functions, that can be integrated with containers through configuration files or environment variables.
Enhance the security of the application by isolating each container from other containers and the host system, and applying fine-grained access control policies and network rules to each container or group of containers.
Ensure the portability of the application by enabling it to run on any cloud provider or platform that supports containers, without requiring any changes to the application code or configuration.
質問 # 289
......
CASP+ 認定は世界的に認められ、雇用者から高く評価されています。この認定により、IT 専門家は仕事市場において競争力を持ち、複雑な IT 環境を保護するために必要なスキルを持っていることが保証されます。CASP+ 認定を持つ IT 専門家は、セキュリティエンジニア、セキュリティアーキテクト、セキュリティコンサルタント、セキュリティマネージャーなど、さまざまな役割で働くことができます。
CompTIA CAS-004 認定は、複雑な IT 環境のセキュリティを設計、実装、管理する責任を持つプロフェッショナルを対象としています。この認定は、世界的に認められ、業界で高く評価されています。認定試験は、候補者がセキュリティリスクを分析し、セキュリティソリューションを設計・実装し、セキュリティインシデントに対応する能力を測定します。また、デジタルフォレンジックス、インシデント対応、セキュリティオペレーションなどの上級トピックもカバーしています。
CAS-004試験問題を今すぐ試そう！最新の[2025年最新] 正解回答付き：https://www.jpntest.com/shiken/CAS-004-mondaishu
合格させるCAS-004試験にはリアル問題解答：https://drive.google.com/open?id=1rffpcdlVBEXzdXS-e_jYohPQJF6hDYk6