最も有効な CAS-001 試験参考書

A security engineer is a new member to a configuration board at the request of management. The company has two new major IT projects starting this year and wants to plan security into the application deployment. The board is primarily concerned with the applications' compliance with federal assessment and authorization standards. The security engineer asks for a timeline to determine when a security assessment of both applications should occur and does not attend subsequent configuration board meetings. If the security engineer is only going to perform a security assessment, which of the following steps in system authorization has the security engineer omitted? (Select TWO).

• A. Consult with the stakeholders to determine which standards can be omitted
• B. Establish the security control baseline to be assessed
• C. Review the results of user acceptance testing
• D. Categorize the applications according to use
• E. Write the systems functionality requirements into the security requirements traceability matrix
• F. Build the application according to software development security standards

A company currently does not use any type of authentication or authorization service for
remote access. The new security policy states that all remote access must be locked down to only authorized personnel. The policy also dictates that only authorized external networks will be allowed to access certain internal resources.
Which of the following would MOST likely need to be implemented and configured on the company's perimeter network to comply with the new security policy? (Select TWO).

• A. Proxy server
• B. Layer 2 switch
• C. WAP
• D. VPN concentrator
• E. Firewall

Which of the following should be used with caution because of its ability to provide access to block level data instead of file level data?

• A. NFS
• B. CIFS
• C. iSCSI
• D. NAS

A new vendor product has been acquired to replace a legacy perimeter security product. There are significant time constraints due to the existing solution nearing end-of-life with no options for extended support. It has been emphasized that only essential activities be performed. Which of the following sequences BEST describes the order of activities when balancing security posture and time constraints?

• A. Decommission the old solution, install the new solution, and test the new solution.
• B. Install the new solution, migrate to the new solution, and test the new solution.
• C. Purchase the new solution, test the new solution, and migrate to the new solution.
• D. Test the new solution, migrate to the new solution, and decommission the old solution.

A Linux security administrator is attempting to resolve performance issues with new software installed on several baselined user systems. After investigating, the security administrator determines that the software is not initializing or executing correctly. For security reasons, the company has implemented trusted operating systems with the goal of preventing unauthorized changes to the configuration baseline. The MOST likely cause of this problem is that SE Linux is set to:

• A. Disabled with a correctly configured policy.
• B. Enforcing mode with an incorrectly configured policy.
• C. Enforcing mode with no policy configured.
• D. Permissive mode with an incorrectly configured policy.