CAS-001 무료 덤프문제 온라인 액세스

The Chief Executive Officer (CEO) of a corporation purchased the latest mobile device and wants to connect it to the company's internal network. The Chief Information Security Officer (CISO) was told to research and recommend how to secure this device.
Which of the following recommendations should be implemented to keep the device from posing a security risk to the company?

• A.A password or PIN to access the device and a corporate policy to prevent sensitive information from residing on a mobile device.
• B.Encryption of the non-volatile memory and a password or PIN to access the device.
• C.A corporate policy to prevent sensitive information from residing on a mobile device and anti-virus software.
• D.Encryption of the non-volatile memory and a corporate policy to prevent sensitive information from residing on a mobile device.

A manager who was attending an all-day training session was overdue entering bonus and payroll information for subordinates. The manager felt the best way to get the changes entered while in training was to log into the payroll system, and then activate desktop sharing with a trusted subordinate. The manager granted the subordinate control of the desktop thereby giving the subordinate full access to the payroll system. The subordinate did not have authorization to be in the payroll system. Another employee reported the incident to the security team. Which of the following would be the MOST appropriate method for dealing with this issue going forward?

• A.Provide targeted security awareness training and impose termination for repeat violators.
• B.Block desktop sharing and web conferencing applications and enable use only with approval.
• C.Actively monitor the data traffic for each employee using desktop sharing or web conferencing applications.
• D.Permanently block desktop sharing and web conferencing applications and do not allow its use at the company.

The Chief Information Officer (CIO) of Company XYZ has returned from a large IT conference where one of the topics was defending against zero day attacks - specifically deploying third party patches to vulnerable software. Two months prior, the majority of the company systems were compromised because of a zero day exploit. Due to budget constraints the company only has operational systems. The CIO wants the Security Manager to research the use of these patches. Which of the following is the GREATEST concern with the use of a third party patch to mitigate another un-patched vulnerability?

• A.The company does not have an adequate test environment to validate the impact of the third party patch, introducing unknown risks.
• B.Another period of vulnerability will be introduced because of the need to remove the third party patch prior to installing any vendor patch.
• C.The company's patch management solution only supports patches and updates released directly by the vendor.
• D.The third party patch may introduce additional unforeseen risks and void the software licenses for the patched applications.

Which of the following is the information owner responsible for?

• A.Integrating security considerations into application and system purchasing decisions.
• B.Developing policies, standards, and baselines.
• C.Determining the proper classification levels for data within the system.
• D.Implementing and evaluating security controls by validating the integrity of the data.

After implementing port security, restricting all network traffic into and out of a network, migrating to IPv6, installing NIDS, firewalls, spam and application filters, a security administer is convinced that the network is secure. The administrator now focuses on securing the hosts on the network, starting with the servers.
Which of the following is the MOST complete list of end-point security software the administrator could plan to implement?

• A.Anti-malware/virus/spyware/spam software, as well as a host based firewall and biometric authentication.
• B.Anti-malware/spam software, as well as a host based firewall and strong, three-factor authentication.
• C.Anti-virus/spyware/spam software, as well as a host based IDS, firewall, and strong three-factor authentication.
• D.Anti-malware/virus/spyware/spam software, as well as a host based firewall and strong, two-factor authentication.