CompTIA Security+ (Sy0-301) Practice Exam

Reviewed by Editorial Team

The ProProfs editorial team is comprised of experienced subject matter experts. They've collectively created over 10,000 quizzes and lessons, serving over 100 million users. Our team includes in-house content moderators and subject matter experts, as well as a global network of rigorously trained contributors. All adhere to our comprehensive editorial guidelines, ensuring the delivery of high-quality content.

Learn about Our Editorial Process

| By Averywright

Averywright

Community Contributor

Quizzes Created: 1 | Total Attempts: 5,553

| Attempts: 5,554

Quiz Flashcard

Questions

Feedback

During the Quiz End of Quiz

Difficulty

Sequential Easy First Hard First

1/94 Questions

What feature of a network switch allows the network administrator to capture network traffic when monitoring or troubleshooting the network?
- Port security
- VLAN
- Collision domain
- Port Mirroring

About This Quiz

When you have a computer on which you use sensitive information like bank details and passwords, you’re probably content in the knowledge that it’s being protected so long as you have decent internet security installed. Have you ever stopped to think about what processes go into ensuring computers are kept safe from malware and hacking? Take this quiz to learn See moreall about it! Good luck!

CompTIA Security+ (Sy0-301) Practice Exam - Quiz

Quiz Preview

2.

Your manager has been reading about hackers capturing network traffic in a switched network environment and is wondering how it is possible that hackers can do this. How can this be accomplished? (Select all that apply.)
- ARP Poisioning
- Port mirroring
- Port security
- MAC flooding
- VLANs
Correct Answer(s)

A. ARP Poisioning
A. MAC flooding

Explanation

Hackers can use a few different techniques to bypass the filtering feature of a switch. The hacker can use ARP poisoning, which poisons the ARP cache on all systems, forcing them to send data to the hacker’s system. Another technique is MAC flooding, which involves the hacker sending bogus MAC addresses to the switch, which causes the switch to not trust the MAC address table. As a result the switch starts flooding all frames (sends the frames to every port) where the hacker is connected and running sniffer software.

Rate this question:
3.

Your company has a web application that seems to be running slowly. Your manager is wondering what can be done to improve the performance. How do you respond?
- Install a proxy server
- Install a load balancer
- Configure the web site in a VLAN
- Configure port security
Correct Answer

A. Install a load balancer

Explanation

A load balancer can be used to split the workload between multiple systems, in this case multiple web servers. Load balancing is a common solution for optimizing performance on web sites or even mail servers.

Rate this question:
4.

Which of the following devices could be used to limit which web sites users on the network can visit?
- Router
- Load balancer
- Proxy server
- CAT 5e
Correct Answer

A. Proxy server

Explanation

Proxy servers are used to control outbound Internet access by filtering web sites users can surf and applications they can use.

Rate this question:
5.

Which TCP/IP protocol is used to convert the IP address to a MAC address?
- ARP
- TCP
- ICMP
- UDP
Correct Answer

A. ARP

Explanation

The ARP protocol is responsible for converting the IP address to a MAC address.

Rate this question:
6.

What ICMP type is used to identify echo request messages?
- 0
- 4
- 8
- 9
Correct Answer

A. 8

Explanation

The ICMP type for echo request messages is ICMP type 8.

Rate this question:
7.

Which of the following identifies the stages of the three-way handshake?
- ACK/SYN, ACK, SYN
- SYN, ACK/SYN, ACK
- ACK, SYN, ACK/SYN
- SYN, ACK, ACK/SYN
Correct Answer

A. SYN, ACK/SYN, ACK

Explanation

The order of the packets for a three-way handshake is SYN, ACK/SYN, and then ACK.

Rate this question:
8.

Which of the following represents ports used by secure TCP applications? (Select all that apply.)
- 23
- 22
- 80
- 143
- 443
Correct Answer(s)

A. 22
A. 443

Explanation

SSH, which is a secure protocol to replace Telnet, uses port 22, while HTTPS is a secure replacement for HTTP traffic and uses port 443.

Rate this question:
9.

You are the network administrator for a small company, and you wish to follow security best practices that relate to the switch. Which of the following should you do? (Select all that apply.)
- Disable unused ports
- Enable all unused ports
- Configure port security
- Disable port security
- Enable console password
- Disable console password
Correct Answer(s)

A. Disable unused ports
A. Configure port security
A. Enable console password

Explanation

When securing devices such as a switch, ensure the administration port, such as a console port, has a password configured. Also disable any unused port and configure port security on the ports.

Rate this question:
10.

What popular feature of a switch allows you to create communication boundaries between systems connected to the switch?
- ARP poisoning
- Port mirroring
- Port security
- MAC flooding
- VLANs
Correct Answer

A. VLANs

Explanation

When you place systems in a VLAN, by default they cannot communicate with systems outside the VLAN. You can have a router route the information from one VLAN to another.

Rate this question:
11.

As requested by your manager you purchase two servers to participate in a server cluster so that if one server fails, the other server will take over the workload. Which of the following goals of security has been met?
- Confidentiality
- Accountability
- Integrity
- Availability
Correct Answer

A. Availability

Explanation

Availability is ensuring that the company asset, such as a server and its data, is available at all times. You can help offer availability by using RAID, server clusters, or performing regular backups.

Rate this question:
12.

You have protected the contents of a highly sensitive file by encrypting the data using Windows EFS. Which of the following goals of security has been satisfied?
- Confidentiality
- Accountability
- Integrity
- Availability
Correct Answer

A. Confidentiality

Explanation

Confidentiality involves ensuring untrusted parties cannot view sensitive information. You typically implement confidentiality by encrypting data and communications or by setting permissions on the resource.

Rate this question:
13.

You have managed the file permissions on a file so that unauthorized persons cannot make modifications to the file. What goal of security has been met?
- Confidentiality
- Accountability
- Integrity
- Availability
Correct Answer

A. Integrity

Explanation

Integrity deals with ensuring that the data has not been altered after being sent to the recipient or stored on the server. In this example, you have modified the permissions so that unauthorized changes to the file cannot be made, which is ensuring the integrity of the file.

Rate this question:
14.

You have configured your network so that each person on the network must provide a username and password to gain access. Presenting a username is an example of what?
- Authentication
- Identification
- Authorization
- Confidentiality
Correct Answer

A. Identification

Explanation

Presenting a username to the system is an example of how the user identifies themselves to the system.

Rate this question:
15.

You have configured the permissions on the accounting folder so that the Accounting group can create, modify, and delete content in the folder; the Managers group can read the contents of the folder; and all other users have been denied access. This is an example of which of the following?
- Authentication
- Identification
- Authorization
- Confidentiality
Correct Answer

A. Authorization

Explanation

Authorization typically involves configuring an access control list such as a permission list and specifying what level of access to a resource a user may have.

Rate this question:
16.

Which of the following are considered biometrics? (Select all that apply)
- Username and password
- Smartcard
- PIN number
- Fingerprint
- Retina scan
Correct Answer(s)

A. Fingerprint
A. Retina scan

Explanation

Biometrics is using a characteristic of yourself to authenticate to a system. Popular examples of biometrics are fingerprint reading, retina scanning, and voice recognition.

Rate this question:
17.

Before an individual is authorized to access resources on the network, they are first ________ with the network.
- Authenticated
- Identified
- Authorized
- Encrypted
Correct Answer

A. Authenticated

Explanation

Before authorization can occur each individual must first be authenticated to the system or network. Authentication is the proving of your identity by typically using a password (authentication) to go with the username (identification).

Rate this question:
18.

You have taken the time to create and implement security policies within your organization. This is an example of which of the following?
- Due diligence
- Separation of duties
- Least privilege
- Due care
Correct Answer

A. Due care

Explanation

Due care is the act of doing the right thing. In this example, the action is the creation of
the security policy that should exist in all organizations.

Rate this question:
19.

All accountants need to be able to modify the accounting data except for Bob. Due to Bob’s job requirements, you have ensured that Bob receives only the read permission to the accounting data. This is an example of which of the following?
- Rotation of duties
- Separation of duties
- Least privilege
- Due care
Correct Answer

A. Least privilege

Explanation

A very important principle of security is the concept of least privilege. Least privilege is
the principle that you should always give only the minimum level of permissions or rights to an
individual.

Rate this question:
20.

Which of the following represents the reasoning for implementing rotation of duties in your environment?
- To limit fraudulent activities within the organization
- To keep data private to the appropriate individuals
- To make information available
- To ensure the secrecy of the information
Correct Answer

A. To limit fraudulent activities within the organization

Explanation

Rotation of duties is designed to hold people responsible for their actions by having
someone else take over the position at a later time. Someone holding this position will not be
likely to perform fraudulent activities knowing that someone else will detect that activity once
placed in the position.

Rate this question:
21.

Within most organizations the person who writes the check is not the person who signs the check. This is an example of which of the following?
- Rotation of duties
- Separation of duties
- Least privilege
- Due care
Correct Answer

A. Separation of duties

Explanation

Having the person that writes the check being different than the person who signs the
check is an example of separation of duties.

Rate this question:
22.

After creating and implementing the company security policy, you verify that policies are being followed on a regular basis by performing regular audits. This is an example of which of the following?
- Due diligence
- Separation of duties
- Least privilege
- Due care
Correct Answer

A. Due diligence

Explanation

Due diligence is the assessing and verifying of actions and the assessing of risks to a
company. In this example, you are verifying that the policy is being followed.

Rate this question:
23.

What type of hacker learns hacking techniques so that they can better defend against a malicious hacker?
- Black-hat
- Gray-hat
- White-hat
- Yellow-hat
Correct Answer

A. White-hat

Explanation

A white-hat hacker learns hacking techniques to learn how to defend against a
malicious hacker.
The other options are incorrect for the following reasons:
A black-hat hacker is someone who hacks for financial gain
or malicious reasons. A gray-hat hacker is someone who learns of a vulnerability and then
publishes it to the world. There is no such thing as a yellow-hat hacker.

Rate this question:
24.

The entity that is responsible for deciding the level of protection that is placed on data and that is ultimately responsible for the security of that data is which of the following?
- Custodian
- Owner
- User
- Administrator
Correct Answer

A. Owner

Explanation

The owner decides on the value of the asset and what level of protection is needed. The
owner is management within the organization, and they are ultimately responsible for securing
the environment.

Rate this question:
25.

The entity that is responsible for implementing the appropriate security controls to protect an asset is which of the following?
- Custodian
- Owner
- User
- Administrator
Correct Answer

A. Custodian

Explanation

The custodian is responsible for implementing the controls to protect the asset and is
your IT staff.

Rate this question:
26.

Which type of policy is not optional and must be adhered to?
- Procedure
- Standard
- Guideline
- Least privilege
Correct Answer

A. Standard

Explanation

A standard is the type of policy that must be followed.
The other answers are incorrect for the following reasons:
A procedure is a step-by-step document that demonstrates how
to accomplish specific tasks. A guideline is a policy that makes a recommendation that does not
need to be followed. Least privilege is incorrect because it is not a type of policy but a principle
of security that involves ensuring that you always give the lowest privileges or permissions
needed to accomplish a goal.

Rate this question:
27.

Which of the following are considered PII-related information that must be secured at all times? (Choose all that apply)
- Postal code
- Driver’s license
- City name
- Social Security number
- Street name
Correct Answer(s)

A. Driver’s license
A. Social Security number

Explanation

Personal Identifiable Information (PII) is unique information about a person that
should be protected at all times and kept confidential.

Rate this question:
28.

What is the first step in creating a security policy?
- Obtain management approval and support.
- Create the AUP.
- Download sample templates.
- Review job roles.
Correct Answer

A. Obtain management approval and support.

Explanation

The first step to creating a security policy is to get approval and support from upper-level
management. Although downloading sample templates may be a great idea to
help you create the policies, it is not the first thing that needs to be done. Creating the AUP
and reviewing job roles are also not correct answers because you always need to obtain support
from management first when dealing with policies.

Rate this question:
29.

One of the network administrators in the office has been monitoring the proxy server logs and notices that Bob has visited some inappropriate web sites. What policy is this in violation of?
- Firewall policy
- Proxy server policy
- AUP
- Hiring policy
Correct Answer

A. AUP

Explanation

The acceptable use policy (AUP) contains the rules for proper computer, Internet,
e-mail, and device usage within the company. The firewall policy contains rules for what type of traffic is allowed to
pass through firewalls, and the proxy server policy is similar to the firewall policy and is
designed to control what traffic is allowed to go inside and outside the network. The hiring
policy contains rules surrounding the process for HR to follow when hiring a new employee.

Rate this question:
30.

The technical team is putting together the firewall solution and needs to know what type of traffic is to pass through the firewall. What policy can the technical team use to find out what traffic is to pass through the firewall?
- AUP
- Hiring policy
- VPN policy
- Firewall policy
Correct Answer

A. Firewall policy

Explanation

The firewall policy contains the detailed information needed to know what the company’s approved firewall configuration is. The acceptable use policy (AUP) contains the rules for proper computer, Internet, e-mail, and device usage within the company. The hiring policy contains rules surrounding the process for HR to follow when hiring a new employee. The VPN policy
contains details on the approved VPN solution and what the requirements are for employees to
be able to VPN into the network from a remote location.

Rate this question:
31.

The network administrator is configuring the network and wants to put restrictions on user passwords such as the length of the password, password complexity, and password history. Where can the administrator find out what the values of those settings should be set to?
- VPN policy
- Password policy
- AUP
- Secure disposal of computers
Correct Answer

A. Password policy

Explanation

The password policy contains the password requirements that need to be enforced on the network servers. The VPN policy contains details on the approved VPN solution and what the requirements are for employees to be able to VPN into the network from a remote location. The acceptable use policy (AUP) contains the rules for proper computer, Internet e-mail, and device usage within the company. The secure disposal of computers policy contains the rules governing how to get rid of old computers and equipment and requires that all confidential data is securely removed from the device or computer.

Rate this question:
32.

Doug is the network administrator for a law firm and has just purchased 20 new systems for the employees. Doug has collected all of the old computers from the employees and has searched through the hard drives and deleted any DOC and XLS files before handing the computers over to the local school. What policy may Doug be in violation of?
- AUP
- Password policy
- Virus protection policy
- Secure disposal of computers
Correct Answer

A. Secure disposal of computers

Explanation

The secure disposal of computers policy contains the rules surrounding what to do with equipment that is no longer needed in the company. The policy should state that all hard drives have to be physically destroyed before passing the computers on, so that you can ensure that no confidential data can be retrieved from the system.

Rate this question:
33.

Data classification labels are applied to ______, while clearance levels are applied to ______.
- Employees, information
- Management, employees
- Information, employees
- Employees, management
Correct Answer

A. Information, employees

Explanation

Information within the company is assigned a data classification label, while the employees are then given a clearance level. For example, a document may be assigned the top secret classification label so that for an employee to gain access to the information, they must have the top secret clearance level.

Rate this question:
34.

Bob requires the capabilities to change the system time on the computers, but instead of adding Bob to the Administrators group (who can change the time on the computer), you grant Bob the Change System Time right. This is an example of following which security principle?
- Least privilege
- Job rotation
- Separation of duties
- AUP
Correct Answer

A. Least privilege

Explanation

The concept of least privilege is to ensure you give only the minimal permissions or rights needed to perform a task. Job rotation is a security principle that requires employees to rotate through job positions on a regular basis in order to detect any improper activities. Separation of duties is a security principle that involves dividing a job into multiple tasks with each task being performed by a different employee. The acceptable use policy (AUP) contains the rules for proper computer, Internet, e-mail, and device usage within the company.

Rate this question:
35.

Which of the following is a good reason to ensure all employees take vacation time each year?
- To keep the employee refreshed and energized
- To hold employees accountable for any suspicious activity
- To keep the employee happy
- To raise company morale
Correct Answer

A. To hold employees accountable for any suspicious activity

Explanation

The security reason to implement mandatory vacation is so that while they are on vacation, you can hopefully detect improper activity performed by an employee. If the employee is always around, they will continue to avoid detection of their activity.

Rate this question:
36.

Management is concerned that an employee may be able to hide fraudulent activity for long durations while working for the company. What would you recommend to help detect an improper activity performed by employees?
- Least privilege
- AUP
- Disabling the employee’s user accounts and access cards
- Job rotation
Correct Answer

A. Job rotation

Explanation

Implementing the security principle known as job rotation is a great way to detect fraudulent activities performed by employees. The concept of least privilege is to ensure you give only the minimal permissions or rights needed to perform a task. The acceptable use policy (AUP) contains the rules for proper computer, Internet, e-mail, and device usage within the company. Disabling the user account and access cards will not help you detect fraudulent activity—you need someone to take over the job role for a while in hopes they will discover improper activity by the previous employee.

Rate this question:
37.

Management has come to you to let you know that John, a longtime employee of the company, has been stealing money from the company. Management and HR are headed into a meeting with John to let him know he is no longer needed. What should you do while they are in the meeting?
- Review logs
- See if anyone wants his office space
- Disable the employee’s user accounts and access cards
- Format the drive on his workstation
Correct Answer

A. Disable the employee’s user accounts and access cards

Explanation

You will want to verify with management before they head into the meeting what your responsibilities are, and they will typically inform you of what corporate policy is surrounding the termination of employment, but typically you want to disable the account while notice is given to the employee so that when the employee comes out of the meeting, they cannot access company assets and do any damage.

Rate this question:
38.

Sue comes to you asking if it is okay if she downloads movies to her company laptop with a P2P program so that she can watch the movies while she is away on business. Which of the following is the best response?
- Educate Sue on the fact that those programs are popular ways to spread viruses, so no, the company does not allow P2P software on its systems.
- Tell her no.
- Tell her yes as long as she does not watch the movies during work hours.
- Tell her yes as long as she places the downloaded movies on the server so that you can virus scan them.
Correct Answer

A. Educate Sue on the fact that those programs are popular ways to spread viruses, so no, the company does not allow P2P software on its systems.

Explanation

The key point here is to educate the user on company policy regarding the use of P2P software with company assets. Explain to the user the risks associated with downloading content from untrusted sources, and explain that P2P software is where a lot of viruses come from.

Rate this question:
39.

What is the term used for when someone slips through an open door behind you after you have unlocked the door?
- Horseback riding
- Worming
- Tailgating
- Gliding
Correct Answer

A. Tailgating

Explanation

Tailgating or piggybacking is the term we use in the security field for someone who enters a locked door behind you after it is opened by an authorized person. Be sure to educate employees on tailgating!

Rate this question:
40.

You are talking with management about ways to limit security threats such as tailgating within the company. Management has said there is no money to spend on controls such as mantraps—what can you do to reduce the risk of tailgating?
- Purchase an additional lock.
- Training and awareness.
- Purchase a revolving door.
- Purchase a mantrap.
Correct Answer

A. Training and awareness.

Explanation

One of the ways to control tailgating in highly secure environments is to use a mantrap—an area between two locked doors where one door does not open until the first door is closed. Solutions such as mantraps or revolving doors are great solutions but they cost money. A cheap solution in low secure environments is to educate the employees on tailgating and to not open the door if someone is hanging around the entrance.

Rate this question:
41.

Your manager has called you into the office and has expressed concerns about a number of news reports on social engineering attacks. Your manager would like to know what can be done to protect the company against social engineering attacks. What would you recommend to your manager?
- Use a firewall.
- User awareness and training.
- Install antivirus software.
- Implement physical security.
Correct Answer

A. User awareness and training.

Explanation

User awareness and training is the only way to protect against social engineering attacks. Technology solutions such as firewalls, antivirus software, and physical security will always help a little, but to truly protect against social engineering attacks, you need to educate the users so they are aware of security best practices.

Rate this question:
42.

Which of the following controls will help protect against tailgating?
- Locked doors
- Electronic keypads
- Swipe cards
- Mantrap
Correct Answer

A. Mantrap

Explanation

A mantrap is an area between two locked doors. The second door cannot be opened until the first door is locked, which helps employees entering the facility notice anyone who may try to enter along with them.

Rate this question:
43.

What is the term used for a phishing attack that is targeted toward a specific person such as the executive of a company?
- Whaling
- Phishing
- Pharming
- Spim
Correct Answer

A. Whaling

Explanation

Whaling is the term for targeting the phishing attack to “the big fish” in the company. With a whaling attack the e-mail message is typically personalized by using the name of that individual. Phishing is sending a generic e-mail to a mass group of people in hopes that someone clicks the link that goes to the fake web site. Pharming is modifying DNS or the hosts file to lead people to the wrong site. Spim is spamming (sending unsolicited e-mails) through instant messenger applications.

Rate this question:
44.

What type of attack results in the victim’s system not being able to perform its job function?
- Man-in-the-middle
- Spoofing
- Denial of service
- Port scanning
Correct Answer

A. Denial of service

Explanation

A denial of service attack involves the hacker causing a system to not perform its job role by overburdening the system with traffic. The DoS attack could cause the system to crash or slow the system down.

Rate this question:
45.

The hacker has managed to poison everyone’s ARP cache so that all traffic to the Internet is being sent to the hacker’s system before they route it out to the Internet. What type of attack is this?
- DDoS
- DoS
- Phishing
- MiTM
Correct Answer

A. MiTM

Explanation

When the hacker positions himself between two systems and is receiving a copy of all traffic before passing it on to the real destination, this is a man-in-the-middle (MiTM) attack.

Rate this question:
46.

What file can the hacker modify after compromising your system that could lead you to the wrong web site?
- Sam
- Hosts
- Lmhosts
- Services
Correct Answer

A. Hosts

Explanation

The hosts file on a system is used to resolve domain names to IP addresses and can be used by the hacker to lead you to the wrong web site if the hacker gains access to this file.

Rate this question:
47.

What type of attack is a smurf attack?
- DDoS
- DoS
- DNS poison
- MiTM
Correct Answer

A. DDoS

Explanation

A smurf attack is an example of a DDoS attack. It involves the hacker spoofing the IP address so that ping messages appear to come from the victim. When all of the systems that were pinged reply to the ping message, they overburden the victim’s system.

Rate this question:
48.

John has been studying hacking techniques used by hackers and decides to send a packet to your system, but ensures that he alters the source IP address of the packet so it looks like it came from someone else. What type of attack is this?
- Phishing
- Pharming
- Spim
- Spoofing
Correct Answer

A. Spoofing

Explanation

Spoofing is when someone alters the source address of a message. IP spoofing is the altering of the source IP address, MAC spoofing is when the hacker alters the source MAC address, and e-mail spoofing is when the hacker alters the source e-mail address of a message.

Rate this question:
49.

Your manager has been reading a lot about popular password attacks such as dictionary attacks and brute-force attacks. Your manager is worried that your company is susceptible to such attacks. Which of the following controls will help protect against a brute-force attack?
- Password complexity
- Account lockout
- Network firewall
- Intrusion detection system
Correct Answer

A. Account lockout

Explanation

To protect against a brute-force attack, you need to take the time away from the hacker. Implementing an account lockout policy takes time away from the hacker so that they can try logging only a few times before the account is locked and unusable.

Rate this question:

Quiz Review Timeline (Updated): Jun 10, 2024 +

Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.

Current Version
Jun 10, 2024

Quiz Edited by
ProProfs Editorial Team
Dec 10, 2012

Quiz Created by
Averywright

CompTIA Security+ (Sy0-301) Practice Exam

What feature of a network switch allows the network administrator to capture network traffic when monitoring or troubleshooting the network?

Quiz Preview

Your manager has been reading about hackers capturing network traffic in a switched network environment and is wondering how it is possible that hackers can do this. How can this be accomplished? (Select all that apply.)

Your company has a web application that seems to be running slowly. Your manager is wondering what can be done to improve the performance. How do you respond?

Which of the following devices could be used to limit which web sites users on the network can visit?

Which TCP/IP protocol is used to convert the IP address to a MAC address?

What ICMP type is used to identify echo request messages?

Which of the following identifies the stages of the three-way handshake?

Which of the following represents ports used by secure TCP applications? (Select all that apply.)

You are the network administrator for a small company, and you wish to follow security best practices that relate to the switch. Which of the following should you do? (Select all that apply.)

What popular feature of a switch allows you to create communication boundaries between systems connected to the switch?

As requested by your manager you purchase two servers to participate in a server cluster so that if one server fails, the other server will take over the workload. Which of the following goals of security has been met?

You have protected the contents of a highly sensitive file by encrypting the data using Windows EFS. Which of the following goals of security has been satisfied?

You have managed the file permissions on a file so that unauthorized persons cannot make modifications to the file. What goal of security has been met?

You have configured your network so that each person on the network must provide a username and password to gain access. Presenting a username is an example of what?

You have configured the permissions on the accounting folder so that the Accounting group can create, modify, and delete content in the folder; the Managers group can read the contents of the folder; and all other users have been denied access. This is an example of which of the following?

Which of the following are considered biometrics? (Select all that apply)

Before an individual is authorized to access resources on the network, they are first ________ with the network.

You have taken the time to create and implement security policies within your organization. This is an example of which of the following?

All accountants need to be able to modify the accounting data except for Bob. Due to Bob’s job requirements, you have ensured that Bob receives only the read permission to the accounting data. This is an example of which of the following?

Which of the following represents the reasoning for implementing rotation of duties in your environment?

Within most organizations the person who writes the check is not the person who signs the check. This is an example of which of the following?

After creating and implementing the company security policy, you verify that policies are being followed on a regular basis by performing regular audits. This is an example of which of the following?

What type of hacker learns hacking techniques so that they can better defend against a malicious hacker?

The entity that is responsible for deciding the level of protection that is placed on data and that is ultimately responsible for the security of that data is which of the following?

The entity that is responsible for implementing the appropriate security controls to protect an asset is which of the following?

Which type of policy is not optional and must be adhered to?

Which of the following are considered PII-related information that must be secured at all times? (Choose all that apply)

What is the first step in creating a security policy?

One of the network administrators in the office has been monitoring the proxy server logs and notices that Bob has visited some inappropriate web sites. What policy is this in violation of?

The technical team is putting together the firewall solution and needs to know what type of traffic is to pass through the firewall. What policy can the technical team use to find out what traffic is to pass through the firewall?

The network administrator is configuring the network and wants to put restrictions on user passwords such as the length of the password, password complexity, and password history. Where can the administrator find out what the values of those settings should be set to?

Data classification labels are applied to ______, while clearance levels are applied to ______.

Bob requires the capabilities to change the system time on the computers, but instead of adding Bob to the Administrators group (who can change the time on the computer), you grant Bob the Change System Time right. This is an example of following which security principle?

Which of the following is a good reason to ensure all employees take vacation time each year?

Management is concerned that an employee may be able to hide fraudulent activity for long durations while working for the company. What would you recommend to help detect an improper activity performed by employees?

Management has come to you to let you know that John, a longtime employee of the company, has been stealing money from the company. Management and HR are headed into a meeting with John to let him know he is no longer needed. What should you do while they are in the meeting?

Sue comes to you asking if it is okay if she downloads movies to her company laptop with a P2P program so that she can watch the movies while she is away on business. Which of the following is the best response?

What is the term used for when someone slips through an open door behind you after you have unlocked the door?

You are talking with management about ways to limit security threats such as tailgating within the company. Management has said there is no money to spend on controls such as mantraps—what can you do to reduce the risk of tailgating?

Your manager has called you into the office and has expressed concerns about a number of news reports on social engineering attacks. Your manager would like to know what can be done to protect the company against social engineering attacks. What would you recommend to your manager?

Which of the following controls will help protect against tailgating?

What is the term used for a phishing attack that is targeted toward a specific person such as the executive of a company?

What type of attack results in the victim’s system not being able to perform its job function?

The hacker has managed to poison everyone’s ARP cache so that all traffic to the Internet is being sent to the hacker’s system before they route it out to the Internet. What type of attack is this?

What file can the hacker modify after compromising your system that could lead you to the wrong web site?

What type of attack is a smurf attack?

John has been studying hacking techniques used by hackers and decides to send a packet to your system, but ensures that he alters the source IP address of the packet so it looks like it came from someone else. What type of attack is this?

Your manager has been reading a lot about popular password attacks such as dictionary attacks and brute-force attacks. Your manager is worried that your company is susceptible to such attacks. Which of the following controls will help protect against a brute-force attack?

Data classification labels are applied to , while clearance levels are applied to .