CompTIA Security+ Practice Exam

Reviewed by Editorial Team
The ProProfs editorial team is comprised of experienced subject matter experts. They've collectively created over 10,000 quizzes and lessons, serving over 100 million users. Our team includes in-house content moderators and subject matter experts, as well as a global network of rigorously trained contributors. All adhere to our comprehensive editorial guidelines, ensuring the delivery of high-quality content.
Learn about Our Editorial Process
| By Kwsherri03
K
Kwsherri03
Community Contributor
Quizzes Created: 1 | Total Attempts: 170
| Attempts: 170
SettingsSettings
Please wait...
  • 1/100 Questions

    Which if the following technologies would you use if you need to implement a system that simulates a network of vulnerable devices, so that this network can be targeted by attackers ?

    • A circuit-level firewall
    • A honeypot
    • A IDS
    • A system integrity verifier
Please wait...
About This Quiz


Comptia Security+ Practice Exam- 1
Full length Comptia Security+ Practice Exam. Take this exam like the real exam to see if you are completely prepared for the real exam. Time yourself to 90 minutes to get a feel of the pressures of the real exam. The practice test is designed to reflect the final exam.

CompTIA Security+ Practice Exam - Quiz

Quiz Preview

  • 2. 

    For which of the following can biometrics be used?

    • Authentication

    • Authorization

    • Certification

    • Accountability

    Correct Answer
    A. Authentication
    Explanation
    Biometrics devices use physical characteristics to identify the user.
    Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 18

    Rate this question:

  • 3. 

    With _______________, access decisions are based on the roles that individual users have as part of an organization.

    • Server based access control

    • Rule based access control

    • Token based access control

    • Role based access control

    • All of the Above

    Correct Answer
    A. Role based access control
    Explanation
    With role-based access control, access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles (such as doctor, nurse, teller, manager). The process of defining roles should be based on a thorough analysis of how an organization operates and should include input from a wide spectrum of users in an organization.

    Most access control systems are rule-based -- that is, they use a preset list of rules when deciding whether or not a user should have access to a resource; this is not specific to access control systems based on user role. Most networks use server-based access control to control access to network resources, however, local resources are typically under the control of the local machine. Neither is particularly unique to role-based access control. Some networks may use token-based access control, but that is not a requirement for role-based access control, either.

    Rate this question:

  • 4. 

    A password represents:

    • Something you have

    • Something you know

    • Something you are

    • All of the Above

    • None of the Above

    Correct Answer
    A. Something you know
    Explanation
    Authentication is accomplished through something you know, something you have and/or something you are. The canonical example of something you know is a password or pass phrase. You might type or speak the value. A number of schemes are possible for obtaining what you know. It might be assigned to you, or you may have picked the value yourself. Constraints may exist regarding the form the value can take, or the alphabet from which you are allowed to construct the value might be limited to letters only. If you forget the value, you may not be able to authenticate yourself to the system.

    Something you have, would be a physical item you possess, such as a smartcard. Something you are, would be a personal characteristic of you, not a piece of information you know.

    Rate this question:

  • 5. 

    A smartcard represents:

    • Something you are

    • Something you know

    • Something you have

    • All of the Above

    • None of the Above

    Correct Answer
    A. Something you have
    Explanation
    Authentication is accomplished through something you know, something you have and/or something you are. One form of authentication requires possession of something ("something you have") such as a key, a smart card, a disk, or some other device. Whatever form it takes, the authenticating item should be difficult to duplicate and may require synchronization with systems other than the one to which you are requesting access. Highly secure environments may require you to satisfy multiple authentication criteria to guarantee authenticity.

    Something you know, would be a piece of data known only to you, such as a password. Something you are, would be a physical characteristic of you, like your fingerprint.

    Rate this question:

  • 6. 

    What type of attacks occurs when a rogue application has been planted on an unsuspecting user's workstation?

    • Social Engineering attacks

    • Logical attacks

    • Physical attacks

    • Trojan Horse attacks

    • None of the Above

    Correct Answer
    A. Trojan Horse attacks
    Explanation
    Trojan Horse attacks - This attack involves a rogue, Trojan horse application that has been planted on an unsuspecting user's workstation. The Trojan horse waits until the user submits a valid PIN from a trusted application, thus enabling usage of the private key, and then asks the smartcard to digitally sign some rogue data. The operation completes but the user never knows that their private key was just used against their will.

    Physical attacks involve physical access to hardware such as a network cable or keyboard. Social engineering attacks are based on taking advantage of human interaction rather than technology itself. (Frequently, social engineering attacks don't even require access to a computer.) There is no such thing as a "logical" attack, although many attacks do involve the use of logic to figure out how an application works and where its security vulnerabilities may be.

    Rate this question:

  • 7. 

    An administrator wishes to enable network auditing policies. Which of the following should the security administrator log?

    • Both logon successes and logon failures

    • Only logon failures for non-existent users

    • Only logon success

    • Only logon failures

    Correct Answer
    A. Both logon successes and logon failures
    Explanation
    The correct answer is "Both logon successes and logon failures" because by logging both logon successes and failures, the administrator can have a comprehensive view of all the login activities on the network. This will help in identifying any unauthorized access attempts or potential security breaches. Logging only logon failures for non-existent users or only logon successes or failures would provide incomplete information and may lead to overlooking important security incidents.

    Rate this question:

  • 8. 

    Which of the following is NOT a valid access control mechanism?

    • DAC (Discretionary Access Control) list.

    • SAC (Subjective Access Control) list.

    • MAC (Mandatory Access Control) list.

    • RBAC (Role Based Access Control) list.

    Correct Answer
    A. SAC (Subjective Access Control) list.
    Explanation
    There is no such thing as a SAC (Subjective Access Control) list.

    Rate this question:

  • 9. 

    You work as the security administrator at Certkiller .com. Certkiller has a RBAC (Role Based Access Control) compliant system for which you are planning the security implementation. There are three types of resources including files, printers, and mailboxes and four distinct departments with distinct functions including Sales, Marketing, Management, and Production in the system. Each department needs access to different resources. Each user has a workstation. Which roles should you create to support the RBAC (Role Based Access Control) model?

    • File, printer, and mailbox roles

    • Sales, marketing, management, and production roles

    • User and workstation roles

    • Allow access and deny access roles

    Correct Answer
    A. Sales, marketing, management, and production roles
    Explanation
    Each distinct department (sales, marketing, management, and production) has their own role in the company, which probably includes using the: filer server, print server, and mail server. So it would be wise to create roles for each department.

    Rate this question:

  • 10. 

    Enforcing minimum privileges for general system users can be easily achieved through the use of:

    • IPSEC

    • TSTEC

    • PRVMIN

    • RBAC

    Correct Answer
    A. RBAC
    Explanation
    Explanation: Ensuring least privilege requires identifying what the user's job is, determining the minimum set of privileges required to perform that job, and restricting the user to a domain with those privileges and nothing more. By denying to subjects transactions that are not necessary for the performance of their duties, those denied privileges couldn't be used to circumvent the organizational security policy. Although the concept of least privilege currently exists within the context of the TCSEC, requirements restrict those privileges of the system administrator. Through the use of RBAC (role based access control), enforced minimum privileges for general system users can be easily achieved.

    Rate this question:

  • 11. 

    Which of the following is NOT a good password deployment guideline?

    • Passwords must be changed at least once every 60 days, depending on your environment.

    • Passwords must not be the same as user id or login id.

    • Password aging must be enforced on all systems.

    • Password must be easy to memorize.

    • All of the Above

    Correct Answer
    A. Password must be easy to memorize.
    Explanation
    Passwords should be easy to memorize, because that minimizes the chance that users will write the password down somewhere that others could see it.

    Passwords should not be the same as the user ID, because that is one of the common passwords that common "password cracker" programs try, when attempting to discover passwords for accounts. Passwords must be changed at least once every 60 days (depending on your environment). Password aging or expiration must be enforced on all systems. Upon password expiration, if the password is not changed, only three grace logins must be allowed then the account must be disable until reset by an administrator or the help desk. Password reuse is not allowed (rotating passwords).

    Rate this question:

  • 12. 

    Which of the following attacks could be the most successful when the security technology is properly implemented and configured?

    • Logical attacks

    • Physical attacks

    • Trojan Horse attacks

    • Social Engineering attacks

    • None of the Above

    Correct Answer
    A. Social Engineering attacks
    Explanation
    Social Engineering attacks: in computer security systems, this type of attack is usually the most successful, especially when the security technology is properly implemented and configured. Usually, these attacks rely on the faults in human beings. An example of a social engineering attack has a hacker impersonating a network service technician. The serviceman approaches a low-level employee and requests their password for network servicing purposes. When using smartcards instead of passwords, this type of attack is a bit more difficult. Most people would not trust an impersonator wishing to have their smartcard and PIN for service purposes.

    Logical, physical and Trojan horse attacks are often much less successful when security is properly implemented on a network.

    Rate this question:

  • 13. 

    Microsoft supports the _______________ and ______standards for use in extranet.

    • CORBA

    • IPSec

    • PPTP

    • DCOM

    • Both A & D

    Correct Answer(s)
    A. IPSec
    A. PPTP
    Explanation
    Netscape, Oracle, and Sun Microsystems have announced an alliance to ensure that their extranet products can work together by standardizing on JavaScript and the Common Object Request Broker Architecture (CORBA). Microsoft supports the Point-to-Point Tunneling Protocol (PPTP) and IPSec.

    CORBA and DCOM are programming technologies.

    Rate this question:

  • 14. 

    Which of the following is an example of a task-based control model?

    • It is an example of Rule Based Access Control (RBAC).

    • It is an example of Mandatory Access Control (MAC).

    • It is an example of Role Based Access Control (RBAC).

    • It is an example of Discretionary Access Control (DAC).

    Correct Answer
    A. It is an example of Role Based Access Control (RBAC).
  • 15. 

    Which of the following best describes an access control mechanism in which access control decisions are based on the responsibilities that an individual user or process has in an organization?

    • RBAC (Role Based Access Control)

    • DAC (Discretionary Access Control)

    • MAC (Mandatory Access Control)

    • All of the Above

    • None of the above.

    Correct Answer
    A. RBAC (Role Based Access Control)
    Explanation
    The RBAC model allows a user to act in a certain predetermined manner based on the role the user holds in the organization. Users can be assigned certain roles system wide.

    Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 12

    Rate this question:

  • 16. 

    Determine the access control model where users are assigned access rights based on their function within the organization?

    • This is a feature of Discretionary Access Control (DAC).

    • This is a feature of Rule Based Access Control (RBAC).

    • This is a feature of Role Based Access Control (RBAC).

    • This is a feature of Mandatory Access Control (MAC).

    Correct Answer
    A. This is a feature of Role Based Access Control (RBAC).
    Explanation
    In Role Based Access Control (RBAC), users are assigned access rights based on their function within the organization. This means that users are given permissions based on their roles or job functions, rather than their individual identities. RBAC allows for more efficient and scalable access control management, as it simplifies the process of granting and revoking access rights by associating them with predefined roles. This model ensures that users have the necessary access to perform their job duties, while also maintaining security by limiting access to sensitive information.

    Rate this question:

  • 17. 

    Which of the following provides the best protection against an intercepted password?

    • VPN (Virtual Private Network).

    • PPTP (Point-to-Point Tunneling Protocol).

    • One time password.

    • Complex password requirement.

    Correct Answer
    A. One time password.
    Explanation
    A one time password is simply a password that has to be changed every time you log on; effectively making any intercepted password good for only the brief interval of time before the legitimate user happens to login themselves. So by chance, if someone were to intercept a password it would probably already be expired, or be on the verge of expiration within a matter of hours.

    Rate this question:

  • 18. 

    Which of the following is the most costly method of an authentication?

    • Passwords

    • Tokens

    • Biometrics

    • Shared secrets

    Correct Answer
    A. Biometrics
    Explanation
    Biometrics These technologies are becoming more reliable, and they will become widely used over the next few years. Many companies use smart cards as their primary method of access control. Implementations have been limited in many applications because of the high cost associated with these technologies. Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 265

    Rate this question:

  • 19. 

    Under MAC, which of the following is true?

    • All that is expressly permitted is forbidden

    • All that is not expressly permitted is not forbidden

    • All that is not expressly permitted is forbidden

    • Both A and B

    • No Answer is Correct

    Correct Answer
    A. All that is not expressly permitted is forbidden
    Explanation
    MAC is the acronym for Mandatory Access Control. It is important to note that mandatory controls are prohibitive (i.e., all that is not expressly permitted is forbidden), not permissive. Only within that context do discretionary controls operate, prohibiting still more access with the same exclusionary principle. In this type of control system decisions are based on privilege (clearance) of subject (user) and sensitivity (classification) of object (file). It requires labeling.

    Under MAC, you define who is allowed to access objects, and if you haven't defined an access right, access is not permitted. So, it is not the case that All that is expressly permitted is forbidden, or that All that is not expressly permitted is not forbidden

    Rate this question:

  • 20. 

    Access controls that are not based on the policy are characterized as:

    • Mandatory controls

    • Discretionary controls

    • Secret controls

    • Corrective controls

    • Non of the Above

    Correct Answer
    A. Discretionary controls
    Explanation
    Access controls that are not based on the policy are characterized as discretionary controls by the U.S. government and as need-to-know controls by other organizations. The latter term connotes least privilege - those who may read an item of data are precisely those whose tasks entail the need.

    Mandatory controls are based on policy. Secret controls and corrective controls are not related to access control.

    Rate this question:

  • 21. 

    ActiveX controls can be digitally signed using a technology called:

    • Java Applet

    • CGI

    • Sandbox

    • Authenticode

    • All of the Above

    Correct Answer
    A. Authenticode
    Explanation
    The ActiveX code is bundled into a single file called an ActiveX control. ActiveX controls can be digitally signed using Microsoft's Authenticode technology. Internet Explorer can be configured to disregard any ActiveX control that isn't signed, to run only ActiveX controls that have been signed by specific publishers, or to accept ActiveX controls signed by any registered software publisher. ActiveX controls do not run in a sandbox. The burden is on the user to determine which ActiveX controls s/he feels are "safe" to run.

    Applets and CGI are alternate types of content, and a sandbox refers to a protected area of the system in which web content runs.

    Rate this question:

  • 22. 

    From a security perspective a performance baseline is MOST useful for:

    • Detecting performance anomalies that may be due to security breaches

    • Assuring that systems are working to their optimal capacity

    • Knowing when security scans are going to finish

    • Predicting the end of useful life for the firewall

    • All of the Above

    Correct Answer
    A. Detecting performance anomalies that may be due to security breaches
    Explanation
    A performance baseline is most useful for detecting performance anomalies that may be due to security breaches. By establishing a baseline of normal performance, any deviations from this baseline can indicate potential security breaches or unauthorized activities. This allows for timely detection and response to security incidents. Assuring optimal system capacity, knowing when security scans will finish, and predicting the end of useful life for the firewall are not directly related to the security perspective of a performance baseline.

    Rate this question:

  • 23. 

    All logs are kept on archive for a period of time. What determines this period of time?

    • Retention policies

    • Administrator preferences

    • MTTF

    • MTTR

    • All of the Above

    Correct Answer
    A. Retention policies
    Explanation
    All logs collected are used in the active and passive monitoring process. All logs are kept on archive for a period of time, called a retention period. This period of time will be determined by your company policies. This allows the use of logs for regular audits, and annual audits if retention is longer then a year. Logs must be secured to prevent modification, deletion, and destruction.

    Administrator preference is often used to determine certain things like how long logs are retained ... but since these decisions can affect the ability of the company to go back and research potential security issues, it is a corporate issue that should be governed by a deliberate policy statement.

    MTTF and MTTR are not relevant to setting the time for which logs will be retained. MTTF (Mean Time To Failure, sometimes called MTBF, Mean Time Before Failure) is related to the average amount of time a piece of equipment will be in service before it fails. MTTR (Mean Time To Repair) is a measure of how long it will take to repair the equipment when it fails.

    Rate this question:

  • 24. 

    A firewall can be classified as a:

    • Rule based access control

    • Lattice based access control

    • Directory based access control

    • ID based access control

    • All of the Above

    Correct Answer
    A. Rule based access control
    Explanation
    Rule based access control is based on a specific profile for each user. Information can be easily changed for only one user but this scheme may become a burden in a very large environment. A rule-based access control unit will intercept every request to the server and compare the source specific access conditions with the rights of the user in order to make an access decision. A good example could be a firewall. Here a set of rules defined by the network administrator is recorded in a file. Every time a connection is attempted (incoming or outgoing), the firewall software checks the rules file to see if the connection is allowed. If it is not, the firewall closes the connection.

    Lattice-based access control is associated with Mandatory Access Control (MAC). Directory based and ID based access controls are not relevant.

    Rate this question:

  • 25. 

    With Discretionary access controls, who determines who has access and what privilege they have?

    • Only the administrators

    • Resource owners

    • End users

    • All of the Above

    • None of the Above

    Correct Answer
    A. Resource owners
    Explanation
    Discretionary access controls can extend beyond limiting which subjects can gain what type of access to which objects. Administrators can limit access to certain times of day or days of the week. Typically, the period during which access would be permitted is 9 a.m. to 5 p.m. Monday through Friday. Such a limitation is designed to ensure that access takes place only when supervisory personnel are present, to discourage unauthorized use of data. Further, subjects' rights to access might be suspended when they are on vacation or leave of absence. When subjects leave an organization altogether, their rights must be terminated rather than merely suspended. Under this type of control, the owner determines who has access and what privilege they have.

    If the end users of resources had control of who had access and what privileges they have, they would be able to access any resource, because they'd have the ability to change access controls at will. If only the administrators controlled access to resources, it would be a major job duty (as well as a bureaucratic bottleneck for users) that would take time away from other administrative activities.

    Rate this question:

  • 26. 

    A centralized database of remote users for a multi-site network typically uses

    • RADIUS

    • PAP

    • MS-CHAP

    • CHAP

    Correct Answer
    A. RADIUS
    Explanation
    RADIUS (Remote Authentication Dial-In User Service) lowers administration costs and increases security by having a centralized database for authenticating remote users. PAP is the simplest of authentication protocols, which uses clear text.

    Rate this question:

  • 27. 

    Identify the access decisions based on a Mandatory Access Control (MAC) environment?

    • Sensitivity labels are based on a Mandatory Access Control (MAC) environment.

    • Access control lists are based on a Mandatory Access Control (MAC) environment.

    • Group membership is based on a Mandatory Access Control (MAC) environment.

    • Ownership is based on a Mandatory Access Control (MAC) environment.

    Correct Answer
    A. Sensitivity labels are based on a Mandatory Access Control (MAC) environment.
    Explanation
    Sensitivity labels are used in a Mandatory Access Control (MAC) environment to determine the level of sensitivity or classification of data. These labels are assigned to resources such as files, folders, or documents, and are used to control access based on the security clearance or level of authorization of users. By applying sensitivity labels, access decisions can be enforced in a MAC environment to ensure that only users with the appropriate clearance can access certain resources.

    Rate this question:

  • 28. 

    Why are clocks used in a Kerberos authentication system?

    • To ensure proper connections.

    • To ensure tickets expire correctly.

    • To generate the seed value for the encryptions keys.

    • To benchmark and set the optimal encryption algorithm.

    Correct Answer
    A. To ensure tickets expire correctly.
    Explanation
    The actual verification of a client's identity is done by validating an authenticator. The authenticator contains the client's identity and a timestamp. To insure that the authenticator is up-to-date and is not an old one that has been captured by an attacker, the timestamp in the authenticator is checked against the current time. If the timestamp is not close enough to the current time (typically within five minutes) then the authenticator is rejected as invalid. Thus, Kerberos requires your system clocks to be loosely synchronized (the default is 5 minutes, but it can be adjusted in Version 5 to be whatever you want).

    Reference: http://www.faqs.org/faqs/kerberos-faq/general/section-22.html

    Rate this question:

  • 29. 

    Identify the process where users can access numerous resources without needing multiple credentials?

    • The authentication process is known as need to know.

    • The authentication process is known as decentralized management.

    • The authentication process is known as Discretionary Access Control (DAC).

    • The authentication process is known as single sign-on.

    Correct Answer
    A. The authentication process is known as single sign-on.
    Explanation
    Single sign-on is a process where users can access numerous resources without needing multiple credentials. This means that once a user is authenticated into one system or application, they can automatically access other systems or applications without having to provide their credentials again. This simplifies the authentication process for users and improves user experience by eliminating the need to remember and enter multiple usernames and passwords.

    Rate this question:

  • 30. 

    A company creates its own application that accesses the company databases and requires a unique login, based on the user’s domain account. The developer has an undocumented login for testing that does not need to be authenticated against the domain. Which of the following is a security issue regarding this scenario?

    • The login should be the same as the domain account for authentication purposes

    • The application should not be deployed if it is not fully tested

    • It is not considered best practice to have a user remember multiple logins

    • It can be used as a backdoor into the company’s databases

    Correct Answer
    A. It can be used as a backdoor into the company’s databases
    Explanation
    The undocumented login for testing that does not need to be authenticated against the domain can be considered a security issue because it creates a potential backdoor into the company's databases. This means that someone who knows about this login could potentially gain unauthorized access to sensitive information and manipulate the company's data without going through the proper authentication process. This loophole in the application's security measures poses a significant risk to the company's data integrity and confidentiality.

    Rate this question:

  • 31. 

    Least privilege is defined as giving access to information:

    • Based on sense of urgency from management

    • Based on tenure at the company

    • Needed to complete the task

    • That may be revealed to the public

    • All of the Above

    Correct Answer
    A. Needed to complete the task
    Explanation
    Least privilege is a principle in information security that states that users should only have the minimum level of access necessary to perform their job tasks. This means that access to information should be granted based on what is needed to complete the task at hand, rather than factors such as management urgency, tenure at the company, or whether the information may be revealed to the public. Therefore, the correct answer is "needed to complete the task."

    Rate this question:

  • 32. 

    Identify the access control model that makes use of security labels connected to the objects?

    • . You should make use of the Role Based Access Control (RBAC) model.

    • You should make use of the Mandatory Access Control (MAC) model.

    • You should make use of the Rule Based Access Control (RBAC) model.

    • You should make use of the Discretionary Access Control (DAC) model.

    Correct Answer
    A. You should make use of the Mandatory Access Control (MAC) model.
    Explanation
    The correct answer is that you should make use of the Mandatory Access Control (MAC) model. This model uses security labels connected to objects to determine access control. In MAC, access decisions are based on the sensitivity of the information being accessed and the security clearances of the subjects. This model is often used in environments where strict control over information flow is required, such as military or government organizations.

    Rate this question:

  • 33. 

    Why would reusing a ticket as a replay attack in Kerberos not be successful?

    • The tickets are digitally signed.

    • The tickets are used a token.

    • The tickets are encrypted.

    • The tickets are time stamped.

    Correct Answer
    A. The tickets are time stamped.
    Explanation
    Reusing a ticket as a replay attack in Kerberos would not be successful because the tickets are time stamped. This means that each ticket has a specific expiration time, and once that time has passed, the ticket becomes invalid. Therefore, even if an attacker were able to obtain a valid ticket, they would not be able to reuse it after its expiration time, making the replay attack ineffective.

    Rate this question:

  • 34. 

    What authentication model uses a smart card and a User ID/Password for accessing network resources?

    • You should identify the Biometric authentication model.

    • You should identify the Multifactor authentication model.

    • You should identify the Mutual authentication model.

    • You should identify the Tokens authentication model.

    Correct Answer
    A. You should identify the Multifactor authentication model.
    Explanation
    The correct answer is the Multifactor authentication model. This model uses multiple factors for authentication, such as a smart card and a User ID/Password, to provide a higher level of security. By requiring multiple factors, it reduces the risk of unauthorized access to network resources.

    Rate this question:

  • 35. 

    Which of the following ports does a DNS (Domain Name Service) server require?

    • 21

    • 23

    • 53

    • 55

    Correct Answer
    A. 53
    Explanation
    A DNS (Domain Name Service) server requires port 53. DNS servers are responsible for translating domain names into IP addresses, allowing users to access websites and other resources using human-readable names. Port 53 is specifically designated for DNS traffic, and it is used for both incoming and outgoing DNS queries and responses. By using this port, DNS servers can efficiently communicate with other DNS servers and clients to provide accurate and timely domain name resolution services.

    Rate this question:

  • 36. 

    Why are non-essential services appealing to attackers? (Choose TWO)

    • Non-essential services are often appealing to attackers since less bandwidth is used.

    • Non-essential services are often appealing to attackers since the surface area for the attack is reduced.

    • Non-essential services are often appealing to attackers since root level access is offered.

    • Non-essential services are often appealing to attackers since attacks are maintained that go unnoticed.

    • Non-essential services are often appealing to attackers since it's not typically configured correctly or secured.

    Correct Answer(s)
    A. Non-essential services are often appealing to attackers since attacks are maintained that go unnoticed.
    A. Non-essential services are often appealing to attackers since it's not typically configured correctly or secured.
    Explanation
    Non-essential services are often appealing to attackers because they are less likely to be closely monitored or protected, making it easier for attackers to maintain their attacks without being detected. Additionally, non-essential services are often not configured correctly or secured, providing vulnerabilities that attackers can exploit to gain unauthorized access or control.

    Rate this question:

  • 37. 

    Under MAC, a clearance is a

    • Privilege

    • Subject

    • Sensitivity

    • Object

    Correct Answer
    A. Privilege
    Explanation
    MAC is the acronym for Mandatory Access Control. It is important to note that mandatory controls are prohibitive (i.e., all that is not expressly permitted is forbidden), not permissive. Only within that context do discretionary controls operate, prohibiting still more access with the same exclusionary principle. In this type of control system decisions are based on privilege (clearance) of subject (user) and sensitivity (classification) of object (file). It requires labeling.

    In MAC, subjects (such as users) are each assigned a clearance (such as "secret" or "top secret"). Objects (containers for information, such as files) are assigned a sensitivity (classification, similar to clearance). When determining whether or not to grant a subject access to an object, the requesting subject's clearance is compared with the sensitivity of the object, and if the clearance is at or higher than the object's sensitivity level, access is granted. Therefore, a clearance functions as a privilege.

    Rate this question:

  • 38. 

    What is a protocol used for carrying authentication, authorization, and configuration information between a Network Access Server and a shared Authentication Server?

    • RADIUS

    • PPTP

    • L2TP

    • IPSec

    • None of the Above

    Correct Answer
    A. RADIUS
    Explanation
    RADIUS is a protocol for carrying authentication, authorization, and configuration information between a Network Access Server, which desires to authenticate its links and a shared Authentication Server. RADIUS uses a centralized database for simplified management. RADIUS is a standard published in RFC2138 as mentioned above.

    The other protocols listed are network communication protocols, not authentication protocols responsible for carrying traffic between a NAS and an Authentication Server.

    Rate this question:

  • 39. 

    The Certkiller .com network contains of various departments that makes use of an access control model. The finance department only requires access to the personal data of staff and the marketing department only needs access to the production data. Which access control model is MOST suitable?

    • The Discretionary Access Control (DAC) access control model would be most suitable.

    • The Rule Based Access Control (RBAC) access control model would be most suitable.

    • The Role Based Access Control (RBAC) access control model would be most suitable.

    • The Mandatory Access Control (MAC) access control model would be most suitable.

    Correct Answer
    A. The Role Based Access Control (RBAC) access control model would be most suitable.
    Explanation
    The Role Based Access Control (RBAC) access control model would be most suitable in this scenario. RBAC allows access to be based on the roles or responsibilities of users within an organization. In this case, the finance department only needs access to staff data, and the marketing department only needs access to production data. RBAC can easily assign specific roles to each department, ensuring that they only have access to the data that is relevant to their responsibilities. This model provides a more organized and efficient way to manage access control within the Certkiller.com network.

    Rate this question:

  • 40. 

    Which access controls are based on security labels assigned to every data item and every user?

    • You should identify Mandatory Access Control (MAC).

    • You should identify Role Based Access Control (RBAC).

    • You should identify Discretionary Access Control (DAC).

    • You should identify List Based Access Control (LBAC).

    Correct Answer
    A. You should identify Mandatory Access Control (MAC).
    Explanation
    Mandatory Access Control (MAC) is an access control mechanism that uses security labels assigned to both data items and users to determine access permissions. MAC enforces access policies based on the security levels assigned to data and the security clearances of users. This ensures that only authorized users with appropriate clearances can access data with matching security labels. Role Based Access Control (RBAC) is a different access control mechanism that is based on assigning roles to users and granting permissions based on those roles. Discretionary Access Control (DAC) is another access control mechanism that allows data owners to determine access permissions. List Based Access Control (LBAC) is not a commonly used access control mechanism.

    Rate this question:

  • 41. 

    When an attacker captures part of a communication and later sends the communication segment to the server whilst pretending to be the user it is known as a:

    • It is known as the TCP/IP hijacking attack.

    • It is known as the Man in the middle attack.

    • It is known as the Replay attack.

    • It is known as the Back door attack

    Correct Answer
    A. It is known as the Replay attack.
    Explanation
    In a replay attack, an attacker captures a communication segment and later resends it to the server, pretending to be the original user. This allows the attacker to gain unauthorized access or perform malicious actions. TCP/IP hijacking attack refers to the manipulation of TCP/IP packets to gain unauthorized access. Man in the middle attack involves intercepting and altering communication between two parties. Back door attack refers to unauthorized access through a hidden entry point. Therefore, the correct term for this scenario is a replay attack.

    Rate this question:

  • 42. 

    Which authentication will provide a username, a password and undergo a thumb print scan to access a workstation?

    • The Biometric authentication best illustrates this scenario.

    • The Kerberos authentication best illustrates this scenario.

    • The Mutual authentication best illustrates this scenario.

    • The Multifactor authentication best illustrates this scenario.

    Correct Answer
    A. The Multifactor authentication best illustrates this scenario.
    Explanation
    Multifactor authentication is the correct answer because it requires multiple forms of identification to access a workstation. In this scenario, the user must provide a username, a password, and undergo a thumb print scan, which demonstrates the use of multiple factors for authentication. Biometric authentication only involves the thumb print scan and does not require a username or password. Kerberos authentication is a network authentication protocol and does not involve a thumb print scan. Mutual authentication involves both the client and the server verifying each other's identities, but does not require a thumb print scan. Therefore, multifactor authentication is the most appropriate choice in this scenario.

    Rate this question:

  • 43. 

    How many ports in TCP/IP (Transmission Control Protocol/Internet Protocol) are vulnerable to being scanned, exploited, or attached?

    • 1,024

    • 32

    • 16,777,216

    • 65,535

    Correct Answer
    A. 65,535
    Explanation
    The correct answer is 65,535. TCP/IP has a range of 65,535 ports, and each port is a unique identifier for different services or protocols. Some ports are well-known and commonly used, while others are less known and may be vulnerable to scanning, exploitation, or attack. Therefore, all 65,535 ports are potentially vulnerable to being scanned, exploited, or attacked.

    Rate this question:

  • 44. 

    Which of the following are used to make access decisions in a MAC (Mandatory Access Control) environment?

    • Sensitivity labels

    • Group membership

    • Ownership

    • Access control lists

    Correct Answer
    A. Sensitivity labels
    Explanation
    Mandatory Access Control is a strict hierarchical model usually associated with governments. All objects are given security labels known as sensitivity labels and are classified accordingly. Then all users are given specific security clearances as to what they are allowed to access.

    Rate this question:

  • 45. 

    Which of the following password management systems is designed to provide availability for a large number of users?

    • Self service password resets

    • Locally saved passwords

    • Multiple access methods

    • Synchronized passwords

    Correct Answer
    A. Self service password resets
    Explanation
    A self service password reset is a system where if an individual user forgets their password, they can reset it on their own (usually by answering a secret question on a web prompt, then receiving a new temporary password on a pre-specified email address) without having to call the help desk. For a system with many users, this will significantly reduce the help desk call volume.

    Rate this question:

  • 46. 

    Identify the authentication system where a unique username and password is used to access multiple systems within a company?

    • Challenge Handshake Authentication Protocol (CHAP) is used to access multiple systems within a company.

    • Single Sign-on is used to access multiple systems within a company.

    • Kerberos is used to access multiple systems within a company.

    • Mandatory Access Control (MAC) is used to access multiple systems within a company.

    Correct Answer
    A. Single Sign-on is used to access multiple systems within a company.
    Explanation
    Single Sign-on (SSO) is an authentication system where a unique username and password is used to access multiple systems within a company. With SSO, users only need to log in once and their credentials are then shared across multiple applications or systems, eliminating the need for separate logins for each system. This improves user experience and productivity by reducing the number of passwords to remember and simplifying the login process.

    Rate this question:

  • 47. 

    With RBAC, roles are:

    • Based on labels

    • Based on flows

    • Hierarchical

    • All of the Above

    • All equal

    Correct Answer
    A. Hierarchical
    Explanation
    With RBAC (role-based access control), security is managed at a level that corresponds closely to the organization's structure. Each user is assigned one or more roles, and each role is assigned one or more privileges that are permitted to users in that role. Roles can be hierarchical.

    Roles are not all equal. The point of RBAC is that different rules can be assigned different security privileges. Labels (such as secret, top secret, etc.) are more usually associated with MAC (Mandatory Access Control). RBAC roles are not typically determined by information flows.

    Rate this question:

  • 48. 

    When using network monitoring systems to monitor workstations, which of the following elements should be reviewed because their information could indicate a possible attack ?

    • Audit log and system log

    • Hard disk space

    • Network counters and access denied errors

    • Network counters

    Correct Answer
    A. Network counters and access denied errors
    Explanation
    Network counters and access denied errors should be reviewed because they can provide valuable information about a possible attack. Network counters can help identify abnormal network traffic patterns or spikes in data transfer, which could indicate a malicious activity. Access denied errors can indicate unauthorized attempts to access sensitive information or resources, suggesting a potential intrusion or attack. By monitoring these elements, network administrators can quickly detect and respond to potential security threats.

    Rate this question:

  • 49. 

    Which of the following best describes an access control mechanism that allows the data owner to create and administer access control?

    • DACs (Discretionary Access Control)

    • LBACs (List Based Access Control)

    • RBACs (Role Based Access Control)

    • MACs (Mandatory Access Control)

    Correct Answer
    A. DACs (Discretionary Access Control)
    Explanation
    The DAC model allows the owner of a resource to establish privileges to the information they own. The DAC model would allow a user to share a file or use a file that someone else has shared. The DAC model establishes an ACL that identifies the users who have authorization to that information. This allows the owner to grant or revoke access to individuals or groups of individuals based on the situation. This model is dynamic in nature and allows information to be shared easily between users.

    Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 12

    Rate this question:

Quiz Review Timeline (Updated): May 28, 2024 +

Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.

  • Current Version
  • May 28, 2024
    Quiz Edited by
    ProProfs Editorial Team
  • Oct 11, 2014
    Quiz Created by
    Kwsherri03

Related Topics

Recent Quizzes

CompTIA Security+ SY0-501 Practice Test 02 CompTIA Security+ SY0-501 Practice Test 02
CompTIA Security+ SY0-501 Practice Test 01 CompTIA Security+ SY0-501 Practice Test 01
CompTIA Security+ Exam MCQ! CompTIA Security+ Exam MCQ!
Back to Top Back to top
Advertisement
×

Wait!
Here's an interesting quiz for you.

We have other quizzes matching your interest.