Security + 6 (501-600)
(19).webp "Security + 6 (501-600) - Quiz")
Questions and Answers
- 1.
Which of the following assets is MOST likely considered for DLP?
- A.
Application server content
- B.
USB mass storage devices
- C.
Reverse proxy
- D.
Print server
Correct Answer
B. USB mass storage devicesExplanation
DLP (Data Loss Prevention) is a security measure that aims to prevent the unauthorized disclosure of sensitive information. USB mass storage devices are most likely considered for DLP because they pose a significant risk of data loss. These devices can be easily connected to a computer and used to transfer or copy sensitive data without proper authorization or monitoring. Therefore, organizations often implement DLP measures to control and monitor the use of USB mass storage devices to prevent data breaches and protect sensitive information.Rate this question:
-
- 2.
In order to securely communicate using PGP, the sender of an email must do which of the following when sending an email to a recipient for the first time?
- A.
Import the recipient’s public key
- B.
Import the recipient’s private key
- C.
Export the sender’s private key
- D.
Export the sender’s public key
Correct Answer
A. Import the recipient’s public keyExplanation
When sending an email to a recipient for the first time using PGP, the sender must import the recipient's public key. This is because PGP uses a public key infrastructure, where each user has a pair of keys - a public key and a private key. The sender needs to import the recipient's public key in order to encrypt the email with it. The recipient will then use their private key to decrypt the email. Importing the recipient's private key or exporting the sender's private or public key is not necessary for securely communicating using PGP.Rate this question:
-
- 3.
A hacker has discovered a simple way to disrupt business for the day in a small company which relies on staff working remotely. In a matter of minutes the hacker was able to deny remotely working staff access to company systems with a script. Which of the following security controls is the hacker exploiting?
- A.
DoS
- B.
Account lockout
- C.
Password recovery
- D.
Password complexity
Correct Answer
B. Account lockoutExplanation
The hacker is exploiting the account lockout security control. By using a script, the hacker is able to deny remotely working staff access to company systems by repeatedly attempting to log in with incorrect credentials. After a certain number of failed login attempts, the account lockout feature is triggered, preventing further access to the system. This disrupts business for the day as staff members are unable to access the necessary systems to work remotely.Rate this question:
-
- 4.
A security specialist has been asked to evaluate a corporate network by performing a vulnerability assessment. Which of the following will MOST likely be performed?
- A.
Identify vulnerabilities, check applicability of vulnerabilities by passively testing security controls.
- B.
Verify vulnerabilities exist, bypass security controls and exploit the vulnerabilities.
- C.
Exploit security controls to determine vulnerabilities and mis-configurations.
- D.
Bypass security controls and identify applicability of vulnerabilities by passively testing security controls.
Correct Answer
A. Identify vulnerabilities, check applicability of vulnerabilities by passively testing security controls.Explanation
The correct answer is "Identify vulnerabilities, check applicability of vulnerabilities by passively testing security controls." In a vulnerability assessment, the security specialist's main goal is to identify vulnerabilities within the corporate network. This is typically done by conducting passive testing of security controls to check the applicability of the vulnerabilities. The specialist does not actively exploit the vulnerabilities or bypass security controls in this assessment.Rate this question:
-
- 5.
A security technician is attempting to access a wireless network protected with WEP. The technician does not know any information about the network. Which of the following should the technician do to gather information about the configuration of the wireless network?
- A.
Spoof the MAC address of an observed wireless network client
- B.
Ping the access point to discover the SSID of the network
- C.
Perform a dictionary attack on the access point to enumerate the WEP key
- D.
Capture client to access point disassociation packets to replay on the local PC’s loopback
Correct Answer
A. Spoof the MAC address of an observed wireless network clientExplanation
The technician should spoof the MAC address of an observed wireless network client. By spoofing the MAC address, the technician can trick the access point into thinking that the technician's device is a trusted client. This will allow the technician to gather information about the configuration of the wireless network, such as the SSID and potentially other security settings.Rate this question:
-
- 6.
After an assessment, auditors recommended that an application hosting company should contract with additional data providers for redundant high speed Internet connections. Which of the following is MOST likely the reason for this recommendation? (Select TWO).
- A.
To allow load balancing for cloud support
- B.
To allow for business continuity if one provider goes out of business
- C.
To eliminate a single point of failure
- D.
To allow for a hot site in case of disaster
- E.
To improve intranet communication speeds
Correct Answer(s)
B. To allow for business continuity if one provider goes out of business
C. To eliminate a single point of failureExplanation
The auditors recommended contracting with additional data providers for redundant high-speed Internet connections to allow for business continuity if one provider goes out of business. This ensures that if one provider fails or ceases operations, the company will still have alternative options to maintain their Internet connectivity and continue their operations without interruption. Additionally, this recommendation aims to eliminate a single point of failure, as relying on a single provider for Internet connectivity poses a risk. By having multiple providers, the company can distribute the load and mitigate the risk of a complete loss of connectivity.Rate this question:
-
- 7.
A router has a single Ethernet connection to a switch. In the router configuration, the Ethernet interface has three sub-interfaces, each configured with ACLs applied to them and 802.1q trunks. Which of the following is MOST likely the reason for the sub-interfaces?
- A.
The network uses the subnet of 255.255.255.128.
- B.
The switch has several VLANs configured on it.
- C.
The sub-interfaces are configured for VoIP traffic.
- D.
The sub-interfaces each implement quality of service.
Correct Answer
B. The switch has several VLANs configured on it.Explanation
The reason for the sub-interfaces is most likely because the switch has several VLANs configured on it. Sub-interfaces are commonly used in router configurations to allow for the routing of traffic between different VLANs. Each sub-interface can be associated with a specific VLAN, allowing the router to route traffic between VLANs using the Ethernet connection to the switch. This setup provides flexibility and security by segregating network traffic into different VLANs.Rate this question:
-
- 8.
Which of the following should be enabled in a laptop’s BIOS prior to full disk encryption?
- A.
USB
- B.
HSM
- C.
RAID
- D.
TPM
Correct Answer
D. TPMExplanation
TPM stands for Trusted Platform Module, which is a security chip that provides hardware-based encryption and secure storage capabilities. Enabling TPM in a laptop's BIOS prior to full disk encryption ensures that the encryption keys are securely stored and protected. It helps to enhance the overall security of the system by preventing unauthorized access to the encrypted data. Therefore, TPM should be enabled to ensure the effectiveness and integrity of the full disk encryption process.Rate this question:
-
- 9.
Company employees are required to have workstation client certificates to access a bank website. These certificates were backed up as a precautionary step before the new computer upgrade. After the upgrade and restoration, users state they can access the bank’s website, but not login. Which is the following is MOST likely the issue?
- A.
The IP addresses of the clients have change
- B.
The client certificate passwords have expired on the server
- C.
The certificates have not been installed on the workstations
- D.
The certificates have been installed on the CA
Correct Answer
C. The certificates have not been installed on the workstationsExplanation
The most likely issue is that the certificates have not been installed on the workstations. Although the users can access the bank's website, they are unable to log in, indicating that there is an issue with the authentication process. Since the employees are required to have workstation client certificates to access the website, the absence of these certificates on the workstations could be causing the login problem.Rate this question:
-
- 10.
Digital Signatures provide which of the following?
- A.
Confidentiality
- B.
Authorization
- C.
Integrity
- D.
Authentication
- E.
Availability
Correct Answer
C. IntegrityExplanation
Digital signatures provide integrity. A digital signature is a cryptographic technique used to ensure that the data or message has not been altered during transmission or storage. It provides a way to verify the integrity of the data by using a mathematical algorithm to generate a unique signature for the data. This signature can then be verified by the recipient to ensure that the data has not been tampered with. Therefore, digital signatures are used to guarantee the integrity of the data and ensure that it has not been modified.Rate this question:
-
- 11.
A user ID and password together provide which of the following?
- A.
Authorization
- B.
Auditing
- C.
Authentication
- D.
Identification
Correct Answer
C. AuthenticationExplanation
A user ID and password together provide authentication. Authentication is the process of verifying the identity of a user or entity. By entering a user ID and password, a user is proving that they are who they claim to be. This helps to ensure that only authorized individuals are granted access to a system or application.Rate this question:
-
- 12.
RADIUS provides which of the following?
- A.
Authentication, Authorization, Availability
- B.
Authentication, Authorization, Auditing
- C.
Authentication, Accounting, Auditing
- D.
Authentication, Authorization, Accounting
Correct Answer
D. Authentication, Authorization, AccountingExplanation
RADIUS provides authentication, authorization, and accounting services. Authentication refers to the process of verifying the identity of a user or device. Authorization involves granting or denying access to specific resources or services based on the authenticated identity. Accounting refers to the tracking and recording of user activity, such as the amount of time spent online or the resources accessed. Together, these three functions help ensure secure and controlled access to network resources.Rate this question:
-
- 13.
A recent intrusion has resulted in the need to perform incident response procedures. The incident response team has identified audit logs throughout the network and organizational systems which hold details of the security breach. Prior to this incident, a security consultant informed the company that they needed to implement an NTP server on the network. Which of the following is a problem that the incident response team will likely encounter during their assessment?
- A.
Chain of custody
- B.
Tracking man hours
- C.
Record time offset
- D.
Capture video traffic
Correct Answer
C. Record time offsetExplanation
The incident response team will likely encounter a problem with the record time offset during their assessment. Since the security consultant had recommended implementing an NTP server, it suggests that there may be inconsistencies in the timestamps recorded in the audit logs. This could make it difficult for the team to accurately determine the sequence of events and establish a timeline of the security breach.Rate this question:
-
- 14.
In order for network monitoring to work properly, you need a PC and a network card running in what mode?
- A.
Launch
- B.
Exposed
- C.
Promiscuous
- D.
Sweep
Correct Answer
C. PromiscuousExplanation
In order for network monitoring to work properly, the network card needs to be running in promiscuous mode. This mode allows the network card to capture and analyze all network traffic, including packets that are not intended for the specific device. By capturing all traffic, network monitoring tools can effectively monitor and analyze network activity, detect anomalies, and identify potential security threats.Rate this question:
-
- 15.
Which of the following utilities can be used in Linux to view a list of users’ failed authentication attempts?
- A.
Badlog
- B.
Faillog
- C.
Wronglog
- D.
Killlog
Correct Answer
B. FaillogExplanation
Faillog is a utility in Linux that can be used to view a list of users' failed authentication attempts. It keeps track of failed login attempts and displays information such as the number of failed attempts and the last failed login time for each user. This information can be helpful for system administrators in identifying potential security threats or detecting unauthorized access attempts.Rate this question:
-
- 16.
A periodic update that corrects problems in one version of a product is called a
- A.
Hotfix
- B.
Overhaul
- C.
Service pack
- D.
Security update
Correct Answer
C. Service packExplanation
A periodic update that corrects problems in one version of a product is called a service pack. Service packs are released by software companies to address bugs, improve performance, and add new features to their products. They are typically larger updates that include multiple fixes and enhancements, and they are designed to provide a comprehensive solution to known issues in the software. Service packs are often released after a significant amount of testing and feedback from users, and they help to ensure that the product remains up-to-date and reliable for its users.Rate this question:
-
- 17.
A user has received an email from an external source which asks for details on the company’s new product line set for release in one month. The user has a detailed spec sheet but it is marked “Internal Proprietary Information”. Which of the following should the user do NEXT?
- A.
Contact their manager and request guidance on how to best move forward
- B.
Contact the help desk and/or incident response team to determine next steps
- C.
Provide the requestor with the email information since it will be released soon anyway
- D.
Reply back to the requestor to gain their contact information and call them
Correct Answer
B. Contact the help desk and/or incident response team to determine next stepsExplanation
The user should contact the help desk and/or incident response team to determine the next steps. This is because the email is from an external source and is requesting internal proprietary information. The help desk and/or incident response team will have the expertise to handle such situations and can provide guidance on how to proceed while ensuring the security and confidentiality of the company's information.Rate this question:
-
- 18.
Which of the following techniques enables a highly secured organization to assess security weaknesses in real time?
- A.
Access control lists
- B.
Continuous monitoring
- C.
Video surveillance
- D.
Baseline reporting
Correct Answer
B. Continuous monitoringExplanation
Continuous monitoring is a technique that enables a highly secured organization to assess security weaknesses in real time. This involves the constant monitoring of systems, networks, and applications to identify any potential vulnerabilities or threats. By continuously monitoring, organizations can promptly detect and respond to any security issues, minimizing the risk of data breaches or unauthorized access. This proactive approach allows for timely remediation and helps ensure the ongoing security and protection of the organization's assets.Rate this question:
-
- 19.
Which of the following techniques can be used to prevent the disclosure of system information resulting from arbitrary inputs when implemented properly?
- A.
Fuzzing
- B.
Patch management
- C.
Error handling
- D.
Strong passwords
Correct Answer
C. Error handlingExplanation
Error handling is a technique that can be used to prevent the disclosure of system information resulting from arbitrary inputs when implemented properly. Proper error handling can ensure that sensitive system information is not exposed to potential attackers. By handling errors in a secure and controlled manner, the system can avoid revealing any internal information that could be used to exploit vulnerabilities or gain unauthorized access.Rate this question:
-
- 20.
Encryption of data at rest is important for sensitive information because of which of the following?
- A.
Facilitates tier 2 support, by preventing users from changing the OS
- B.
Renders the recovery of data harder in the event of user password loss
- C.
Allows the remote removal of data following eDiscovery requests
- D.
Prevents data from being accessed following theft of physical equipment
Correct Answer
D. Prevents data from being accessed following theft of physical equipmentExplanation
Encryption of data at rest is important for sensitive information because it prevents unauthorized access to the data in the event of physical theft of equipment. Encryption ensures that even if the physical device is stolen, the data remains secure and cannot be accessed without the encryption key. This helps to protect sensitive information and maintain its confidentiality, even in the face of physical security breaches.Rate this question:
-
- 21.
Which of the following is synonymous with a server’s certificate?
- A.
Public key
- B.
CRL
- C.
Private key
- D.
Recovery agent
Correct Answer
A. Public keyExplanation
A server's certificate is synonymous with a public key because a certificate includes the server's public key along with additional information such as the server's identity and the digital signature of a trusted third party. The public key is used for encryption and authentication purposes, allowing secure communication between the server and clients. A CRL (Certificate Revocation List) is a list of revoked certificates, not synonymous with a server's certificate. A private key is used by the server to decrypt encrypted data, and a recovery agent is a person or entity authorized to access encrypted data in case of emergencies.Rate this question:
-
- 22.
A network administrator noticed various chain messages have been received by the company.Which of the following security controls would need to be implemented to mitigate this issue?
- A.
Anti-spam
- B.
Antivirus
- C.
Host-based firewalls
- D.
Anti-spyware
Correct Answer
A. Anti-spamExplanation
To mitigate the issue of receiving chain messages, the network administrator would need to implement the security control of anti-spam. Anti-spam software is designed to identify and block unsolicited and unwanted emails, including chain messages. By implementing anti-spam measures, the company can reduce the number of chain messages received, improving email security and reducing the risk of malware or phishing attacks that may be associated with such messages.Rate this question:
-
- 23.
Which of the following types of application attacks would be used to specifically gain unauthorized information from databases that did not have any input validation implemented?
- A.
SQL injection
- B.
Session hijacking and XML injection
- C.
Cookies and attachments
- D.
Buffer overflow and XSS
Correct Answer
A. SQL injectionExplanation
SQL injection is a type of application attack that allows an attacker to manipulate the database queries by injecting malicious SQL code. In this scenario, since the databases do not have any input validation implemented, it becomes vulnerable to SQL injection. By exploiting this vulnerability, an attacker can gain unauthorized access to the database and retrieve sensitive information.Rate this question:
-
- 24.
Which of the following should be deployed to prevent the transmission of malicious traffic between virtual machines hosted on a singular physical device on a network?
- A.
HIPS on each virtual machine
- B.
NIPS on the network
- C.
NIDS on the network
- D.
HIDS on each virtual machine
Correct Answer
A. HIPS on each virtual machineExplanation
To prevent the transmission of malicious traffic between virtual machines hosted on a singular physical device on a network, Host-based Intrusion Prevention Systems (HIPS) should be deployed on each virtual machine. HIPS monitors and analyzes the activities and behavior of individual hosts to detect and prevent any unauthorized or malicious activities. By having HIPS installed on each virtual machine, it provides an additional layer of security and ensures that any potential threats or attacks are detected and mitigated at the host level, preventing the transmission of malicious traffic between the virtual machines.Rate this question:
-
- 25.
A security administrator wants to get a real time look at what attackers are doing in the wild, hoping to lower the risk of zero-day attacks. Which of the following should be used to accomplish this goal?
- A.
Penetration testing
- B.
Honeynets
- C.
Vulnerability scanning
- D.
Baseline reporting
Correct Answer
B. HoneynetsExplanation
Honeynets should be used to accomplish the goal of getting a real-time look at what attackers are doing in the wild and lowering the risk of zero-day attacks. Honeynets are decoy systems or networks that are designed to attract attackers and gather information about their techniques and tactics. By monitoring the activity on a honeynet, security administrators can gain valuable insights into the behavior of attackers and identify new attack methods, allowing them to proactively defend against zero-day attacks. Penetration testing, vulnerability scanning, and baseline reporting are important security measures but do not provide the same level of real-time visibility into attacker activity as honeynets.Rate this question:
-
- 26.
Which of the following protocols is the security administrator observing in this packet capture? 12:33:43, SRC 192.168.4.3:3389, DST 10.67.33.20:8080, SYN/ACK
- A.
HTTPS
- B.
RDP
- C.
HTTP
- D.
SFTP
Correct Answer
B. RDPExplanation
The security administrator is observing the RDP (Remote Desktop Protocol) in this packet capture. This is indicated by the source IP address 192.168.4.3 and source port 3389, which are commonly used for RDP connections. The destination IP address 10.67.33.20 and destination port 8080 suggest that the RDP traffic is being sent to a specific device and port. The SYN/ACK flag indicates that a TCP handshake is occurring, which is typical for establishing a remote desktop connection using RDP.Rate this question:
-
- 27.
Which of the following is true about asymmetric encryption?
- A.
A message encrypted with the private key can be decrypted by the same key
- B.
A message encrypted with the public key can be decrypted with a shared key.
- C.
A message encrypted with a shared key, can be decrypted by the same key.
- D.
A message encrypted with the public key can be decrypted with the private key.
Correct Answer
D. A message encrypted with the public key can be decrypted with the private key.Explanation
Asymmetric encryption, also known as public-key encryption, uses a pair of keys - a public key and a private key. The public key is used to encrypt the message, while the private key is used to decrypt it. This means that a message encrypted with the public key can only be decrypted with the corresponding private key. Therefore, the statement "A message encrypted with the public key can be decrypted with the private key" is true.Rate this question:
-
- 28.
Which of the following is true about an email that was signed by User A and sent to User B?
- A.
User A signed with User B’s private key and User B verified with their own public key.
- B.
User A signed with their own private key and User B verified with User A’s public key.
- C.
User A signed with User B’s public key and User B verified with their own private key.
- D.
User A signed with their own public key and User B verified with User A’s private key.
Correct Answer
B. User A signed with their own private key and User B verified with User A’s public key.Explanation
User A signing the email with their own private key and User B verifying it with User A's public key means that User A is the sender of the email and User B is the recipient. This is the correct way to sign and verify an email using asymmetric encryption. The private key is used for signing, which ensures the authenticity and integrity of the email, while the public key is used for verification, ensuring that the email was indeed sent by User A.Rate this question:
-
- 29.
The Chief Information Officer (CIO) is concerned with moving an application to a SaaS cloud provider. Which of the following can be implemented to provide for data confidentiality assurance during and after the migration to the cloud?
- A.
HPM technology
- B.
Full disk encryption
- C.
DLP policy
- D.
TPM technology
Correct Answer
C. DLP policyExplanation
A Data Loss Prevention (DLP) policy can be implemented to provide data confidentiality assurance during and after the migration to the cloud. DLP policies help in identifying and preventing the unauthorized transmission of sensitive data. This ensures that data remains confidential and protected from unauthorized access or disclosure, both during the migration process and after the application is moved to the SaaS cloud provider. It helps in enforcing security controls and preventing data leakage, thereby ensuring data confidentiality.Rate this question:
-
- 30.
Which of the following protocols encapsulates an IP packet with an additional IP header?
- A.
SFTP
- B.
IPSec
- C.
HTTPS
- D.
SSL
Correct Answer
B. IPSecExplanation
IPSec is the correct answer because it is a protocol used for securing IP communications by encapsulating IP packets with an additional IP header. This additional header provides authentication, integrity, and confidentiality for the transmitted data. By encapsulating the IP packet, IPSec ensures that the data is protected from unauthorized access or tampering during transmission.Rate this question:
-
- 31.
A program has been discovered that infects a critical Windows system executable and stays dormant in memory. When a Windows mobile phone is connected to the host, the program infects the phone’s boot loader and continues to target additional Windows PCs or phones. Which of the following malware categories BEST describes this program?
- A.
Zero-day
- B.
Trojan
- C.
Virus
- D.
Rootkit
Correct Answer
C. VirusExplanation
This program is best described as a virus. A virus is a type of malware that infects other files or programs and spreads by attaching itself to them. In this case, the program infects a critical Windows system executable and then spreads to the phone's boot loader when connected to the host. The virus then continues to target additional Windows PCs or phones, indicating its ability to replicate and spread.Rate this question:
-
- 32.
A user has unknowingly gone to a fraudulent site. The security analyst notices the following system change on the user’s host: Old `hosts’ file:127.0.0.1 localhost New `hosts’ file:127.0.0.1 localhost 5.5.5.5 www.comptia.com Which of the following attacks has taken place?
- A.
Spear phishing
- B.
Pharming
- C.
Phishing
- D.
Vishing
Correct Answer
B. PharmingExplanation
The correct answer is Pharming. Pharming is a type of cyber attack where a user is redirected to a fraudulent website without their knowledge or consent. In this scenario, the user has unknowingly visited a fraudulent site, and the change in the host's file indicates that the IP address for the legitimate website "www.comptia.com" has been changed to the IP address "5.5.5.5", which is associated with the fraudulent site. This manipulation of the host's file is a common technique used in pharming attacks to redirect users to malicious websites.Rate this question:
-
- 33.
An investigator recently discovered that an attacker placed a remotely accessible CCTV camera in a public area overlooking several Automatic Teller Machines (ATMs). It is also believed that user accounts belonging to ATM operators may have been compromised. Which of the following attacks has MOST likely taken place?
- A.
Shoulder surfing
- B.
Dumpster diving
- C.
Whaling attack
- D.
Vishing attack
Correct Answer
A. Shoulder surfingExplanation
The most likely attack that has taken place in this scenario is shoulder surfing. Shoulder surfing refers to the act of spying on someone's activities, such as typing in their PIN or accessing their accounts, by looking over their shoulder. In this case, the attacker has placed a CCTV camera in a public area, which suggests that they are trying to capture the ATM operators' activities and potentially gain access to their user accounts. This aligns with the concept of shoulder surfing, making it the most likely attack in this situation.Rate this question:
-
- 34.
A user commuting to work via public transport received an offensive image on their smart phone from another commuter. Which of the following attacks MOST likely took place?
- A.
War chalking
- B.
Bluejacking
- C.
War driving
- D.
Bluesnarfing
Correct Answer
B. BluejackingExplanation
Bluejacking is the most likely attack that took place in this scenario. Bluejacking is a form of cyber attack where an attacker sends unsolicited messages or offensive content to other Bluetooth-enabled devices within close proximity. In this case, the user received an offensive image on their smartphone, which suggests that someone nearby used Bluetooth to send the offensive content. War chalking involves marking public spaces with symbols to indicate the presence of Wi-Fi networks, war driving involves searching for Wi-Fi networks while driving, and bluesnarfing involves unauthorized access to a Bluetooth-enabled device to steal information. None of these attacks align with the scenario described.Rate this question:
-
- 35.
Which one do you like?
- A.
Option 1
- B.
Option 2
- C.
Option 3
- D.
Option 4
Correct Answer
A. Option 1 -
Back to top