CompTIA Security+ Practice Exam (1)

Reviewed by Editorial Team
The ProProfs editorial team is comprised of experienced subject matter experts. They've collectively created over 10,000 quizzes and lessons, serving over 100 million users. Our team includes in-house content moderators and subject matter experts, as well as a global network of rigorously trained contributors. All adhere to our comprehensive editorial guidelines, ensuring the delivery of high-quality content.
Learn about Our Editorial Process
| By Mastermind1100
M
Mastermind1100
Community Contributor
Quizzes Created: 4 | Total Attempts: 21,993
| Attempts: 8,869
SettingsSettings
Please wait...
  • 1/89 Questions

    With _______________, access decisions are based on the roles that individual users have as part of an organization.

    • Server based access control
    • Rule based access control
    • Token based access control
    • Role based access control
    • All of the Above
Please wait...
About This Quiz

Comptia Security+ Practice Exam- 1
Full length Comptia Security+ Practice Exam. Take this exam like the real exam to see if you are completely prepared for the real exam. Time yourself to 90 minutes to get a feel of the pressures of the real exam. The practice test is designed to reflect the final exam.

CompTIA Security+ Practice Exam (1) - Quiz

Quiz Preview

  • 2. 

    Which if the following technologies would you use if you need to implement a system that simulates a network of vulnerable devices, so that this network can be targeted by attackers ?

    • A circuit-level firewall

    • A honeypot

    • A IDS

    • A system integrity verifier

    Correct Answer
    A. A honeypot
    Explanation
    A honeypot is the correct answer because it is a technology used to simulate a network of vulnerable devices in order to attract and deceive attackers. It is designed to appear as a legitimate target to attackers, allowing security professionals to monitor their activities and gather information about their techniques. By deploying a honeypot, organizations can study attack patterns, identify vulnerabilities, and develop effective countermeasures to protect their actual network from similar attacks.

    Rate this question:

  • 3. 

    A smartcard represents:

    • Something you are

    • Something you know

    • Something you have

    • All of the Above

    • None of the Above

    Correct Answer
    A. Something you have
    Explanation
    Authentication is accomplished through something you know, something you have and/or something you are. One form of authentication requires possession of something ("something you have") such as a key, a smart card, a disk, or some other device. Whatever form it takes, the authenticating item should be difficult to duplicate and may require synchronization with systems other than the one to which you are requesting access. Highly secure environments may require you to satisfy multiple authentication criteria to guarantee authenticity.

    Something you know, would be a piece of data known only to you, such as a password. Something you are, would be a physical characteristic of you, like your fingerprint.

    Rate this question:

  • 4. 

    Identify the process where users can access numerous resources without needing multiple credentials?

    • The authentication process is known as need to know.

    • The authentication process is known as decentralized management.

    • The authentication process is known as Discretionary Access Control (DAC).

    • The authentication process is known as single sign-on.

    Correct Answer
    A. The authentication process is known as single sign-on.
    Explanation
    Single sign-on (SSO) is a process where users can access numerous resources without needing multiple credentials. With SSO, users only need to authenticate once, usually through a central identity provider, and then they can access multiple applications and systems without having to enter their credentials again. This improves user experience, reduces the risk of password fatigue or forgetting passwords, and enhances security by centralizing authentication and authorization processes.

    Rate this question:

  • 5. 

    Which of the following is the most costly method of an authentication?

    • Passwords

    • Tokens

    • Biometrics

    • Shared secrets

    Correct Answer
    A. Biometrics
    Explanation
    Biometrics These technologies are becoming more reliable, and they will become widely used over the next few years. Many companies use smart cards as their primary method of access control. Implementations have been limited in many applications because of the high cost associated with these technologies. Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 265

    Rate this question:

  • 6. 

    A password represents:

    • Something you have

    • Something you know

    • Something you are

    • All of the Above

    • None of the Above

    Correct Answer
    A. Something you know
    Explanation
    Authentication is accomplished through something you know, something you have and/or something you are. The canonical example of something you know is a password or pass phrase. You might type or speak the value. A number of schemes are possible for obtaining what you know. It might be assigned to you, or you may have picked the value yourself. Constraints may exist regarding the form the value can take, or the alphabet from which you are allowed to construct the value might be limited to letters only. If you forget the value, you may not be able to authenticate yourself to the system.

    Something you have, would be a physical item you possess, such as a smartcard. Something you are, would be a personal characteristic of you, not a piece of information you know.

    Rate this question:

  • 7. 

    What authentication model uses a smart card and a User ID/Password for accessing network resources?

    • You should identify the Biometric authentication model.

    • You should identify the Multifactor authentication model.

    • You should identify the Mutual authentication model.

    • You should identify the Tokens authentication model.

    Correct Answer
    A. You should identify the Multifactor authentication model.
    Explanation
    The correct answer is the Multifactor authentication model because it involves the use of multiple factors for authentication, such as a smart card and a User ID/Password. This adds an extra layer of security by requiring the user to provide more than one form of identification to access network resources.

    Rate this question:

  • 8. 

    Determine the access control model where users are assigned access rights based on their function within the organization?

    • This is a feature of Discretionary Access Control (DAC).

    • This is a feature of Rule Based Access Control (RBAC).

    • This is a feature of Role Based Access Control (RBAC).

    • This is a feature of Mandatory Access Control (MAC).

    Correct Answer
    A. This is a feature of Role Based Access Control (RBAC).
    Explanation
    This question is asking about the access control model where users are assigned access rights based on their function within the organization. This is a feature of Role Based Access Control (RBAC). In RBAC, access rights are assigned to users based on their roles or job functions. This allows for easier management of access control as users can be assigned to roles and their access rights can be managed at the role level rather than individually for each user.

    Rate this question:

  • 9. 

    For which of the following can biometrics be used?

    • Authentication

    • Authorization

    • Certification

    • Accountability

    Correct Answer
    A. Authentication
    Explanation
    Biometrics devices use physical characteristics to identify the user.
    Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 18

    Rate this question:

  • 10. 

    Identify the authentication system where a unique username and password is used to access multiple systems within a company?

    • Challenge Handshake Authentication Protocol (CHAP) is used to access multiple systems within a company.

    • Single Sign-on is used to access multiple systems within a company.

    • Kerberos is used to access multiple systems within a company.

    • Mandatory Access Control (MAC) is used to access multiple systems within a company.

    Correct Answer
    A. Single Sign-on is used to access multiple systems within a company.
    Explanation
    Single Sign-on is an authentication system where a unique username and password are used to access multiple systems within a company. This means that users only need to enter their credentials once and they will be granted access to all authorized systems without the need to re-enter their credentials for each individual system. This simplifies the authentication process for users and improves overall security by reducing the need for multiple passwords and the potential for password reuse or weak passwords.

    Rate this question:

  • 11. 

    A centralized database of remote users for a multi-site network typically uses

    • RADIUS

    • PAP

    • MS-CHAP

    • CHAP

    Correct Answer
    A. RADIUS
    Explanation
    RADIUS (Remote Authentication Dial-In User Service) lowers administration costs and increases security by having a centralized database for authenticating remote users. PAP is the simplest of authentication protocols, which uses clear text.

    Rate this question:

  • 12. 

    An administrator wishes to enable network auditing policies. Which of the following should the security administrator log?

    • Both logon successes and logon failures

    • Only logon failures for non-existent users

    • Only logon success

    • Only logon failures

    Correct Answer
    A. Both logon successes and logon failures
    Explanation
    Enabling network auditing policies allows the administrator to monitor and track logon activities on the network. By logging both logon successes and logon failures, the administrator can have a comprehensive view of all logon attempts, whether they were successful or not. This information is crucial for detecting and investigating any unauthorized access attempts or suspicious activities on the network. Logging only logon failures for non-existent users or only logon successes or only logon failures would provide limited information and may not give a complete picture of the network's security status.

    Rate this question:

  • 13. 

    A company creates its own application that accesses the company databases and requires a unique login, based on the user’s domain account. The developer has an undocumented login for testing that does not need to be authenticated against the domain. Which of the following is a security issue regarding this scenario?

    • The login should be the same as the domain account for authentication purposes

    • The application should not be deployed if it is not fully tested

    • It is not considered best practice to have a user remember multiple logins

    • It can be used as a backdoor into the company’s databases

    Correct Answer
    A. It can be used as a backdoor into the company’s databases
    Explanation
    The presence of an undocumented login that does not require authentication against the domain poses a security issue because it can be exploited as a backdoor into the company's databases. This means that unauthorized individuals could potentially gain access to sensitive information and compromise the company's data security. It is important to ensure that all logins and access points are properly authenticated and secured to prevent unauthorized access.

    Rate this question:

  • 14. 

    Which of the following best describes an access control mechanism in which access control decisions are based on the responsibilities that an individual user or process has in an organization?

    • RBAC (Role Based Access Control)

    • DAC (Discretionary Access Control)

    • MAC (Mandatory Access Control)

    • All of the Above

    • None of the above.

    Correct Answer
    A. RBAC (Role Based Access Control)
    Explanation
    The RBAC model allows a user to act in a certain predetermined manner based on the role the user holds in the organization. Users can be assigned certain roles system wide.

    Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 12

    Rate this question:

  • 15. 

    Why are clocks used in a Kerberos authentication system?

    • To ensure proper connections.

    • To ensure tickets expire correctly.

    • To generate the seed value for the encryptions keys.

    • To benchmark and set the optimal encryption algorithm.

    Correct Answer
    A. To ensure tickets expire correctly.
    Explanation
    The actual verification of a client's identity is done by validating an authenticator. The authenticator contains the client's identity and a timestamp. To insure that the authenticator is up-to-date and is not an old one that has been captured by an attacker, the timestamp in the authenticator is checked against the current time. If the timestamp is not close enough to the current time (typically within five minutes) then the authenticator is rejected as invalid. Thus, Kerberos requires your system clocks to be loosely synchronized (the default is 5 minutes, but it can be adjusted in Version 5 to be whatever you want).

    Reference: http://www.faqs.org/faqs/kerberos-faq/general/section-22.html

    Rate this question:

  • 16. 

    What is based upon an authentication server that allocates tickets to users?

    • You should make use of the Kerberos authentication method.

    • You should make use of the Challenge Handshake Authentication Protocol (CHAP) authentication method.

    • You should make use of the Username/password authentication method

    • You should make use of the Multifactor authentication method.

    Correct Answer
    A. You should make use of the Kerberos authentication method.
    Explanation
    The correct answer is "You should make use of the Kerberos authentication method." Kerberos is a network authentication protocol that uses a trusted third-party authentication server to issue tickets to users. These tickets are then used by users to authenticate themselves to various services on the network. This method provides secure authentication and helps prevent unauthorized access to network resources.

    Rate this question:

  • 17. 

    All logs are kept on archive for a period of time. What determines this period of time?

    • Retention policies

    • Administrator preferences

    • MTTF

    • MTTR

    • All of the Above

    Correct Answer
    A. Retention policies
    Explanation
    All logs collected are used in the active and passive monitoring process. All logs are kept on archive for a period of time, called a retention period. This period of time will be determined by your company policies. This allows the use of logs for regular audits, and annual audits if retention is longer then a year. Logs must be secured to prevent modification, deletion, and destruction.

    Administrator preference is often used to determine certain things like how long logs are retained ... but since these decisions can affect the ability of the company to go back and research potential security issues, it is a corporate issue that should be governed by a deliberate policy statement.

    MTTF and MTTR are not relevant to setting the time for which logs will be retained. MTTF (Mean Time To Failure, sometimes called MTBF, Mean Time Before Failure) is related to the average amount of time a piece of equipment will be in service before it fails. MTTR (Mean Time To Repair) is a measure of how long it will take to repair the equipment when it fails.

    Rate this question:

  • 18. 

    Which of the following is NOT a good password deployment guideline?

    • Passwords must be changed at least once every 60 days, depending on your environment.

    • Passwords must not be the same as user id or login id.

    • Password aging must be enforced on all systems.

    • Password must be easy to memorize.

    • All of the Above

    Correct Answer
    A. Password must be easy to memorize.
    Explanation
    Passwords should be easy to memorize, because that minimizes the chance that users will write the password down somewhere that others could see it.

    Passwords should not be the same as the user ID, because that is one of the common passwords that common "password cracker" programs try, when attempting to discover passwords for accounts. Passwords must be changed at least once every 60 days (depending on your environment). Password aging or expiration must be enforced on all systems. Upon password expiration, if the password is not changed, only three grace logins must be allowed then the account must be disable until reset by an administrator or the help desk. Password reuse is not allowed (rotating passwords).

    Rate this question:

  • 19. 

    Identify the access control model that makes use of security labels connected to the objects?

    • . You should make use of the Role Based Access Control (RBAC) model.

    • You should make use of the Mandatory Access Control (MAC) model.

    • You should make use of the Rule Based Access Control (RBAC) model.

    • You should make use of the Discretionary Access Control (DAC) model.

    Correct Answer
    A. You should make use of the Mandatory Access Control (MAC) model.
    Explanation
    The correct answer is that you should make use of the Mandatory Access Control (MAC) model. This model uses security labels connected to the objects to determine access control. In MAC, access decisions are based on the security classification of the objects and the security clearances of the subjects. It ensures that only authorized users with the appropriate security clearances can access objects with matching security labels.

    Rate this question:

  • 20. 

    Which access controls are based on security labels assigned to every data item and every user?

    • You should identify Mandatory Access Control (MAC).

    • You should identify Role Based Access Control (RBAC).

    • You should identify Discretionary Access Control (DAC).

    • You should identify List Based Access Control (LBAC).

    Correct Answer
    A. You should identify Mandatory Access Control (MAC).
    Explanation
    Mandatory Access Control (MAC) is a type of access control that is based on security labels assigned to every data item and every user. It enforces access control policies based on predefined rules and regulations, ensuring that only authorized users with the necessary security clearance can access specific data items. MAC is commonly used in high-security environments such as government or military systems to protect sensitive information. Role Based Access Control (RBAC), Discretionary Access Control (DAC), and List Based Access Control (LBAC) are also access control models, but they are not specifically based on security labels assigned to every data item and every user.

    Rate this question:

  • 21. 

    Which of the following access control methods allows access control decisions to be based on security labels associated with each data item and each user?

    • MACs (Mandatory Access Control)

    • RBACs (Role Based Access Control)

    • LBACs (List Based Access Control)

    • DACs (Discretionary Access Control)

    Correct Answer
    A. MACs (Mandatory Access Control)
    Explanation
    The MAC model is a static model that uses a predefined set of access privileges to files on the system. The system administrator establishes these parameters and associates them with an account, files or resources. The MAC model can be very restrictive.

    Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 11

    Rate this question:

  • 22. 

    What model assigns sensitivity labels to users and their data?

    • You should identify the Discretionary Access Control (DAC) access control model.

    • You should identify the Role Based Access Control (RBAC) access control model.

    • You should identify the Mandatory Access Control (MAC) access control model.

    • You should identify the Rule Based Access Control (RBAC) access control model.

    • None of the Above

    Correct Answer
    A. You should identify the Mandatory Access Control (MAC) access control model.
    Explanation
    The correct answer is the Mandatory Access Control (MAC) access control model. This model assigns sensitivity labels to users and their data, ensuring that access to resources is based on predefined security policies and rules. In MAC, access decisions are determined by the system administrator rather than the user, and users have limited control over the access permissions.

    Rate this question:

  • 23. 

    The Certkiller .com network contains of various departments that makes use of an access control model. The finance department only requires access to the personal data of staff and the marketing department only needs access to the production data. Which access control model is MOST suitable?

    • The Discretionary Access Control (DAC) access control model would be most suitable.

    • The Rule Based Access Control (RBAC) access control model would be most suitable.

    • The Role Based Access Control (RBAC) access control model would be most suitable.

    • The Mandatory Access Control (MAC) access control model would be most suitable.

    Correct Answer
    A. The Role Based Access Control (RBAC) access control model would be most suitable.
    Explanation
    The Role Based Access Control (RBAC) access control model would be most suitable for the given scenario. RBAC allows access to be granted based on the roles and responsibilities of users within an organization. In this case, the finance department only needs access to personal staff data, while the marketing department only needs access to production data. RBAC would allow administrators to assign specific roles to users in each department, ensuring that they have access to the appropriate data based on their job responsibilities. This model provides a more efficient and secure way of managing access control within the organization.

    Rate this question:

  • 24. 

    Which of the following attacks could be the most successful when the security technology is properly implemented and configured?

    • Logical attacks

    • Physical attacks

    • Trojan Horse attacks

    • Social Engineering attacks

    • None of the Above

    Correct Answer
    A. Social Engineering attacks
    Explanation
    Social Engineering attacks: in computer security systems, this type of attack is usually the most successful, especially when the security technology is properly implemented and configured. Usually, these attacks rely on the faults in human beings. An example of a social engineering attack has a hacker impersonating a network service technician. The serviceman approaches a low-level employee and requests their password for network servicing purposes. When using smartcards instead of passwords, this type of attack is a bit more difficult. Most people would not trust an impersonator wishing to have their smartcard and PIN for service purposes.

    Logical, physical and Trojan horse attacks are often much less successful when security is properly implemented on a network.

    Rate this question:

  • 25. 

    You work as the security administrator at Certkiller .com. Certkiller has a RBAC (Role Based Access Control) compliant system for which you are planning the security implementation. There are three types of resources including files, printers, and mailboxes and four distinct departments with distinct functions including Sales, Marketing, Management, and Production in the system. Each department needs access to different resources. Each user has a workstation. Which roles should you create to support the RBAC (Role Based Access Control) model?

    • File, printer, and mailbox roles

    • Sales, marketing, management, and production roles

    • User and workstation roles

    • Allow access and deny access roles

    Correct Answer
    A. Sales, marketing, management, and production roles
    Explanation
    Each distinct department (sales, marketing, management, and production) has their own role in the company, which probably includes using the: filer server, print server, and mail server. So it would be wise to create roles for each department.

    Rate this question:

  • 26. 

    Which authentication will provide a username, a password and undergo a thumb print scan to access a workstation?

    • The Biometric authentication best illustrates this scenario.

    • The Kerberos authentication best illustrates this scenario.

    • The Mutual authentication best illustrates this scenario.

    • The Multifactor authentication best illustrates this scenario.

    Correct Answer
    A. The Multifactor authentication best illustrates this scenario.
    Explanation
    Multifactor authentication is the only option that includes multiple factors of authentication, such as a username, password, and thumbprint scan. Biometric authentication only includes the thumbprint scan, Kerberos authentication does not mention a thumbprint scan, and Mutual authentication does not mention any specific authentication factors. Therefore, Multifactor authentication is the most appropriate choice for this scenario.

    Rate this question:

  • 27. 

    From a security perspective a performance baseline is MOST useful for:

    • Detecting performance anomalies that may be due to security breaches

    • Assuring that systems are working to their optimal capacity

    • Knowing when security scans are going to finish

    • Predicting the end of useful life for the firewall

    • All of the Above

    Correct Answer
    A. Detecting performance anomalies that may be due to security breaches
    Explanation
    A performance baseline is a reference point that represents the normal functioning and performance of a system. By establishing a baseline, any deviations from the normal behavior can be easily identified. In the context of security, detecting performance anomalies can be a strong indicator of a security breach. Unusual or unexpected changes in performance metrics may suggest that an attacker is manipulating the system or attempting to exploit vulnerabilities. Therefore, a performance baseline is most useful for detecting performance anomalies that may be due to security breaches.

    Rate this question:

  • 28. 

    With regard to DAC (Discretionary Access Control), which of the following statements are true?

    • Files that don't have an owner CANNOT be modified.

    • The administrator of the system is an owner of each object.

    • The operating system is an owner of each object.

    • Each object has an owner, which has full control over the object.

    • None of the Above

    Correct Answer
    A. Each object has an owner, which has full control over the object.
    Explanation
    The DAC model allows the owner of a resource to establish privileges to the information they own. The DAC model would allow a user to share a file or use a file that someone else has shared. The DAC model establishes an ACL that identifies the users who have authorized to that information. This allows the owner to grant or revoke access to individuals or group of individuals based on the situation. This model is dynamic in nature and allows information to be shared easily between users.

    Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 12

    Rate this question:

  • 29. 

    Identify the access decisions based on a Mandatory Access Control (MAC) environment?

    • Sensitivity labels are based on a Mandatory Access Control (MAC) environment.

    • Access control lists are based on a Mandatory Access Control (MAC) environment.

    • Group membership is based on a Mandatory Access Control (MAC) environment.

    • Ownership is based on a Mandatory Access Control (MAC) environment.

    Correct Answer
    A. Sensitivity labels are based on a Mandatory Access Control (MAC) environment.
    Explanation
    In a Mandatory Access Control (MAC) environment, access decisions are based on sensitivity labels. Sensitivity labels are used to classify and categorize data based on its level of sensitivity or importance. These labels determine the level of access that users or processes have to the data. Access control lists, group membership, and ownership are not specifically associated with MAC environments, although they may be used in conjunction with MAC policies.

    Rate this question:

  • 30. 

    Enforcing minimum privileges for general system users can be easily achieved through the use of:

    • IPSEC

    • TSTEC

    • PRVMIN

    • RBAC

    Correct Answer
    A. RBAC
    Explanation
    Explanation: Ensuring least privilege requires identifying what the user's job is, determining the minimum set of privileges required to perform that job, and restricting the user to a domain with those privileges and nothing more. By denying to subjects transactions that are not necessary for the performance of their duties, those denied privileges couldn't be used to circumvent the organizational security policy. Although the concept of least privilege currently exists within the context of the TCSEC, requirements restrict those privileges of the system administrator. Through the use of RBAC (role based access control), enforced minimum privileges for general system users can be easily achieved.

    Rate this question:

  • 31. 

    Which of the following ports does a DNS (Domain Name Service) server require?

    • 21

    • 23

    • 53

    • 55

    Correct Answer
    A. 53
    Explanation
    A DNS (Domain Name Service) server requires port 53. DNS servers use this port to listen for and respond to DNS queries from clients. When a client wants to resolve a domain name to an IP address, it sends a DNS query to the DNS server on port 53. The server then looks up the requested domain name in its database and returns the corresponding IP address to the client. Port 53 is specifically designated for DNS traffic, allowing DNS servers to efficiently handle DNS requests and provide domain name resolution services.

    Rate this question:

  • 32. 

    How many ports in TCP/IP (Transmission Control Protocol/Internet Protocol) are vulnerable to being scanned, exploited, or attached?

    • 1,024

    • 32

    • 16,777,216

    • 65,535

    Correct Answer
    A. 65,535
    Explanation
    The correct answer is 65,535. TCP/IP has 65,535 ports, which are used for communication between devices on a network. Each port is assigned a specific number and is vulnerable to being scanned, exploited, or attacked if not properly secured. It is important to have robust security measures in place to protect these ports from unauthorized access and potential threats.

    Rate this question:

  • 33. 

    Under MAC, which of the following is true?

    • All that is expressly permitted is forbidden

    • All that is not expressly permitted is not forbidden

    • All that is not expressly permitted is forbidden

    • Both A and B

    • No Answer is Correct

    Correct Answer
    A. All that is not expressly permitted is forbidden
    Explanation
    MAC is the acronym for Mandatory Access Control. It is important to note that mandatory controls are prohibitive (i.e., all that is not expressly permitted is forbidden), not permissive. Only within that context do discretionary controls operate, prohibiting still more access with the same exclusionary principle. In this type of control system decisions are based on privilege (clearance) of subject (user) and sensitivity (classification) of object (file). It requires labeling.

    Under MAC, you define who is allowed to access objects, and if you haven't defined an access right, access is not permitted. So, it is not the case that All that is expressly permitted is forbidden, or that All that is not expressly permitted is not forbidden

    Rate this question:

  • 34. 

    Which of the following access control methods provides the most granular access to protected objects?

    • Capabilities

    • Access control lists

    • Permission bits

    • Profiles

    Correct Answer
    A. Access control lists
    Explanation
    Access control lists enable devices in your network to ignore requests from specified users or systems, or grant certain network capabilities to them. ACLs allow a stronger set of access controls to be established in your network. The basic process of ACL control allows the administrator to design and adapt the network to deal with specific security threats.

    Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 235

    Rate this question:

  • 35. 

    Which of the following are used to make access decisions in a MAC (Mandatory Access Control) environment?

    • Sensitivity labels

    • Group membership

    • Ownership

    • Access control lists

    Correct Answer
    A. Sensitivity labels
    Explanation
    Mandatory Access Control is a strict hierarchical model usually associated with governments. All objects are given security labels known as sensitivity labels and are classified accordingly. Then all users are given specific security clearances as to what they are allowed to access.

    Rate this question:

  • 36. 

    What type of attacks occurs when a rogue application has been planted on an unsuspecting user's workstation?

    • Social Engineering attacks

    • Logical attacks

    • Physical attacks

    • Trojan Horse attacks

    • None of the Above

    Correct Answer
    A. Trojan Horse attacks
    Explanation
    Trojan Horse attacks - This attack involves a rogue, Trojan horse application that has been planted on an unsuspecting user's workstation. The Trojan horse waits until the user submits a valid PIN from a trusted application, thus enabling usage of the private key, and then asks the smartcard to digitally sign some rogue data. The operation completes but the user never knows that their private key was just used against their will.

    Physical attacks involve physical access to hardware such as a network cable or keyboard. Social engineering attacks are based on taking advantage of human interaction rather than technology itself. (Frequently, social engineering attacks don't even require access to a computer.) There is no such thing as a "logical" attack, although many attacks do involve the use of logic to figure out how an application works and where its security vulnerabilities may be.

    Rate this question:

  • 37. 

    Microsoft supports the _______________ and ______standards for use in extranet.

    • CORBA

    • IPSec

    • PPTP

    • DCOM

    • Both A & D

    Correct Answer(s)
    A. IPSec
    A. PPTP
    Explanation
    Netscape, Oracle, and Sun Microsystems have announced an alliance to ensure that their extranet products can work together by standardizing on JavaScript and the Common Object Request Broker Architecture (CORBA). Microsoft supports the Point-to-Point Tunneling Protocol (PPTP) and IPSec.

    CORBA and DCOM are programming technologies.

    Rate this question:

  • 38. 

    Identify the method that should be used to ensure that the user is able to authenticate to the server and the server to the user?

    • You should make use of the Mutual authentication method.

    • You should make use of the Biometric authentication method.

    • You should make use of the Username/password authentication method.

    • You should make use of the Multifactor authentication method.

    Correct Answer
    A. You should make use of the Mutual authentication method.
    Explanation
    Mutual authentication is the method that should be used to ensure that both the user and the server can authenticate each other. This method requires both parties to present valid credentials to establish trust and verify the identity of each other. It provides a higher level of security compared to other authentication methods mentioned, such as biometric, username/password, or multifactor authentication.

    Rate this question:

  • 39. 

    Which of the following is a characteristic of MAC (Mandatory Access Control)?

    • Use levels of security to classify users and data

    • Allow owners of documents to determine who has access to specific documents

    • Use access control lists which specify a list of authorized users

    • Use access control lists which specify a list of unauthorized users

    Correct Answer
    A. Use levels of security to classify users and data
    Explanation
    Mandatory Access Control is a strict hierarchical model, first developed by governments and it is based on classifying data on importance and categorizing data by department. Users receive specific security clearances to access this data. For instance, the most important piece of data would have the highest classification, where only the President would of that department would have access; while the least important resources would be classified at the bottom where everyone in the organization including the janitors could access it.

    Rate this question:

  • 40. 

    Which of the following must be deployed for Kerberos to function correctly?

    • Dynamic IP (Internet Protocol) routing protocols for routers and servers.

    • Separate network segments for the realms

    • Token authentication devices.

    • Time synchronization services for clients and servers.

    Correct Answer
    A. Time synchronization services for clients and servers.
    Explanation
    Time synchronization is crucial because Kerberos uses server and workstation time as part of the authentication process.

    Rate this question:

  • 41. 

    Which of the following is an example of a task-based control model?

    • It is an example of Rule Based Access Control (RBAC).

    • It is an example of Mandatory Access Control (MAC).

    • It is an example of Role Based Access Control (RBAC).

    • It is an example of Discretionary Access Control (DAC).

    Correct Answer
    A. It is an example of Role Based Access Control (RBAC).
  • 42. 

    Which of the following access control methods relies on user security clearance and data classification?

    • RBAC (Role Based Access Control).

    • NDAC (Non-Discretionary Access Control).

    • MAC (Mandatory Access Control).

    • DAC (Discretionary Access Control).

    Correct Answer
    A. MAC (Mandatory Access Control).
    Explanation
    Mandatory Access Control is a strict hierarchical model, first developed by governments and it is based on classifying data on importance and categorizing data by department. Users receive specific security clearances to access this data. For instance, the most important piece of data would have the highest classification, where only the President would of that department would have access; while the least important resources would be classified at the bottom where everyone in the organization including the janitors could access it.

    Rate this question:

  • 43. 

    Which servers should be located on a private network?

    • You should place a File and print server on the private network.

    • You should place a Remote Access Server (RAS) on the private network.

    • You should place an E-mail server on the private network.

    • You should place a Web server on the private network.

    Correct Answer
    A. You should place a File and print server on the private network.
    Explanation
    A file and print server should be located on a private network because it contains sensitive and confidential data that should only be accessed by authorized users within the organization. Placing it on a private network ensures that the server is protected from external threats and unauthorized access. Additionally, a private network provides better control and security measures, such as firewalls and access restrictions, to safeguard the data stored on the file and print server.

    Rate this question:

  • 44. 

    Access controls that are not based on the policy are characterized as:

    • Mandatory controls

    • Discretionary controls

    • Secret controls

    • Corrective controls

    • Non of the Above

    Correct Answer
    A. Discretionary controls
    Explanation
    Access controls that are not based on the policy are characterized as discretionary controls by the U.S. government and as need-to-know controls by other organizations. The latter term connotes least privilege - those who may read an item of data are precisely those whose tasks entail the need.

    Mandatory controls are based on policy. Secret controls and corrective controls are not related to access control.

    Rate this question:

  • 45. 

    Which of the following factors must be considered when implementing Kerberos authentication?

    • Which of the following factors must be considered when implementing Kerberos authentication?

    • Kerberos tickets can be spoofed using replay attacks to network resources.

    • Kerberos requires a centrally managed database of all user and resource passwords.

    • Kerberos uses clear text passwords.

    Correct Answer
    A. Kerberos requires a centrally managed database of all user and resource passwords.
    Explanation
    If the key distribution centre is down, all of other systems dependent on those keys won't be able to function.

    Rate this question:

  • 46. 

    A firewall can be classified as a:

    • Rule based access control

    • Lattice based access control

    • Directory based access control

    • ID based access control

    • All of the Above

    Correct Answer
    A. Rule based access control
    Explanation
    Rule based access control is based on a specific profile for each user. Information can be easily changed for only one user but this scheme may become a burden in a very large environment. A rule-based access control unit will intercept every request to the server and compare the source specific access conditions with the rights of the user in order to make an access decision. A good example could be a firewall. Here a set of rules defined by the network administrator is recorded in a file. Every time a connection is attempted (incoming or outgoing), the firewall software checks the rules file to see if the connection is allowed. If it is not, the firewall closes the connection.

    Lattice-based access control is associated with Mandatory Access Control (MAC). Directory based and ID based access controls are not relevant.

    Rate this question:

  • 47. 

    Which services is provided by message authentication codes?

    • You make use of message authentication codes to provide the Key recovery service.

    • You make use of message authentication codes to provide the Fault recovery service.

    • You make use of message authentication codes to provide the Acknowledgement service.

    • You make use of message authentication codes to provide the Integrity service.

    Correct Answer
    A. You make use of message authentication codes to provide the Integrity service.
    Explanation
    Message authentication codes (MACs) are cryptographic algorithms that are used to provide integrity service. Integrity service ensures that the message has not been altered or tampered with during transmission. By using MACs, the sender can generate a tag or code that is attached to the message. The receiver can then verify the integrity of the message by recalculating the tag and comparing it with the received one. If the tags match, it means that the message has not been modified. MACs do not provide key recovery, fault recovery, or acknowledgement services.

    Rate this question:

  • 48. 

    Which of the following provides the best protection against an intercepted password?

    • VPN (Virtual Private Network).

    • PPTP (Point-to-Point Tunneling Protocol).

    • One time password.

    • Complex password requirement.

    Correct Answer
    A. One time password.
    Explanation
    A one time password is simply a password that has to be changed every time you log on; effectively making any intercepted password good for only the brief interval of time before the legitimate user happens to login themselves. So by chance, if someone were to intercept a password it would probably already be expired, or be on the verge of expiration within a matter of hours.

    Rate this question:

  • 49. 

    Which of the following is an inherent flaw of DAC (Discretionary Access Control)?

    • DAC (Discretionary Access Control) relies only on the identity of the user or process, leaving room for a Trojan horse.

    • DAC (Discretionary Access Control) relies on certificates, allowing attackers to use those certificates.

    • DAC (Discretionary Access Control) does not rely on the identity of a user, allowing anyone to use an account.

    • DAC (Discretionary Access Control) has no known security flaws.

    Correct Answer
    A. DAC (Discretionary Access Control) relies only on the identity of the user or process, leaving room for a Trojan horse.
    Explanation
    In a DAC model, network users have some flexibility regarding how information is accessed. This model allows users to dynamically share information with other users. The process allows a more flexible environment, but it increases the risk of unauthorized disclosure of information. Administrators will have a more difficult time ensuring that information access is controlled and that only appropriate access is given.

    Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 440

    Rate this question:

Quiz Review Timeline (Updated): Dec 16, 2024 +

Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.

  • Current Version
  • Dec 16, 2024
    Quiz Edited by
    ProProfs Editorial Team
  • Apr 11, 2009
    Quiz Created by
    Mastermind1100
Back to Top Back to top
Advertisement