COMPTIA CASP+ Module 1

1. Your organization underwent a security assessment. It was discovered that a computer connected to any Ethernet connection within its shipping facility could access network resources without authentication. You are instructed to address this security flaw. Which standard, if implemented, would address the problem?
2. The department of IT security was tasked with recommending a single security device capable of performing several security responsibilities. Antivirus, anti-spyware, a firewall, and an IDP are among the security features. What device should be recommended by the IT security department?
3. End users of company XYZ are experiencing trouble logging into the network. Which form of attack does his investigation of the scenario lead him to assume it is?
4. Your organization's website and secure web server have recently been defaced. The server was compromised during a three-day holiday weekend when the majority of IT personnel was unavailable. The network diagram comprises of the Internet, firewall, IDS, SSL accelerator, web server farm, internal firewall, and internal network, in sequence from the outside in. You try a forensic study, but the web server logs have been removed and the internal firewall logs reveal no activity. What do you as the security administrator do?
5. You are configuring SNMP on a server running Windows. You have determined that you are running SNMPv2c. What are the benefits of upgrading to SNMPv3?
6. Your CISO has requested that you create a solution that can identify and stop criminal activity on the jump servers in your DMZ. Which solution achieves this objective?
7. Your security team created NAC lists for authentication and enforcement of company policy. Initially, the team placed software on the devices for these functions. Nevertheless, the security team determined that this approach is no longer desirable. They desire to implement a solution that serves the same purpose but does not require the installation of software on the devices. What is this configuration referred to within the NAC context?
8. Ana, who works for a construction company, has discovered that cloud computing fulfills 90 percent of his IT requirements. Which of the following is the least significant when considering cloud computing?
9. Your department is searching for a new storage solution that permits an unspecified number of systems to join utilizing file-based peering protocols (such as NFS and SMB). This solution will also be utilized to provide network clients with file-sharing services such as data storage, access, and management. What is the optimal storage solution for your business?
10. Ben is a government security engineer attempting to discover the control of highly secret customer data. Who should he consult on the coordination of control of these sensitive data?
11. A security engineer is afraid that logs on their hybrid SDN network could be lost if devices fail or are exploited by an attacker. What solution safeguards against the loss of logs on these devices?
12. You have received a response to your request for quotation from a software firm that manufactures a solution that will allow you to record all changes in a single change management tool. This tool will monitor scheduling changes, change implementation, change costs, and reporting. What category of software is this?
13. You are researching a new system that finds, analyzes, and reports on real-time threats based on logs alone. What is the best response?
14. Your CISO has chosen to execute a comprehensive enterprise mobility management (EMM) strategy. She wants to ensure that important company data is not compromised by mobile apps on employee devices. Which of them will execute that the best?
15. You are a web developer responsible for securing API keys in a client-side JavaScript application for your hospital. What is the most effective and efficient technique to do this work quickly?
16. The newly formed IT team at Craig is researching cloud computing models. He desires to utilize an infrastructure-integrated cloud computing approach with orchestration. Based on business and technological policies, apps and data may share resources. Which of the following options is ideal for this circumstance?
17. You have been evaluating a CMDB's backup schedule. Your CIO stated that the company's RPO is 48 hours. What is the minimum frequency of CMDB backups?
18. Three years ago, a significant enterprise social media organization underwent many mergers, divestitures, and acquisitions. Consequently, the interdependencies between the internal networks and software are extremely complex. Enhanced integration is required. Which of the following integration platforms is ideal for software architecture based on security and standards?
19. You have transferred a software project to the fielding phase and delivered a functioning solution to the client. What is this phase commonly known as?
20. You are conducting unit testing on a new software application. How can you examine an individual program to guarantee that each module behaves as intended?
21. The SDLC phases constitute a subset of the system life cycle (SLC). After the implementation phase of the SDLC, the SLC contains two phases that address postinstallation and future adjustments. What do you call them?
22. Many of your company's remote workers use mobile laptops to do their tasks. Security is afraid that sensitive information stored on these computers may be disclosed and leaked. What methodology prevents data loss most effectively?
23. Your firm has opted to transition from dedicated desktop machines to a virtual desktop environment. The desktop image lives on a server within a virtual machine and is accessed over the network by a desktop client. Which of the following is described here?
24. You have moved more than fifty percent of your business to the cloud, but you are still concerned about data loss, unauthorized access, and encryption. What remains the cloud infrastructure vulnerability that leads to the most breaches?
25. As a network administrator, you are checking network logs. In the previous 48 hours, UDP traffic has surged by more than 30 percent. You capture the packets with Wireshark and observe the following: UDP 192.168.1.1:123->46.110.10.5:123. What is the most likely attack scenario?
26. Sheldon's end users access secret information on the corporate network utilizing mobile devices. He must guarantee that the information from all databases is sent to these mobile devices in a secure manner. Encryption is a requirement. Which of the following best defines a major worry with PII on mobile devices?
27. Alex develops websites. He developed an online form for clients to fill out and submit via a website. What should a developer do immediately to prevent this page from becoming a security risk?
28. Marketing has submitted a request to a third-party vendor for web-based meeting software. The software products that you, as a security analyst, have evaluated require user registration and installation, as well as data and desktop sharing. Which of the following controls best ensures the security of information?
29. Which of the following access control concepts should you use to develop a system of checks and balances for privileged access employees?
30. Your penetration testers obtained the credentials for specific user accounts through social engineering and phishing tactics, according to their report. Once on the organization's network, penetration testers utilized these credentials to circumvent access controls and acquire remote system access. They were able to transition from a user account to an administrator account in one instance. What is the name for this type of assault?
31. Your IT administrator desires to switch from a centralized to a decentralized access control technique. You require a router capable of authenticating users using a locally stored database. This necessitates the addition of each subject to the local database for access, so establishing a security domain or sphere of trust. What best describes this form of governance?
32. You implement access control requirements for your secure data storage system. You modify the default passwords and mandate the use of strong passwords. What else should you do to increase the security of this storage system?
33. Your organization need a AAA server to handle VPN users who connect to the corporate network. Which of the following will be utilized in the delivery of AAA services?
34. You are currently logged in to a website. While executing website-based tasks, you gain access to a third-party program. The application requests permission to view your profile information as part of its operation. What technology is described by this procedure?
35. Your firm needs conduct massive volumes of big data computations nightly. To reduce TCO, elastic cloud services are utilized. Every night, virtual computers and containers are generated and deleted. What is the most significant threat to confidentiality?
36. GPS is integrated into mobile devices and cameras, allowing coordinates of longitude and latitude to be placed in a machine-readable format as part of a photograph or within an app or game. Other than the physical coordinates of longitude and latitude, which of the following will not be contained in the metadata of a cell phone photograph?
37. Management of your hosted application environment necessitates end-to-end visibility, a high-performance connection, and security monitoring. What factors should be considered to maximize control and visibility?
38. You have a new security policy that mandates off-site data backups. This data should be backed up every hour. Cost is crucial. Which strategy are you most likely to implement?
39. You wish to create a technique that verifies an email was sent by a certain person and that its contents were not altered. Which of the provided technologies performs this function?
40. As a network defender, you are having trouble keeping up with the volume of network attacks. What resources can you utilize to aid in the early discovery and reaction to these dangers, particularly new ones?
41. Amy desires to utilize a protocol that enables a client to retrieve a database element without the database owner knowing which element was retrieved. If implemented securely, the client will only discover the element they are querying for, safeguarding their anonymity. Which of the following is the most effective solution?
42. Exciting breakthroughs in augmented reality (AR) are occurring, and cybersecurity is currently dealing with a great degree of complexity. Adoption of augmented reality introduces an expanding spectrum of cyber-security threats. Consumers and organizations are dealing with massive data breaches, and modern businesses must deploy strong cybersecurity safeguards. Which of these is not an urgent or pertinent cybersecurity concern involving augmented reality?
43. You want your firm to profit from artificial intelligence, but several members of the application development department do not understand what AI is. Which of the following is true?
44. Carl is leading a project to deploy a chatbot on your insurance company's webpage to replace human agents. What technologies will he employ most likely?
45. A server containing confidential financial data is running out of space. You are the manager of information security and are responsible for data storage. What is the optimal choice?
46. A circumstance affecting the CIA trinity of an IT asset may involve both internal and external sources of risk. A breach of physical security and data theft may be caused by
47. During what stage of eDiscovery will you identify which digital data and documents should be collected for potential analysis and review?
48. You are the administrator of a small business that hosts many virtualized client servers on a single host. You are instructed to form a cluster by adding a new host. The new hardware and operating system will be unique, but the underlying technology will remain compatible. Both hosts will share the same storage capacity. What are you attempting to achieve?
49. Willie is implementing a new RAID configuration required for disk failure redundancy. What security objective is Bob attempting to achieve?
50. You are monitoring your IT environment to detect practices like credential dumping. Credential dumping is the process of obtaining usernames and passwords from a computer in order to transmit them to other machines on the network. On a Windows system, where are credentials stored?