CompTIA Security+ Exam 1

1. Match the four risk response strategies with its correct description
Avoidance
Don't engage in risky a activity

Unselect

Willing to live with the risk without control and mitigation

Unselect

Transfer the risk to another entity

Unselect

Take steps to reduce the impact

Unselect

Transference
Don't engage in risky a activity

Unselect

Willing to live with the risk without control and mitigation

Unselect

Transfer the risk to another entity

Unselect

Take steps to reduce the impact

Unselect

Mitigation
Don't engage in risky a activity

Unselect

Willing to live with the risk without control and mitigation

Unselect

Transfer the risk to another entity

Unselect

Take steps to reduce the impact

Unselect

Acceptance
Don't engage in risky a activity

Unselect

Willing to live with the risk without control and mitigation

Unselect

Transfer the risk to another entity

Unselect

Take steps to reduce the impact

Unselect

2. What are the three categories of control types that can be administered?

3. You are asked to segregate the human resource and accounts department's network traffic on a layer two device within a LAN, so as to stop the two departments from seeing each other resources. Which of the following types of network design you would choose?

4. NAT will hide the public IP address from the Internet world and is also a solution for the limited IPv6 addresses available

5. What is the primary purpose of implementing security policies?

6. You have been tasked in the implementation of corporate security policies regarding tablet usage for business purposes.  What should you do first?

7. Match the security policy term with its correct definition
Policy
What happens if policy is not followed

Unselect

How security can be improved by using security policies

Unselect

Collection of what can be done and what can't be done

Unselect

Defines to which set of users a security policy applies

Unselect

Scope
What happens if policy is not followed

Unselect

How security can be improved by using security policies

Unselect

Collection of what can be done and what can't be done

Unselect

Defines to which set of users a security policy applies

Unselect

Enforcement
What happens if policy is not followed

Unselect

How security can be improved by using security policies

Unselect

Collection of what can be done and what can't be done

Unselect

Defines to which set of users a security policy applies

Unselect

Overview
What happens if policy is not followed

Unselect

How security can be improved by using security policies

Unselect

Collection of what can be done and what can't be done

Unselect

Defines to which set of users a security policy applies

Unselect

8. Which of the following is not an example of personally identifiable information?

9. Service level agreements (SLAs) are contractual documents guaranteeing a specific availability of network services

10. A user on your network receives an email from the insurance company stating that there has been a security breach and all customers need to login to a link provided and change their login password. What variety of attack is this?

11. Match the type of attach with its description
Spoofing
DNS poisoning that leads a victim to a bogus server while surfing web

Unselect

A spam message sent via instant messaging application

Unselect

Happens when a hacker alter the source address of the packet

Unselect

A spoofed email that looks like to be coming from a trusted sender

Unselect

Spear Phishing
DNS poisoning that leads a victim to a bogus server while surfing web

Unselect

A spam message sent via instant messaging application

Unselect

Happens when a hacker alter the source address of the packet

Unselect

A spoofed email that looks like to be coming from a trusted sender

Unselect

Spim
DNS poisoning that leads a victim to a bogus server while surfing web

Unselect

A spam message sent via instant messaging application

Unselect

Happens when a hacker alter the source address of the packet

Unselect

A spoofed email that looks like to be coming from a trusted sender

Unselect

Pharming
DNS poisoning that leads a victim to a bogus server while surfing web

Unselect

A spam message sent via instant messaging application

Unselect

Happens when a hacker alter the source address of the packet

Unselect

A spoofed email that looks like to be coming from a trusted sender

Unselect

12. A birthday attack occurs when the hacker captures traffic off the network with a packet analyzer such as Wireshark

13. What can be done to help prevent buffer overflow attacks from occurring in your network?

14. What is the type of malware that hides itself from the operating system while allowing privileged access to a malicious user?

15. Which of the following are true regarding backdoors?

16. Bob uses the Google Chrome web browser on his Windows laptop. He reports that his browser home page keeps changing to web sites offering savings on consumer electronic products. What is causing this problem?

17. A trojan is a malicious code that appears to be useful software. It could create a backdoor method for attackers to gain access to the system

18. Match the technique with its description
Fuzzing
Testing of software to identify the cause of flaw

Unselect

Fixes problem with the software

Unselect

Disabling unneeded services to make system secure

Unselect

Refers to testing own software for vulnerabilities

Unselect

Hardening
Testing of software to identify the cause of flaw

Unselect

Fixes problem with the software

Unselect

Disabling unneeded services to make system secure

Unselect

Refers to testing own software for vulnerabilities

Unselect

Debugging
Testing of software to identify the cause of flaw

Unselect

Fixes problem with the software

Unselect

Disabling unneeded services to make system secure

Unselect

Refers to testing own software for vulnerabilities

Unselect

Patching
Testing of software to identify the cause of flaw

Unselect

Fixes problem with the software

Unselect

Disabling unneeded services to make system secure

Unselect

Refers to testing own software for vulnerabilities

Unselect

19. You are a network administrator in a company. The company's management has asked you to secure all the Windows laptops, keeping in view most of the users use external USB storage devices to save their data. What are some of the best security practices to follow?

20. Security templates are used to exploits hardware and software vulnerabilities to determine how secure computing devices or networks really are

21. Which of the following security measure would protect the data stored in hard disk drive even if the hardware is stolen or lost?

22. Your company hosts an on-premises active directory server to authenticate users. File servers and other applications are hosted in a public cloud. You have enabled Identity federation to create trust between locally authenticated users and cloud services for seamless connectivity. What type of cloud model you are using in this scenario?

23. Which technology allows a response to be triggered if a mobile device leaves an area around a corporate building as per company policy?

24. You are setting up a wireless router in a cafe, where customers would be able to connect to the internet. Where should you plug in the wireless router?

25. Which technology actively monitors the network or system activity for abnormal behaviours and also take action to prevent the intrusion from succeeding?

26. Based on the following LAN firewall rules, choose the best description

Allow inbound TCP 22, TCP 21

Allow outbound TCP 80, TCP 443

27. Which process examines, where traffic is going and compares that against a list of allowed and forbidden sites to allow or prevent access?

28. Which system is designed as a decoy to attract the cyberattacks in an effort to detect, deflect or counteract attempts at unauthorized use of information systems?

29. Which two services are not provided by WPA when enabled on a wireless local area network?

30. What are some of the best practices to secure a wireless network?

31. Temporal Key Integrity Protocol (TKIP) is used by Wired Equivalent Privacy (WEP) for encryption and supersedes WiFi Protected Access (WPA)

32. You have received a new wireless router from your internet service provider and you notice a PIN on the back of the router. What is the purpose of the PIN?

33. You are a network administrator in a company. Some of the users are going on a business trip but they need access to the company's network while travelling. What should you configure for them?

34. Before accessing computer systems, an enterprise company requires users to provide a PIN from their mobile phone using an authentication application. What is this an example of?

35. Which service can be used to enable a user to authenticate only once to multiple resources that would otherwise require separate logins?

36. A network router has the following inbound access-list configured

Choose the correct description of the ACL configuration

37. Match the term with its description
False positive
Occurrence is incorrectly determined to be malicious

Unselect

Occurrence is considered normal activity and not malicious

Unselect

Occurrence that is malicious, has been detected

Unselect

Problems that do not get detected

Unselect

True positive
Occurrence is incorrectly determined to be malicious

Unselect

Occurrence is considered normal activity and not malicious

Unselect

Occurrence that is malicious, has been detected

Unselect

Problems that do not get detected

Unselect

False negative
Occurrence is incorrectly determined to be malicious

Unselect

Occurrence is considered normal activity and not malicious

Unselect

Occurrence that is malicious, has been detected

Unselect

Problems that do not get detected

Unselect

True negative
Occurrence is incorrectly determined to be malicious

Unselect

Occurrence is considered normal activity and not malicious

Unselect

Occurrence that is malicious, has been detected

Unselect

Problems that do not get detected

Unselect

38. Which hashing algorithm computes a digest from provided data and any change in the data will invalidate the digest?

39. Which firmware security solution uses PKI certificate keys to encrypt and decrypt hard disk contents?

40. Which of the following statements regarding wired networks are not true? (Choose two)

41. A user in your company show you some details regarding malicious users, gaining access to corporate resources. What type of assessment would you perform to investigate this?

42. What defines the contractual documents, detailing the expected service from an Internet service provider?

43. Risk management identifies and prioritizes risks and risk assessment is the governing of risks to minimize their impact

44. An application server uses five hot-swappable hard disks in a RAID 5 configuration. When one disk fails, you have other disks readily available that you can simply plug in while the server is still running. Which term best describes this scenario?

45. Match the incident response term with its definition
Preparation
Process to lessen the effect of anything

Unselect

Documentation of an incident for future reference

Unselect

It includes establishing incident response procedures

Unselect

Lessons Learned
Process to lessen the effect of anything

Unselect

Documentation of an incident for future reference

Unselect

It includes establishing incident response procedures

Unselect

Mitigation Steps
Process to lessen the effect of anything

Unselect

Documentation of an incident for future reference

Unselect

It includes establishing incident response procedures

Unselect

46. Which procedure is an intrusive type of testing that involves simulating malicious activity against hosts or entire networks in order to assess how secure they are and to identify threats?

47. You work as a network administrator in a company. You have set up a fileserver and configured auditing so that you can track who deletes files on the file share 'Projects'. Where will you view the audit results?

48. Verbose logging is useful for troubleshooting but not for long periods of time because performance is degraded

49. Which device can track detailed web surfing activity including site visited, time of day and the user account name?

50. One of the users in your company reports that his Windows PC has been slow and unstable since last week. What should you first do to narrow down the problem?


 

Leave a comment