CompTIA Security+ Exam 2

1. You work as a network administrator in a company. You have been asked to block outbound traffic to a few websites based on IP address. At which layer of the OSI model,  the IP filtering would work?

2. Layer 2 switches represent multiple collision domains but a single broadcast domain

3. You have captured some network traffic and while analyzing it using Wireshark, you notice that some of the packets are destined for TCP port 20 and 21. What type of network traffic is this?

4. Which of the following protocols do not encrypt data?

5. Bob is a network administrator and has been asked to allow HR users to modify few HR documents stored on a file server. Which information security goal Bob will satisfy?

6. Being a network administrator, Bob's duty is to download and test the latest software updates and security patches before applying to users PCs. To which security goal does this example apply?

7. You receive the e-mail message shown here. What type of threat is this?

Local Postage Service

CONGRATULATIONS

This email was sent only to 10 Selected Customers in your area. In this way. we would like to thank you for being here for us.
You are one of the current customers to win an Exclusive Reward.
All you have to do is confirm receipt of this email. Please click here to confirm.

Thanks and good luck.

8. Which policy specifies details about data storage for various types of information including storage location, the length of time data is retained, the type of storage media such as magnetic tape or cloud archiving?

9. A buffer overflow attack occurs when a hacker sends more data to an application or service than it is expecting

10. Which social engineering tactic involves an attacker fabricating fake reviews to convince the victim that other people have used the software or service that the attacker is offering?

11. Which attack involves tricking the user into clicking an object that does not do what the user expects it to do?

12. In which type of threat the victim's data is encrypted and a demand is made from the victim, in the form of payment to decrypt the data

13. The primary function of the Stuxnet attack was to hide its presence while reprogramming industrial computer systems. Stuxnet was spread through USB flash drives and it replicated itself. Which of the following apply to Stuxnet attack?

14. Match the type of attack with its description
Virus
A piece of code that performs malicious actions without the user's consent

Unselect

Gains access to a computer and encrypts all files

Unselect

Stores every keystroke from the machine it is installed on

Unselect

A piece of malicious code that can replicate itself

Unselect

Worm
A piece of code that performs malicious actions without the user's consent

Unselect

Gains access to a computer and encrypts all files

Unselect

Stores every keystroke from the machine it is installed on

Unselect

A piece of malicious code that can replicate itself

Unselect

Key-logger
A piece of code that performs malicious actions without the user's consent

Unselect

Gains access to a computer and encrypts all files

Unselect

Stores every keystroke from the machine it is installed on

Unselect

A piece of malicious code that can replicate itself

Unselect

Crypto-malware
A piece of code that performs malicious actions without the user's consent

Unselect

Gains access to a computer and encrypts all files

Unselect

Stores every keystroke from the machine it is installed on

Unselect

A piece of malicious code that can replicate itself

Unselect

15. Which standard requires that devices be authenticated before being given network access?

16. Which method involves the customer, in the development of the product and can create basic versions of working software quickly?

17. What primary benefit does Git provide to manage changed code by giving each change its own unique identifier?

18. A host-based intrusion prevention system (HIPS) detects and stops attacks on a computer system and also monitor the content of LAN network traffic

19. Which protocol is a WPA2 standard that uses an AES block cipher with counter mode and makes pattern detection difficult, thus making this a strong protocol?

20. You are configuring a wireless network for your home. Which options are not applicable to a home network?

21. Which attack involves an attacker creating enough interference that legitimate clients cannot communicate with the wireless access point?

22. Transport Layer Security (TLS) replaces which protocol and offers more secure data authentication to ensure data has not been tampered with while in transit?

23. Which protocol reports on network congestion and the reachability of network nodes?

24. Which term describes the intentional altering of communications in an attempt to make it more difficult for unauthorized parties to make sense of the message?

25. Which of the following statements are true regarding the certificates containing private keys?

26. Which security solution uses PKI certificate keys to encrypt and decrypt hard disk contents?

27. Which algorithm uses one-way encryption that transforms a string of characters into a fixed-length value or key and ensure the integrity of data?

28. You want to authenticate the wireless users and also to log connection sessions. Which of the following should be used?

29. Which of the following physical access control methods identify entry into a secure area?

30. You work as a system administrator in a company. You have recently migrated locally hosted email exchange to cloud. How does this apply to the concept of risk?

31. Your company has decided not to launch a new product in a market due to economic uncertainty and ongoing COVID -19 pandemic. Which term best describes your company's decision?

32. You work as a system administrator in a company. You have been asked to migrate the file server and email server data to the cloud. What step should you take to make sure access to files and emails is always available to users?

33. Which document lists lessons learned from previous incidents in order to improve upon identified problems that obstructed incident response?

34. What type of evidences would be easy for the perpetrator to forge?

35. Annual loss expectancy (ALE) is used when performing a risk assessment and used to calculate the probability of asset failure over a year

36. Which type of analysis refers to using specialized tools or algorithms to analyze large volumes of data?

37. Which Windows tool is used to measure and monitor performance metrics of a Windows computer?

38. In what type of testing, testers are given details regarding the item they are testing, such as software source code or network diagrams?

39. A packet sniffer captures transmitted network traffic and it can also determine whether RDP is available on a particular IP address

40. Match the type of testing with its description
Black box
It is final part of testing process

Unselect

Testers have knowledge about how software or network is designed

Unselect

Testers have minimal knowledge about how software or network is designed

Unselect

Testers have no information about how software or network is designed

Unselect

White box
It is final part of testing process

Unselect

Testers have knowledge about how software or network is designed

Unselect

Testers have minimal knowledge about how software or network is designed

Unselect

Testers have no information about how software or network is designed

Unselect

Grey box
It is final part of testing process

Unselect

Testers have knowledge about how software or network is designed

Unselect

Testers have minimal knowledge about how software or network is designed

Unselect

Testers have no information about how software or network is designed

Unselect

Red box
It is final part of testing process

Unselect

Testers have knowledge about how software or network is designed

Unselect

Testers have minimal knowledge about how software or network is designed

Unselect

Testers have no information about how software or network is designed

Unselect

41. Which two commands use ICMP to test whether or not a network host responds to an incoming packet?

42. To adhere to new corporate security guidelines, your branch offices must analyze network traffic for irregularities and then triggers alarms or notifications. What should you install?

43. What can be done to prevent malicious users from tampering with log files?

44. Which tool is used to permanently remove the data stored on a memory device?

45. Which protocol is used to collect and organize information about managed devices with enhanced security on an IP network?

46. What refers to the theft of information from a Bluetooth enabled device through a Bluetooth connection?

47. In what type of attack, the attacker enters malicious code in an application and the malicious code is passed to the backend database?

48. In a man in the middle attack, an attacker captures and replays network data between two parties without their knowledge

49. Which of the following is the best security practice to counter brute force attack to prevent hackers from accessing the user's account?

50. Which type of policy states about, how and where data is stored, how long it must be kept, and how it is to be backed up or disposed of?


 

Leave a comment