Comptia Sec+ Sy0-401

Front 1

A forensic analyst is reviewing electronic evidence after a robbery. Security cameras installed at the site were facing the wrong direction to capture the incident. The analyst ensures the cameras are turned to face the proper direction. Which of the following types of controls is being used?

Back 1

Corrective

Front 2

A company with a US-based sales force has requested that the VPN system be configured to authenticate the sales team based on their username, password and a client side certificate. Additionally, the security administrator has restricted the VPN to only allow authentication from the US territory. How many authentication
factors are in use by the VPN system?

Back 2

3

Front 3

The Chief Information Officer (CIO) wants to implement a redundant server location to which the production server images can be moved within 48 hours and services can be quickly restored, in case of a catastrophic failure of the primary datacenter's HVAC. Which of the following can be implemented?

Back 3

Warm site

Front 4

Users are unable to connect to the web server at IP 192.168.0.20. Which of the following can be inferred of a firewall that is configured ONLY with the following ACL?

PERMIT TCP ANY HOST 192.168.0.10 EQ 80
PERMIT TCP ANY HOST 192.168.0.10 EQ 443

Back 4

It implements an implicit deny.

Front 5

A network administrator has recently updated their network devices to ensure redundancy is in place so that:

Back 5

single points of failure are removed.

Front 6

Which of the following network architecture concepts is used to securely isolate at the boundary between networks?

Back 6

DMZ

Front 7

After a user performed a war driving attack, the network administrator noticed several similar markings where WiFi was available throughout the enterprise. Which of the following is the term used to describe these markings?

Back 7

War chalking

Front 8

A company has purchased an application that integrates into their enterprise user directory for account authentication. Users are still prompted to type in their usernames and passwords. Which of the following types of authentication is being utilized here?

Back 8

Same sign-on

Front 9

Which of the following types of encryption will help in protecting files on a PED?

Back 9

Mobile device encryption

Front 10

The information security team does a presentation on social media and advises the participants not to provide too much personal information on social media web sites. This advice would BEST protect people from which of the following?

Back 10

Cognitive passwords attacks

Front 11

How often, at a MINIMUM, should Sara, an administrator, review the accesses and right of the users on her system?

Back 11

Annually

Front 12

A user has unknowingly gone to a fraudulent site. The security analyst notices the following system change on the user's host:

Old `hosts' file:
127.0.0.1 localhost

New `hosts' file:
127.0.0.1 localhost
5.5.5.5 www.comptia.com

Which of the following attacks has taken place?

spear fishing
Pharming
Phishing
Vishing

Back 12

Pharming

Front 13

Which of the following assets is MOST likely considered for DLP?

a.Application server contentb.USB mass storage devicesc.Reverse proxyd.Print server

Back 13

B. USB mass storage devices

Front 14

A security analyst has been notified that trade secrets are being leaked from one of the executives in the corporation. When reviewing this executive's laptop they notice several pictures of the employee's pets are on the hard drive and on a cloud storage network. When the analyst hashes the images on the hard drive against the hashes on the cloud network they do not match. How is the employee leaking these secrets?

Back 14

Steganography

Front 15

A user has received an email from an external source which asks for details on the company's new product line set for release in one month. The user has a detailed spec sheet but it is marked "Internal Proprietary Information". What should the user do next?

Back 15

Contact the help desk and/or incident response team to determine next steps

Front 16

Digital signatures provide what?

Back 16

Integrity

Front 17

Mandatory vacations are a security control which can be used to uncover what?

Back 17

Fraud committed by a system administrator

Front 18

A network stream needs to be encrypted. Sara, the network administrator, has selected a cipher which will encrypt 8 bits at a time before sending the data across the network. Which cypher has Sara selected?

Back 18

Block cypher

Front 19

A hacker has discovered a simple way to disrupt business for the day in a small company which relies on staff working remotely. In a matter of minutes the hacker was able to deny remotely working staff access to company systems with a script. Which security controls is the hacker exploiting?

Back 19

Account lockout

Front 20

A security administrator plans on replacing a critical business application in five years.

Recently, there was a security flaw discovered in the application that will cause the IT department to manually re-enable user accounts each month at a cost of $2,000.

Patching the application today would cost $140,000 and take two
months to implement.

What should the security administrator do in regards to the application?

Back 20

Accept the risk and continue to enable the accounts each month saving money

Front 21

An administrator is concerned that a company's web server has not been patched. What would be the BEST assessment for the administrator to perform?

Back 21

Vulnerability scan

Front 22

Sara, a security manager, has decided to force expiration of all company passwords by the close of business day. What BEST supports this reasoning?

Back 22

A recent security breach in which passwords were cracked.

Front 23

Disabling unnecessary services, restricting administrative access, and enabling auditing controls on a server are forms of what?

Back 23

System hardening

Front 24

What techniques enables a highly secured organization to assess security weaknesses in real time?

Back 24

Continuous monitoring

Front 25

The security administrator is observing unusual network behavior from a workstation. The workstation is communicating with a known malicious destination over an encrypted tunnel. A full antivirus scan, with an updated antivirus definition file, does not show any signs of infection. What has happened on the workstation?

Back 25

Zero-day attack

Front 26

A recent computer breach has resulted in the incident response team needing to perform a forensics examination. Upon examination, the forensics examiner determines that they cannot tell which captured hard
drive was from the device in question. What would have prevented the confusion experienced during this examination?

Back 26

Evidence labeling

Front 27

A user commuting to work via public transport received an offensive image on their smart phone from another commuter. What attacks MOST likely took place?

Back 27

Bluejacking

Front 28

Encryption of data at rest is important for sensitive information because of what?

Back 28

Prevents data from being accessed following theft of physical equipment

Front 29

What can be implemented with multiple bit strength?

Back 29

AES

Front 30

A trojan was recently discovered on a server. There are now concerns that there has been a security breach that allows unauthorized people to access data. The administrator should be looking for the presence of a/an:

Back 30

Backdoor

Front 31

Matt, a security analyst, needs to implement encryption for company data and also prevent theft of company data. Where and how should Matt meet this requirement?

Back 31

Matt should implement DLP and encrypt the company database.

Front 32

What is the LEAST volatile when performing incident response procedures?

Back 32

Hard drive

Front 33

What does full disk encryption prevent?

Back 33

Clear text access

Front 34

Sara, an application developer, implemented error and exception handling alongside input validation. What does this help prevent?

Back 34

Cross-site scripting

Front 35

What services are used to support authentication services for several local devices from a central location without the use of tokens?

Back 35

TACACS+

Front 36

What presents the STRONGEST access control?

Back 36

MAC

Front 37

During a security assessment, an administrator wishes to see which services are running on a remote server. What should the administrator use?

Back 37

Port scanner

Front 38

A router has a single Ethernet connection to a switch. In the router configuration, the Ethernet interface has three sub-interfaces, each configured with ACLs applied to them and 802.1q trunks. What is MOST likely the reason for the sub-interfaces?

Back 38

The switch has several VLANs configured on it.

Front 39

What types of application attacks would be used to specifically gain unauthorized information from databases that did not have any input validation implemented?

Back 39

SQL injection

Front 40

A security administrator wishes to change their wireless network so that IPSec is built into the protocol and NAT is no longer required for address range extension. What protocols should be used in this scenario?

Back 40

IPv6

Front 41

Pete, an employee, is terminated from the company and the legal department needs documents from his encrypted hard drive. What should be used to accomplish this task? (select two)

Back 41

Recover Agent
Key Escrow

Front 42

What protocols allows for secure transfer of files? (Select TWO).

Back 42

SFTP
SCP

Front 43

After a recent internal audit, the security administrator was tasked to ensure that all credentials must be changed within 90 days, cannot be repeated, and cannot contain any dictionary words or patterns. All credentials will remain enabled regardless of the number of attempts made. What types of user account options were enforced? (Select TWO).

Back 43

Password expiration
Password complexity

Front 44

In the initial stages of an incident response, Matt, the security administrator, was provided the hard drives in from the incident manager. What incident response procedures would he need to perform in order to begin the analysis? (Select TWO).

Back 44

Take hashes
capture the system image

Front 45

The manager has a need to secure physical documents every night, since the company began enforcing the clean desk policy. The BEST solution would include: (Select TWO).

Back 45

Fire- or water-proof safe
Locking cabinets and drawers

Front 46

Which two algorithms has well documented collisions?

Back 46

MD5
SHA

Front 47

What can use RC4 for encryption? (Select TWO).

Back 47

SSL
WEP

Front 48

What can be used on a smartphone to BEST protect against sensitive data loss if the device is stolen? (Select TWO).

Back 48

Remote wipe
Device Encryption

Front 49

What concepts are included on the three sides of the "security triangle"? (Select THREE).

Back 49

Confidentiality
Availability
Integrity

Front 50

What symmetric key algorithms are examples of block ciphers? (Select THREE).

Back 50

3DES

AES

Blowfish

Front 51

An achievement in providing worldwide Internet security was the signing of certificates associated with which protocols?

Back 51

SSL

Front 52

A Chief Information Security Officer (CISO) wants to implement two-factor authentication within the company. What would fulfill the CISO's requirements?

Back 52

USB token and PIN

Front 53

What can a security administrator implement on mobile devices that will help prevent unwanted people from viewing the data if the device is left unattended?

Back 53

Screen lock

Front 54

What would a security administrator implement in order to identify a problem between two systems that are not communicating properly?

Back 54

Protocol analyzer

Front 55

What can result in significant administrative overhead from incorrect reporting?

Back 55

False positives

Front 56

A security administrator wants to perform routine tests on the network during working hours when certain applications are being accessed by the most people. What would allow the security administrator to test the lack of security controls for those applications with the least impact to the system?

Back 56

Vunlerability test

Front 57

What risk concepts requires an organization to determine the number of failures per year?

Back 57

ALE

Front 58

A system security analyst using an enterprise monitoring tool notices an unknown internal host exfiltrating files to several foreign IP addresses. What would be an appropriate mitigation technique?

Back 58

Rogue machine detection

Front 59

Three of the primary security control types that can be implemented are.

Back 59

Operational, technical, and management

Front 60

The helpdesk reports increased calls from clients reporting spikes in malware infections on their systems.
What phases of incident response is MOST appropriate as a FIRST response?

Back 60

Identification

Front 61

What protocols operates at the HIGHEST level of the OSI model?

Back 61

SCP

Front 62

Joe, the system administrator, has been asked to calculate the Annual Loss Expectancy (ALE) for a $5,000 server, which often crashes. In the past year, the server has crashed 10 times, requiring a system reboot to recover with only 10% loss of data or function. What is the ALE of this server?

Back 62

$5000

Front 63

What should an administrator implement to research current attack methodologies?

Back 63

Honeypot

Front 64

What can be implemented in hardware or software to protect a web server from cross-site scripting attacks?

Back 64

Web application firewall

Front 65

What means of wireless authentication is easily vulnerable to spoofing?

Back 65

MAC filtering

Front 66

Jane, a security administrator, needs to implement a secure wireless authentication method that uses a remote RADIUS server for authentication.
What is an authentication method Jane should use?

Back 66

LEAP

Front 67

Computer evidence at a crime scene is documented with a tag stating who had possession of the evidence at
a given time.
What does this illustrate?

Back 67

Chain of custody

Front 68

A network administrator is configuring access control for the sales department which has high employee turnover. What is BEST suited when assigning user rights to individuals in the sales
department?

Back 68

Group based priveleges

Front 69

What is being tested when a company's payroll server is powered off for eight hours?

Back 69

Continuity of operations plan

Front 70

A security analyst, Ann, is reviewing an IRC channel and notices that a malicious exploit has been created for a frequently used application. She notifies the software vendor and asks them for remediation steps, but is alarmed to find that no patches are available to mitigate this vulnerability.
What BEST describes this exploit?

Back 70

Zero-day

Front 71

A security administrator has concerns about new types of media which allow for the mass distribution of personal comments to a select group of people. To mitigate the risks involved with this media, employees should receive training on what?

Back 71

Social networking

Front 72

A network administrator is responsible for securing applications against external attacks. Every month, the underlying operating system is updated. There is no process in place for other software updates.
What processes could MOST effectively mitigate these risks?

Back 72

Application patch management

Front 73

A software developer is responsible for writing the code on an accounting application. Another software developer is responsible for developing code on a system in human resources. Once a year they have to switch roles for several weeks.
What practices is being implemented?

Back 73

Job rotation

Front 74

A network engineer is designing a secure tunneled VPN. What protocols would be the MOST secure?

Back 74

IPsec

Front 75

What implementation steps would be appropriate for a public wireless hot- spot?

Back 75

Open system authentication

Front 76

What is a step in deploying a WPA2-Enterprise wireless network?

Back 76

Install a digital certificate on the authentication server