Question 1

A security technician is testing a solution that will prevent outside entities from spoofing the company's email domain, which is comptia.org . The testing is successful, and the security technician is prepared to fully implement the solution. Which of the following actions should the technician take to accomplish this task?

Accepted Answer

A)  Add TXT @ "v=spf1 mx include:_spf.comptia.org ?all" to the DNS record. Add TXT @ "v=spf1 mx include:_spf.comptia.org ?all" to the DNS record. 
B)  Add TXT @ "v=spf1 mx include:_spf.comptia.org ?all" to the email server. to the email server. 
C)  Add TXT @ "v=spf1 mx include:_spf.comptia.org +all" to the domain controller. TXT @ "v=spf1 mx include:_spf.comptia.org +all" to the domain controller. 
D)  Add TXT @ "v=spf1 mx include:_spf.comptia.org +all" to the web server. to the web server.

Question 2

A security analyst has received information from a third-party intelligence-sharing resource that indicates employee accounts were breached. Which of the following is the NEXT step the analyst should take to address the issue?

Accepted Answer

A)  Audit access permissions for all employees to ensure least privilege. 
B)  Force a password reset for the impacted employees and revoke any tokens. 
C)  Configure SSO to prevent passwords from going outside the local network. 
D)  Set up privileged access management to ensure auditing is enabled.

Question 3

An incident responder successfully acquired application binaries off a mobile device for later forensic analysis. Which of the following should the analyst do NEXT?

Accepted Answer

A)  Decompile each binary to derive the source code. 
B)  Perform a factory reset on the affected mobile device. 
C)  Compute SHA-256 hashes for each binary. 
D)  Encrypt the binaries using an authenticated AES-256 mode of operation. 
E)  Inspect the permissions manifests within each application.

Question 4

A security analyst needs to reduce the overall attack surface. Which of the following infrastructure changes should the analyst recommend?

Accepted Answer

A)  Implement a honeypot. 
B)  Air gap sensitive systems. 
C)  Increase the network segmentation. 
D)  Implement a cloud-based architecture.

Question 5

A security analyst at a technology solutions firm has uncovered the same vulnerabilities on a vulnerability scan for a long period of time. The vulnerabilities are on systems that are dedicated to the firm's largest client. Which of the following is MOST likely inhibiting the remediation efforts?

Accepted Answer

A)  The parties have an MOU between them that could prevent shutting down the systems 
B)  There is a potential disruption of the vendor-client relationship 
C)  Patches for the vulnerabilities have not been fully tested by the software vendor 
D)  There is an SLA with the client that allows very little downtime

Question 6

A security analyst is required to stay current with the most recent threat data and intelligence reports. When gathering data, it is MOST important for the data to be:

Accepted Answer

A)  proprietary and timely 
B)  proprietary and accurate 
C)  relevant and deep 
D)  relevant and accurate

Question 7

During an incident, a cybersecurity analyst found several entries in the web server logs that are related to an IP with a bad reputation. Which of the following would cause the analyst to further review the incident?

Accepted Answer

A)  BadReputationIp - - [2019-04-12 10:43Z] "GET /etc/passwd" 403 1023 
B)  BadReputationIp - - [2019-04-12 10:43Z] "GET /index.html?src=../.ssh/id_rsa" 401 17044 
C)  BadReputationIp - - [2019-04-12 10:43Z] "GET /a.php?src=/etc/passwd" 403 11056 
D)  BadReputationIp - - [2019-04-12 10:43Z] "GET /a.php?src=../../.ssh/id_rsa" 200 15036 
E)  BadReputationIp - - [2019-04-12 10:43Z] "GET /favicon.ico?src=../usr/share/icons" 200 19064

Question 8

A user's computer has been running slowly when the user tries to access web pages. A security analyst runs the command netstat -aon from the command line and receives the following output:  Which of the following lines indicates the computer may be compromised?

Accepted Answer

A)  Line 1 
B)  Line 2 
C)  Line 3 
D)  Line 4 
E)  Line 5
F) Line 6

Question 9

Massivelog.log has grown to 40GB on a Windows server. At this size, local tools are unable to read the file, and it cannot be moved off the virtual server where it is located. Which of the following lines of PowerShell script will allow a user to extract the last 10,000 lines of the log for review?

Accepted Answer

A)  tail -10000 Massivelog.log > extract.txt 
B)  info tail n -10000 Massivelog.log | extract.txt; 
C)  get content './Massivelog.log' -Last 10000 | extract.txt 
D)  get-content './Massivelog.log' -Last 10000 > extract.txt;

Question 10

Which of the following attacks can be prevented by using output encoding?

Accepted Answer

A)  Server-side request forgery 
B)  Cross-site scripting 
C)  SQL injection 
D)  Command injection 
E)  Cross-site request forgery
F) Directory traversal

Question 11

A security analyst reviews the following aggregated output from an Nmap scan and the border firewall ACL:  Which of the following should the analyst reconfigure to BEST reduce organizational risk while maintaining current functionality?

Accepted Answer

A)  PC1 
B)  PC2 
C)  Server1 
D)  Server2 
E)  Firewall

Question 12

A security analyst is reviewing the logs from an internal chat server. The chat.log file is too large to review manually, so the analyst wants to create a shorter log file that only includes lines associated with a user demonstrating anomalous activity. Below is a snippet of the log:  Which of the following commands would work BEST to achieve the desired result?

Accepted Answer

A)  grep -v chatter14 chat.log 
B)  grep -i pythonfun chat.log 
C)  grep -i javashark chat.log 
D)  grep -v javashark chat.log 
E)  grep -v pythonfun chat.log
F) grep -i chatter14 chat.log

Question 13

The inability to do remote updates of certificates, keys, software, and firmware is a security issue commonly associated with:

Accepted Answer

A)  web servers on private networks 
B)  HVAC control systems 
C)  smartphones 
D)  firewalls and UTM devices

Question 14

A forensic analyst took an image of a workstation that was involved in an incident. To BEST ensure the image is not tampered with, the analyst should use:

Accepted Answer

A)  hashing 
B)  backup tapes 
C)  a legal hold 
D)  chain of custody

Question 15

A security analyst is reviewing packet captures from a system that was compromised. The system was already isolated from the network, but it did have network access for a few hours after being compromised. When viewing the capture in a packet analyzer, the analyst sees the following:  Which of the following can the analyst conclude?

Accepted Answer

A)  Malware is attempting to beacon to 128.50.100.3. 
B)  The system is running a DoS attack against ajgidwle.com. 
C)  The system is scanning ajgidwle.com for PII. 
D)  Data is being exfiltrated over DNS.

Question 16

A security is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS. Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise?

Accepted Answer

A)  Run an anti-malware scan on the system to detect and eradicate the current threat 
B)  Start a network capture on the system to look into the DNS requests to validate command and control traffic 
C)  Shut down the system to prevent further degradation of the company network 
D)  Reimage the machine to remove the threat completely and get back to a normal running state 
E)  Isolate the system on the network to ensure it cannot access other systems while evaluation is underway

Question 17

An organization that handles sensitive financial information wants to perform tokenization of data to enable the execution of recurring transactions. The organization is most interested in a secure, built-in device to support its solution. Which of the following would MOST likely be required to perform the desired function?

Accepted Answer

A)  TPM 
B)  eFuse 
C)  FPGA 
D)  HSM 
E)  UEFI

Question 18

A large software company wants to move its source control and deployment pipelines into a cloud-computing environment. Due to the nature of the business, management determines the recovery time objective needs to be within one hour. Which of the following strategies would put the company in the BEST position to achieve the desired recovery time?

Accepted Answer

A)  Establish an alternate site with active replication to other regions 
B)  Configure a duplicate environment in the same region and load balance between both instances 
C)  Set up every cloud component with duplicated copies and auto-scaling turned on 
D)  Create a duplicate copy on premises that can be used for failover in a disaster situation

Question 19

Which of the following will allow different cloud instances to share various types of data with a minimal amount of complexity?

Accepted Answer

A)  Reverse engineering 
B)  Application log collectors 
C)  Workflow orchestration 
D)  API integration 
E)  Scripting

Question 20

An organization has not had an incident for several months. The Chief Information Security Officer (CISO) wants to move to a more proactive stance for security investigations. Which of the following would BEST meet that goal?

Accepted Answer

A)  Root-cause analysis 
B)  Active response 
C)  Advanced antivirus 
D)  Information-sharing community 
E)  Threat hunting

Exam 5: CompTIA Cloud Essentials+