Question 1

An organization needs to implement a large PKI. Network engineers are concerned that repeated transmission of the OCSP will impact network performance. Which of the following should the security analyst recommend is lieu of an OCSP?

Accepted Answer

A)  CSR 
B)  CRL 
C)  CA 
D)  OID

Question 2

A security analyst believes an employee's workstation has been compromised. The analyst reviews the system logs, but does not find any attempted logins. The analyst then runs the diff command, comparing the C:\Windows\System32 directory and the installed cache directory. The analyst finds a series of files that look suspicious. One of the files contains the following commands:  Which of the following types of malware was used?

Accepted Answer

A)  Worm 
B)  Spyware 
C)  Logic bomb 
D)  Backdoor

Question 3

A member of the human resources department is searching for candidate resumes and encounters the following error message when attempting to access popular job search websites:  Which of the following would resolve this issue without compromising the company's security policies?

Accepted Answer

A)  Renew the DNS settings and IP address on the employee's computer 
B)  Add the employee to a less restrictive group on the content filter 
C)  Remove the proxy settings from the employee's web browser 
D)  Create an exception for the job search sites in the host-based firewall on the employee's computer

Question 4

Given the output:  Which of the following account management practices should the security engineer use to mitigate the identified risk?

Accepted Answer

A)  Implement least privilege 
B)  Eliminate shared accounts. 
C)  Eliminate password reuse. 
D)  Implement two-factor authentication

Question 5

The security administrator has noticed cars parking just outside of the building fence line. Which of the following security measures can the administrator use to help protect the company's WiFi network against war driving? (Choose two.)

Accepted Answer

A)  Create a honeynet 
B)  Reduce beacon rate 
C)  Add false SSIDs 
D)  Change antenna placement 
E)  Adjust power level controls
F) Implement a warning banner

Question 6

During an application design, the development team specifics a LDAP module for single sign-on communication with the company's access control database. This is an example of which of the following?

Accepted Answer

A)  Application control 
B)  Data in-transit 
C)  Identification 
D)  Authentication

Question 7

A security administrator suspects that a DDoS attack is affecting the DNS server. The administrator accesses a workstation with the hostname of workstation01 on the network and obtains the following output from the ipconfig command:  The administrator successfully pings the DNS server from the workstation. Which of the following commands should be issued from the workstation to verify the DDoS attack is no longer occuring?

Accepted Answer

A)  dig www.google.com 
B)  dig 192.168.1.254 
C)  dig workstation01.com 
D)  dig 192.168.1.26

Question 8

While working on an incident, Joe, a technician, finished restoring the OS and applications on a workstation from the original media. Joe is about to begin copying the user's files back onto the hard drive. Which of the following incident response steps is Joe working on now?

Accepted Answer

A)  Recovery 
B)  Eradication 
C)  Containment 
D)  Identification

Question 9

A company has a security policy that specifies all endpoint computing devices should be assigned a unique identifier that can be tracked via an inventory management system. Recent changes to airline security regulations have cause many executives in the company to travel with mini tablet devices instead of laptops. These tablet devices are difficult to tag and track. An RDP application is used from the tablet to connect into the company network. Which of the following should be implemented in order to meet the security policy requirements?

Accepted Answer

A)  Virtual desktop infrastructure (IDI) 
B)  WS-security and geo-fencing 
C)  A hardware security module (HSM) 
D)  RFID tagging system 
E)  MDM software
F) Security Requirements Traceability Matrix (SRTM)

Question 10

If two employees are encrypting traffic between them using a single encryption key, which of the following agorithms are they using?

Accepted Answer

A)  RSA 
B)  3DES 
C)  DSA 
D)  SHA-2

Question 11

A security researcher is tracking an adversary by noting its attacks and techniques based on its capabilities, infrastructure, and victims. Which of the following is the researcher MOST likely using?

Accepted Answer

A)  The Diamond Model of Intrusion Analysis 
B)  The Cyber Kill Chain 
C)  The MITRE CVE database 
D)  The incident response process

Question 12

Which of the following is a reason why an organization would define an AUP?

Accepted Answer

A)  To define the lowest level of privileges needed for access and use of the organization's resources 
B)  To define the set of rules and behaviors for users of the organization's IT systems 
C)  To define the intended partnership between two organizations 
D)  To define the availability and reliability characteristics between an IT provider and consumer

Question 13

A security consultant was asked to revise the security baselines that are utilized by a large organization. Although the company provides different platforms for its staff, including desktops, laptops, and mobile devices, the applications do not vary by platform. Which of the following should the consultant recommend? (Choose two.)

Accepted Answer

A)  Apply patch management on a daily basis. 
B)  Allow full functionality for all applications that are accessed remotely. 
C)  Apply default configurations of all operating systems. 
D)  Apply application whitelisting. 
E)  Disable default accounts and/or passwords.

Question 14

A security analyst is doing a vulnerability assessment on a database server. A scanning tool returns the following information:  There have been several security breaches on the web server that accesses this database. The security team is instructed to mitigate the impact of any possible breaches. The security team is also instructed to improve the security on this database by making it less vulnerable to offline attacks. Which of the following would BEST accomplish these goals? (Choose two.)

Accepted Answer

A)  Start using salts to generate MD5 password hashes 
B)  Generate password hashes using SHA-256 
C)  Force users to change passwords the next time they log on 
D)  Limit users to five attempted logons before they are locked out 
E)  Require the web server to only use TLS 1.2 encryption

Question 15

A security analyst has received several reports of an issue on an internal web application. Users state they are having to provide their credentials twice to log in. The analyst checks with the application team and notes this is not an expected behavior. After looking at several logs, the analyst decides to run some commands on the gateway and obtains the following output:  Which of the following BEST describes the attack the company is experiencing?

Accepted Answer

A)  MAC flooding 
B)  URL redirection 
C)  ARP poisoning 
D)  DNS hijacking

Question 16

A company has a data system with definitions for "Private" and "Public". The company's security policy outlines how data should be protected based on type. The company recently added the data type "Proprietary". Which of the following is the MOST likely reason the company added this data type?

Accepted Answer

A)  Reduced cost 
B)  More searchable data 
C)  Better data classification 
D)  Expanded authority of the privacy officer

Question 17

An organization finds that most help desk calls are regarding account lockout due to a variety of applications running on different systems. Management is looking for a solution to reduce the number of account lockouts while improving security. Which of the following is the BEST solution for this organization?

Accepted Answer

A)  Create multiple application accounts for each user. 
B)  Provide secure tokens. 
C)  Implement SSO. 
D)  Utilize role-based access control.

Question 18

Which of the following is commonly used for federated identity management across multiple organizations?

Accepted Answer

A)  SAML 
B)  Active Directory 
C)  Kerberos 
D)  LDAP

Question 19

When a malicious user is able to retrieve sensitive information from RAM, the programmer has failed to implement:

Accepted Answer

A)  session keys. 
B)  encryption of data at rest. 
C)  encryption of data in use. 
D)  ephemeral keys.

Question 20

A systems administrator is implementing a remote access method for the system that will utilize GUI. Which of the following protocols would be BEST suited for this?

Accepted Answer

A)  TLS 
B)  SSH 
C)  SFP 
D)  SRTP

Exam 15: CompTIA Security+