Question 1

After patching computers with the latest application security patches/updates; users are unable to open certain applications. Which of the following will correct the issue?

Accepted Answer

A)  Modifying the security policy for patch management tools 
B)  Modifying the security policy for HIDS/HIPS 
C)  Modifying the security policy for DLP 
D)  Modifying the security policy for media control

Question 2

A highly complex password policy has made it nearly impossible to crack account passwords. Which of the following might a hacker still be able to perform?

Accepted Answer

A)  Pass-the-hash attack 
B)  ARP poisoning attack 
C)  Birthday attack 
D)  Brute force attack

Question 3

Which of the following would MOST likely appear in an uncredentialed vulnerability scan?

Accepted Answer

A)  Self-signed certificates 
B)  Missing patches 
C)  Auditing parameters 
D)  Inactive local accounts

Question 4

A security analyst needs a solution that can execute potential malware in a restricted and isolated environment for analysis. In which of the following technologies is the analyst interested?

Accepted Answer

A)  Sandboxing 
B)  Staging 
C)  DMZ 
D)  Honeypot

Question 5

An attacker captures the encrypted communication between two parties for a week, but is unable to decrypt the messages. The attacker then compromises the session key during one exchange and successfully compromises a single message. The attacker plans to use this key to decrypt previously captured and future communications, but is unable to. This is because the encryption scheme in use adheres to:

Accepted Answer

A)  Asymmetric encryption 
B)  Out-of-band key exchange 
C)  Perfect forward secrecy 
D)  Secure key escrow

Question 6

The help desk received a call from a user who was trying to access a set of files from the day before but received the following error message: File format not recognized . Which of the following types of malware MOST likely caused this to occur?

Accepted Answer

A)  Ransomware 
B)  Polymorphic virus 
C)  Rootkit 
D)  Spyware

Question 7

A security analyst is inspecting the results of a recent internal vulnerability scan that was performed against intranet services. The scan reports include the following critical-rated vulnerability: Title: Remote Command Execution vulnerability in web server Rating: Critical (CVSS 10.0) Threat actor: any remote user of the web server Confidence: certain Recommendation: apply vendor patches Which of the following actions should the security analyst perform FIRST?

Accepted Answer

A)  Escalate the issue to senior management. 
B)  Apply organizational context to the risk rating. 
C)  Organize for urgent out-of-cycle patching. 
D)  Exploit the server to check whether it is a false positive.

Question 8

The president of a company that specializes in military contracts receives a request for an interview. During the interview, the reporter seems more interested in discussing the president's family life and personal history than the details of a recent company success. Which of the following security concerns is this MOST likely an example of?

Accepted Answer

A)  Insider threat 
B)  Social engineering 
C)  Passive reconnaissance 
D)  Phishing

Question 9

A home invasion occurred recently in which an intruder compromised a home network and accessed a WiFI- enabled baby monitor while the baby's parents were sleeping. Which of the following BEST describes how the intruder accessed the monitor?

Accepted Answer

A)  Outdated antivirus 
B)  WiFi signal strength 
C)  Social engineering 
D)  Default configuration

Question 10

A security administrator suspects there may be unnecessary services running on a server. Which of the following tools will the administrator MOST likely use to confirm the suspicions?

Accepted Answer

A)  Nmap 
B)  Wireshark 
C)  Autopsy 
D)  DNSEnum

Question 11

A coffee company has hired an IT consultant to set up a WiFi network that will provide Internet access to customers who visit the company's chain of cafés. The coffee company has provided no requirements other than that customers should be granted access after registering via a web form and accepting the terms of service. Which of the following is the MINIMUM acceptable configuration to meet this single requirement?

Accepted Answer

A)  Captive portal 
B)  WPA with PSK 
C)  Open WiFi 
D)  WPS

Question 12

A coding error has been discovered on a customer-facing website. The error causes each request to return confidential PHI data for the incorrect organization. The IT department is unable to identify the specific customers who are affected. As a result, all customers must be notified of the potential breach. Which of the following would allow the team to determine the scope of future incidents?

Accepted Answer

A)  Intrusion detection system 
B)  Database access monitoring 
C)  Application fuzzing 
D)  Monthly vulnerability scans

Question 13

An audit reported has identifies a weakness that could allow unauthorized personnel access to the facility at its main entrance and from there gain access to the network. Which of the following would BEST resolve the vulnerability?

Accepted Answer

A)  Faraday cage 
B)  Air gap 
C)  Mantrap 
D)  Bollards

Question 14

Company XYZ has decided to make use of a cloud-based service that requires mutual, certificate- based authentication with its users. The company uses SSL-inspecting IDS at its network boundary and is concerned about the confidentiality of the mutual authentication. Which of the following model prevents the IDS from capturing credentials used to authenticate users to the new service or keys to decrypt that communication?

Accepted Answer

A)  Use of OATH between the user and the service and attestation from the company domain 
B)  Use of active directory federation between the company and the cloud-based service 
C)  Use of smartcards that store x.509 keys, signed by a global CA 
D)  Use of a third-party, SAML-based authentication service for attestation

Question 15

An attacker uses a network sniffer to capture the packets of a transaction that adds $20 to a gift card. The attacker then user a function of the sniffer to push those packets back onto the network again, adding another $20 to the gift card. This can be done many times. Which of the following describes this type of attack?

Accepted Answer

A)  Integer overflow attack 
B)  Smurf attack 
C)  Replay attack 
D)  Buffer overflow attack 
E)  Cross-site scripting attack

Question 16

Joe, a technician, is working remotely with his company provided laptop at the coffee shop near his home. Joe is concerned that another patron of the coffee shop may be trying to access his laptop. Which of the following is an appropriate control to use to prevent the other patron from accessing Joe's laptop directly?

Accepted Answer

A)  full-disk encryption 
B)  Host-based firewall 
C)  Current antivirus definitions 
D)  Latest OS updates

Question 17

Company A has acquired Company B. Company A has different domains spread globally, and typically migrates its acquisitions infrastructure under its own domain infrastructure. Company B, however, cannot be merged into Company A's domain infrastructure. Which of the following methods would allow the two companies to access one another's resources?

Accepted Answer

A)  Attestation 
B)  Federation 
C)  Single sign-on 
D)  Kerberos

Question 18

A security administrator found the following piece of code referenced on a domain controller's task scheduler: $var = GetDomainAdmins If $var != 'fabio' SetDomainAdmins = NULL With which of the following types of malware is the code associated?

Accepted Answer

A)  RAT 
B)  Backdoor 
C)  Logic bomb 
D)  Crypto-malware

Question 19

Which of the following are the BEST selection criteria to use when assessing hard drive suitability for time-sensitive applications that deal with large amounts of critical information? (Choose two.)

Accepted Answer

A)  MTBF 
B)  MTTR 
C)  SLA 
D)  RTO 
E)  MTTF
F) RPO

Question 20

Which of the following best describes the initial processing phase used in mobile device forensics?

Accepted Answer

A)  The phone should be powered down and the battery removed to preserve the state of data on any internal or removable storage utilized by the mobile device 
B)  The removable data storage cards should be processed first to prevent data alteration when examining the mobile device 
C)  The mobile device should be examined first, then removable storage and lastly the phone without removable storage should be examined again 
D)  The phone and storage cards should be examined as a complete unit after examining the removable storage cards separately.

Exam 15: CompTIA Security+