Question 1

Which of the following is the LEAST secure hashing algorithm?

Accepted Answer

A)  SHA1 
B)  RIPEMD 
C)  MD5 
D)  DES

Question 2

An organization's employees currently use three different sets of credentials to access multiple internal resources. Management wants to make this process less complex. Which of the following would be the BEST option to meet this goal?

Accepted Answer

A)  Transitive trust 
B)  Single sign-on 
C)  Federation 
D)  Secure token

Question 3

A small enterprise decides to implement a warm site to be available for business continuity in case of a disaster. Which of the following BEST meets its requirements?

Accepted Answer

A)  A fully operational site that has all the equipment in place and full data backup tapes on site 
B)  A site used for its data backup storage that houses a full-time network administrator 
C)  An operational site requiring some equipment to be relocated as well as data transfer to the site 
D)  A site staffed with personnel requiring both equipment and data to be relocated there in case of disaster.

Question 4

A security administrator is performing a risk assessment on a legacy WAP with a WEP-enabled wireless infrastructure. Which of the following should be implemented to harden the infrastructure without upgrading the WAP?

Accepted Answer

A)  Implement WPA and TKIP 
B)  Implement WPS and an eight-digit pin 
C)  Implement WEP and RC4 
D)  Implement WPA2 Enterprise

Question 5

A director of IR is reviewing a report regarding several recent breaches. The director compiles the following statistic's -Initial IR engagement time frame -Length of time before an executive management notice went out -Average IR phase completion The director wants to use the data to shorten the response time. Which of the following would accomplish this?

Accepted Answer

A)  CSIRT 
B)  Containment phase 
C)  Escalation notifications 
D)  Tabletop exercise

Question 6

A security analyst observes the following events in the logs of an employee workstation:  Given the information provided, which of the following MOST likely occurred on the workstation?

Accepted Answer

A)  Application whitelisting controls blocked an exploit payload from executing. 
B)  Antivirus software found and quarantined three malware files. 
C)  Automatic updates were initiated but failed because they had not been approved. 
D)  The SIEM log agent was not tuned properly and reported a false positive.

Question 7

A help desk is troubleshooting user reports that the corporate website is presenting untrusted certificate errors to employees and customers when they visit the website. Which of the following is the MOST likely cause of this error, provided the certificate has not expired?

Accepted Answer

A)  The certificate was self signed, and the CA was not imported by employees or customers 
B)  The root CA has revoked the certificate of the intermediate CA 
C)  The valid period for the certificate has passed, and a new certificate has not been issued 
D)  The key escrow server has blocked the certificate from being validated

Question 8

A network administrator was concerned during an audit that users were able to use the same passwords the day after a password change policy took effect. The following settings are in place: Users must change their passwords every 30 days. Users cannot reuse the last 10 passwords. Which of the following settings would prevent users from being able to immediately reuse the same passwords?

Accepted Answer

A)  Minimum password age of five days 
B)  Password history of ten passwords 
C)  Password length greater than ten characters 
D)  Complex passwords must be used

Question 9

The SSID broadcast for a wireless router has been disabled but a network administrator notices that unauthorized users are accessing the wireless network. The administer has determined that attackers are still able to detect the presence of the wireless network despite the fact the SSID has been disabled. Which of the following would further obscure the presence of the wireless network?

Accepted Answer

A)  Upgrade the encryption to WPA or WPA2 
B)  Create a non-zero length SSID for the wireless router 
C)  Reroute wireless users to a honeypot 
D)  Disable responses to a broadcast probe request

Question 10

A datacenter engineer wants to ensure an organization's servers have high speed and high redundancy and can sustain the loss of two physical disks in an array. Which of the following RAID configurations should the engineer implement to deliver this functionality?

Accepted Answer

A)  RAID 0 
B)  RAID 1 
C)  RAID 5 
D)  RAID 10 
E)  RAID 50

Question 11

A security engineer is configuring a system that requires the X.509 certificate information to be pasted into a form field in Base64 encoded format to import it into the system. Which of the following certificate formats should the engineer use to obtain the information in the required format?

Accepted Answer

A)  PFX 
B)  PEM 
C)  DER 
D)  CER

Question 12

Which of the following are MOST susceptible to birthday attacks?

Accepted Answer

A)  Hashed passwords 
B)  Digital certificates 
C)  Encryption passwords 
D)  One time passwords

Question 13

A first responder needs to collect digital evidence from a compromised headless virtual host. Which of the following should the first responder collect FIRST?

Accepted Answer

A)  Virtual memory 
B)  BIOS configuration 
C)  Snapshot 
D)  RAM

Question 14

An administrator is configuring access to information located on a network file server named "Bowman". The files are located in a folder named "BalkFiles". The files are only for use by the "Matthews" division and should be read-only. The security policy requires permissions for shares to be managed at the file system layer and also requires those permissions to be set according to a least privilege model. Security policy for this data type also dictates that administrator-level accounts on the system have full access to the files. The administrator configures the file share according to the following table:  Which of the following rows has been misconfigured?

Accepted Answer

A)  Row 1 
B)  Row 2 
C)  Row 3 
D)  Row 4 
E)  Row 5

Question 15

An attachment that was emailed to finance employees contained an embedded message. The security administrator investigates and finds the intent was to conceal the embedded information from public view. Which of the following BEST describes this type of message?

Accepted Answer

A)  Obfuscation 
B)  Steganography 
C)  Diffusion 
D)  BCRYPT

Question 16

A cybersecurity analyst is looking into the payload of a random packet capture file that was selected for analysis. The analyst notices that an internal host had a socket established with another internal host over a non-standard port. Upon investigation, the origin host that initiated the socket shows this output:  Given the above output, which of the following commands would have established the questionable socket?

Accepted Answer

A)  traceroute 8.8.8.8 
B)  ping -1 30 8.8.8.8 -a 600 
C)  nc -1 192.168.5.1 -p 9856 
D)  pskill pid 9487

Question 17

Which of the following scenarios BEST describes an implementation of non-repudiation?

Accepted Answer

A)  A user logs into a domain workstation and access network file shares for another department 
B)  A user remotely logs into the mail server with another user's credentials 
C)  A user sends a digitally signed email to the entire finance department about an upcoming meeting 
D)  A user access the workstation registry to make unauthorized changes to enable functionality within an application

Question 18

A technician is required to configure updates on a guest operating system while maintaining the ability to quickly revert the changes that were made while testing the updates. Which of the following should the technician implement?

Accepted Answer

A)  Snapshots 
B)  Revert to known state 
C)  Rollback to known configuration 
D)  Shadow copy

Question 19

A botnet has hit a popular website with a massive number of GRE-encapsulated packets to perform a DDoS attack. News outlets discover a certain type of refrigerator was exploited and used to send outbound packets to the website that crashed. To which of the following categories does the refrigerator belong?

Accepted Answer

A)  SoC 
B)  ICS 
C)  IoT 
D)  MFD

Question 20

A network administrator is attempting to troubleshoot an issue regarding certificates on a secure website. During the troubleshooting process, the network administrator notices that the web gateway proxy on the local network has signed all of the certificates on the local machine. Which of the following describes the type of attack the proxy has been legitimately programmed to perform?

Accepted Answer

A)  Transitive access 
B)  Spoofing 
C)  Man-in-the-middle 
D)  Replay

Exam 15: CompTIA Security+