Question 1

A recent penetration test revealed several issues with a public-facing website used by customers. The testers were able to: Enter long lines of code and special characters Crash the system Gain unauthorized access to the internal application server Map the internal network The development team has stated they will need to rewrite a significant portion of the code used, and it will take more than a year to deliver the finished product. Which of the following would be the BEST solution to introduce in the interim?

Accepted Answer

A)  Content fileting 
B)  WAF 
C)  TLS 
D)  IPS/IDS 
E)  UTM

Question 2

A procedure differs from a policy in that it:

Accepted Answer

A)  is a high-level statement regarding the company's position on a topic. 
B)  sets a minimum expected baseline of behavior. 
C)  provides step-by-step instructions for performing a task. 
D)  describes adverse actions when violations occur.

Question 3

Given the following requirements: Help to ensure non-repudiation Capture motion in various formats Which of the following physical controls BEST matches the above descriptions?

Accepted Answer

A)  Camera 
B)  Mantrap 
C)  Security guard 
D)  Motion sensor

Question 4

Which of the following differentiates a collision attack from a rainbow table attack?

Accepted Answer

A)  A rainbow table attack performs a hash lookup 
B)  A rainbow table attack uses the hash as a password 
C)  In a collision attack, the hash and the input data are equivalent 
D)  In a collision attack, the same input results in different hashes

Question 5

While troubleshooting a client application connecting to the network, the security administrator notices the following error: Certificate is not valid. Which of the following is the BEST way to check if the digital certificate is valid?

Accepted Answer

A)  PKI 
B)  CRL 
C)  CSR 
D)  IPSec

Question 6

A member of the human resources department received the following email message after sending an email containing benefit and tax information to a candidate: "Your message has been quarantined for the following policy violation: external potential_PII. Please contact the IT security administrator for further details". Which of the following BEST describes why this message was received?

Accepted Answer

A)  The DLP system flagged the message. 
B)  The mail gateway prevented the message from being sent to personal email addresses. 
C)  The company firewall blocked the recipient's IP address. 
D)  The file integrity check failed for the attached files.

Question 7

Ann. An employee in the payroll department, has contacted the help desk citing multiple issues with her device, including: Slow performance Word documents, PDFs, and images no longer opening A pop-up Ann states the issues began after she opened an invoice that a vendor emailed to her. Upon opening the invoice, she had to click several security warnings to view it in her word processor. With which of the following is the device MOST likely infected?

Accepted Answer

A)  Spyware 
B)  Crypto-malware 
C)  Rootkit 
D)  Backdoor

Question 8

An organization recently acquired an ISO 27001 certification. Which of the following would MOST likely be considered a benefit of this certification?

Accepted Answer

A)  It allows for the sharing of digital forensics data across organizations. 
B)  It provides insurance in case of a data breach. 
C)  It provides complimentary training and certification resources to IT security staff. 
D)  It certifies the organization can work with foreign entities that require a security clearance. 
E)  It assures customers that the organization meets security standards.

Question 9

The Chief Executive Officer (CEO) of an organization would like staff members to have the flexibility to work from home anytime during business hours, including during a pandemic or crisis. However, the CEO is concerned that some staff members may take advantage of the flexibility and work from high-risk countries while on holiday or outsource work to a third-party organization in another country. The Chief Information Officer (CIO) believes the company can implement some basic controls to mitigate the majority of the risk. Which of the following would be BEST to mitigate the CEO's concerns? (Choose two.)

Accepted Answer

A)  Geolocation 
B)  Time-of-day restrictions 
C)  Certificates 
D)  Tokens 
E)  Geotagging
F) Role-based access controls

Question 10

Which of the following vulnerability types would the type of hacker known as a script kiddie be MOST dangerous against?

Accepted Answer

A)  Passwords written on the bottom of a keyboard 
B)  Unpatched exploitable Internet-facing services 
C)  Unencrypted backup tapes 
D)  Misplaced hardware token

Question 11

Which of the following allows an application to securely authenticate a user by receiving credentials from a web domain?

Accepted Answer

A)  TACACS+ 
B)  RADIUS 
C)  Kerberos 
D)  SAML

Question 12

A vulnerability scanner that uses its running service's access level to better assess vulnerabilities across multiple assets within an organization is performing a:

Accepted Answer

A)  Credentialed scan. 
B)  Non-intrusive scan. 
C)  Privilege escalation test. 
D)  Passive scan.

Question 13

A company is planning to encrypt the files in several sensitive directories of a file server with a symmetric key. Which of the following could be used?

Accepted Answer

A)  RSA 
B)  TwoFish 
C)  Diffie-Helman 
D)  NTLMv2 
E)  RIPEMD

Question 14

Which of the following solutions should an administrator use to reduce the risk from an unknown vulnerability in a third-party software application?

Accepted Answer

A)  Sandboxing 
B)  Encryption 
C)  Code signing 
D)  Fuzzing

Question 15

A security analyst is hardening a server with the directory services role installed. The analyst must ensure LDAP traffic cannot be monitored or sniffed and maintains compatibility with LDAP clients. Which of the following should the analyst implement to meet these requirements? (Select two.)

Accepted Answer

A)  Generate an X.509-compliant certificate that is signed by a trusted CA. 
B)  Install and configure an SSH tunnel on the LDAP server. 
C)  Ensure port 389 is open between the clients and the servers using the communication. 
D)  Ensure port 636 is open between the clients and the servers using the communication. 
E)  Remote the LDAP directory service role from the server.

Question 16

Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?

Accepted Answer

A)  The document is a honeyfile and is meant to attract the attention of a cyberintruder. 
B)  The document is a backup file if the system needs to be recovered. 
C)  The document is a standard file that the OS needs to verify the login credentials. 
D)  The document is a keylogger that stores all keystrokes should the account be compromised.

Question 17

A security analyst runs a monthly file integrity check on the main web server. When analyzing the logs, the analyst observed the following entry:  No OS patches were applied to this server during this period. Considering the log output, which of the following is the BEST conclusion?

Accepted Answer

A)  The cmd.exe was executed on the scanned server between the two dates. An incident ticket should be created. 
B)  The iexplore.exe was executed on the scanned server between the two dates. An incident ticket should be created. 
C)  The cmd.exe was updated on the scanned server. An incident ticket should be created. 
D)  The iexplore.exe was updated on the scanned server. An incident ticket should be created.

Question 18

A security administrator receives notice that a third-party certificate authority has been compromised, and new certificates will need to be issued. Which of the following should the administrator submit to receive a new certificate?

Accepted Answer

A)  CRL 
B)  OSCP 
C)  PFX 
D)  CSR 
E)  CA

Question 19

An organization's internal auditor discovers that large sums of money have recently been paid to a vendor that management does not recognize. The IT security department is asked to investigate the organizations the organization's ERP system to determine how the accounts payable module has been used to make these vendor payments. The IT security department finds the following security configuration for the accounts payable module: New Vendor Entry - Required Role: Accounts Payable Clerk New Vendor Approval - Required Role: Accounts Payable Clerk Vendor Payment Entry - Required Role: Accounts Payable Clerk Vendor Payment Approval - Required Role: Accounts Payable Manager Which of the following changes to the security configuration of the accounts payable module would BEST mitigate the risk?

Accepted Answer

A)   
B)   
C)   
D)

Question 20

A company recently implemented a new security system. In the course of configuration, the security administrator adds the following entry: #Whitelist USB\VID_13FE&PID_4127&REV_0100 Which of the following security technologies is MOST likely being configured?

Accepted Answer

A)  Application whitelisting 
B)  HIDS 
C)  Data execution prevention 
D)  Removable media control

Exam 15: CompTIA Security+