Question 1

A CSIRT has completed restoration procedures related to a breach of sensitive data is creating documentation used to improve the organization's security posture. The team has been specifically tasked to address logical controls in their suggestions. Which of the following would be MOST beneficial to include in lessons learned documentation? (Choose two.)

Accepted Answer

A)  A list of policies, which should be revised to provide better clarity to employees regarding acceptable use 
B)  Recommendations relating to improved log correlation and alerting tools 
C)  Data from the organization's IDS/IPS tools, which show the timeline of the breach and the activities executed by the attacker 
D)  A list of potential improvements to the organization's NAC capabilities, which would improve AAA within the environment 
E)  A summary of the activities performed during each phase of the incident response activity
F) A list of topics that should be added to the organization's security awareness training program based on weaknesses exploited during the attack

Question 2

Which of the following precautions MINIMIZES the risk from network attacks directed at multifunction printers, as well as the impact on functionality at the same time?

Accepted Answer

A)  Isolating the systems using VLANs 
B)  Installing a software-based IPS on all devices 
C)  Enabling full disk encryption 
D)  Implementing a unique user PIN access functions

Question 3

During a recent audit, it was discovered that several user accounts belonging to former employees were still active and had valid VPN permissions. Which of the following would help reduce the amount of risk the organization incurs in this situation in the future?

Accepted Answer

A)  Time-of-day restrictions 
B)  User access reviews 
C)  Group-based privileges 
D)  Change management policies

Question 4

An intruder sniffs network traffic and captures a packet of internal network transactions that add funds to a game card. The intruder pushes the same packet multiple times across the network, which increments the funds on the game card. Which of the following should a security administrator implement to BEST protect against this type of attack?

Accepted Answer

A)  An IPS 
B)  A WAF 
C)  SSH 
D)  An IPSec VPN

Question 5

A security administrator is creating a subnet on one of the corporate firewall interfaces to use as a DMZ which is expected to accommodate at most 14 physical hosts. Which of the following subnets would BEST meet the requirements?

Accepted Answer

A)  192.168.0.16 255.25.255.248 
B)  192.168.0.16/28 
C)  192.168.1.50 255.255.25.240 
D)  192.168.2.32/27

Question 6

A security analyst is hardening a server with the directory services role installed. The analyst must ensure LDAP traffic cannot be monitored or sniffed and maintains compatibility with LDAP clients. Which of the following should the analyst implement to meet these requirements? (Choose two.)

Accepted Answer

A)  Generate an X.509-compliant certificate that is signed by a trusted CA. 
B)  Install and configure an SSH tunnel on the LDAP server. 
C)  Ensure port 389 is open between the clients and the servers using the communication. 
D)  Ensure port 636 is open between the clients and the servers using the communication. 
E)  Remote the LDAP directory service role from the server.

Question 7

A system's administrator has finished configuring firewall ACL to allow access to a new web server.  The security administrator confirms form the following packet capture that there is network traffic from the internet to the web server:  The company's internal auditor issues a security finding and requests that immediate action be taken. With which of the following is the auditor MOST concerned?

Accepted Answer

A)  Misconfigured firewall 
B)  Clear text credentials 
C)  Implicit deny 
D)  Default configuration

Question 8

A network administrator wants to implement a method of securing internal routing. Which of the following should the administrator implement?

Accepted Answer

A)  DMZ 
B)  NAT 
C)  VPN 
D)  PAT

Question 9

A company has had a BYOD policy in place for many years and now wants to roll out an MDM solution. The company has decided that end users who wish to utilize their personal devices for corporate use must opt in to the MDM solution. End users are voicing concerns about the company having access to their personal devices via the MDM solution. Which of the following should the company implement to ease these concerns?

Accepted Answer

A)  Sideloading 
B)  Full device encryption 
C)  Application management 
D)  Containerization

Question 10

An organization has hired a penetration tester to test the security of its ten web servers. The penetration tester is able to gain root/administrative access in several servers by exploiting vulnerabilities associated with the implementation of SMTP, POP, DNS, FTP, Telnet, and IMAP. Which of the following recommendations should the penetration tester provide to the organization to better protect their web servers in the future?

Accepted Answer

A)  Use a honeypot 
B)  Disable unnecessary services 
C)  Implement transport layer security 
D)  Increase application event logging

Question 11

A company has just experienced a malware attack affecting a large number of desktop users. The antivirus solution was not able to block the malware, but the HIDS alerted to C2 calls as 'Troj.Generic' . Once the security team found a solution to remove the malware, they were able to remove the malware files successfully, and the HIDS stopped alerting. The next morning, however, the HIDS once again started alerting on the same desktops, and the security team discovered the files were back. Which of the following BEST describes the type of malware infecting this company's network?

Accepted Answer

A)  Trojan 
B)  Spyware 
C)  Rootkit 
D)  Botnet

Question 12

A technician is configuring a load balancer for the application team to accelerate the network performance of their applications. The applications are hosted on multiple servers and must be redundant. Given this scenario, which of the following would be the BEST method of configuring the load balancer?

Accepted Answer

A)  Round-robin 
B)  Weighted 
C)  Least connection 
D)  Locality-based

Question 13

A pass-the-hash attack is commonly used to:

Accepted Answer

A)  modify DNS records to point to a different domain. 
B)  modify the IP address of the targeted computer. 
C)  execute java script to capture user credentials. 
D)  laterally move across the network.

Question 14

When sending messages using symmetric encryption, which of the following must happen FIRST?

Accepted Answer

A)  Exchange encryption key 
B)  Establish digital signatures 
C)  Agree on an encryption method 
D)  Install digital certificates

Question 15

An organization wants to upgrade its enterprise-wide desktop computer solution. The organization currently has 500 PCs active on the network. The Chief Information Security Officer (CISO) suggests that the organization employ desktop imaging technology for such a large-scale upgrade. Which of the following is a security benefit of implementing an imaging solution?

Accepted Answer

A)  It allows for faster deployment. 
B)  It provides a consistent baseline. 
C)  It reduces the number of vulnerabilities. 
D)  It decreases the boot time.

Question 16

Which of the following BEST describes a security exploit for which a vendor patch is not readily available?

Accepted Answer

A)  Integer overflow 
B)  Zero-day 
C)  End of life 
D)  Race condition

Question 17

After a breach, a company has decided to implement a solution to better understand the technique used by the attackers. Which of the following is the BEST solution to be deployed?

Accepted Answer

A)  Network analyzer 
B)  Protocol analyzer 
C)  Honeypot network 
D)  Configuration compliance scanner

Question 18

Company policy requires the use if passphrases instead if passwords. Which of the following technical controls MUST be in place in order to promote the use of passphrases?

Accepted Answer

A)  Reuse 
B)  Length 
C)  History 
D)  Complexity

Question 19

The computer resource center issued smartphones to all first-level and above managers. The managers have the ability to install mobile tools. Which of the following tools should be implemented to control the types of tools the managers install?

Accepted Answer

A)  Download manager 
B)  Content manager 
C)  Segmentation manager 
D)  Application manager

Question 20

The Chief Information Security Officer (CISO) in a company is working to maximize protection efforts of sensitive corporate data. The CISO implements a "100% shred" policy within the organization, with the intent to destroy any documentation that is not actively in use in a way that it cannot be recovered or reassembled. Which of the following attacks is this deterrent MOST likely to mitigate?

Accepted Answer

A)  Dumpster diving 
B)  Whaling 
C)  Shoulder surfing 
D)  Vishing

Exam 15: CompTIA Security+