Question 1

The Chief Information Officer (CIO) has decided to add two-factor authentication along with the use of passwords when logging on to the network. Which of the following should be implemented to BEST accomplish this requirement?

Accepted Answer

A)  Require users to enter a PIN 
B)  Require users to set complex passwords 
C)  Require users to insert a smart card when logging on 
D)  Require the system to use a CAPTCHA

Question 2

The process of applying a salt and cryptographic hash to a password then repeating the process many times is known as which of the following?

Accepted Answer

A)  Collision resistance 
B)  Rainbow table 
C)  Key stretching 
D)  Brute force attack

Question 3

A systems administrator is installing and configuring an application service that requires access to read and write to log and configuration files on a local hard disk partition. The service must run as an account with authorization to interact with the file system. Which of the following would reduce the attack surface added by the service and account? (Choose two.)

Accepted Answer

A)  Use a unique managed service account. 
B)  Utilize a generic password for authenticating. 
C)  Enable and review account audit logs. 
D)  Enforce least possible privileges for the account. 
E)  Add the account to the local administrators group.
F) Use a guest account placed in a non-privileged users group.

Question 4

Joe, a user, has been trying to send Ann, a different user, an encrypted document via email. Ann has not received the attachment but is able to receive the header information. Which of the following is MOST likely preventing Ann from receiving the encrypted file?

Accepted Answer

A)  Unencrypted credentials 
B)  Authentication issues 
C)  Weak cipher suite 
D)  Permission issues

Question 5

A security consultant discovers that an organization is using the PCL protocol to print documents, utilizing the default driver and print settings. Which of the following is the MOST likely risk in this situation?

Accepted Answer

A)  An attacker can access and change the printer configuration. 
B)  SNMP data leaving the printer will not be properly encrypted. 
C)  An MITM attack can reveal sensitive information. 
D)  An attacker can easily inject malicious code into the printer firmware. 
E)  Attackers can use the PCL protocol to bypass the firewall of client computers.

Question 6

When backing up a database server to LTO tape drives, the following backup schedule is used. Backups take one hour to complete:  On Friday at 9:00 p.m., there is a RAID failure on the database server. The data must be restored from backup. Which of the following is the number of backup tapes that will be needed to complete this operation?

Accepted Answer

A)  1 
B)  2 
C)  3 
D)  4 
E)  6

Question 7

A company is planning to build an internal website that allows for access to outside contracts and partners. A majority of the content will only be available to internal employees with the option to share. Which of the following concepts is MOST appropriate?

Accepted Answer

A)  VPN 
B)  Proxy 
C)  DMZ 
D)  Extranet

Question 8

Which of the following is a benefit of credentialed vulnerability scans?

Accepted Answer

A)  Credentials provide access to scan documents to identify possible data theft. 
B)  The vulnerability scanner is able to inventory software on the target. 
C)  A scan will reveal data loss in real time. 
D)  Black-box testing can be performed.

Question 9

A developer is creating a new web application on a public cloud platform and wants to ensure the application can respond to increases in load while minimizing costs during periods of low usage. Which of the following strategies is MOST relevant to the use-case?

Accepted Answer

A)  Elasticity 
B)  Redundancy 
C)  High availability 
D)  Non-persistence

Question 10

A tester was able to leverage a pass-the-hash attack during a recent penetration test. The tester gained a foothold and moved laterally through the network. Which of the following would prevent this type of attack from reoccurring?

Accepted Answer

A)  Renaming all active service accounts and disabling all inactive service accounts 
B)  Creating separate accounts for privileged access that are not used to log on to local machines 
C)  Enabling full-disk encryption on all workstations that are used by administrators and disabling RDP 
D)  Increasing the password complexity requirements and setting account expiration dates

Question 11

A security administrator is investigating a report that a user is receiving suspicious emails. The user's machine has an old functioning modem installed. Which of the following security concerns need to be identified and mitigated? (Choose two.)

Accepted Answer

A)  Vishing 
B)  Whaling 
C)  Spear phishing 
D)  Pharming 
E)  War dialing
F) Hoaxing

Question 12

A security analyst captures forensic evidence from a potentially compromised system for further investigation. The evidence is documented and securely stored to FIRST:

Accepted Answer

A)  maintain the chain of custody. 
B)  preserve the data. 
C)  obtain a legal hold. 
D)  recover data at a later time.

Question 13

After deploying an antivirus solution on some network-isolated industrial computers, the service desk team received a trouble ticket about the following message being displayed on the computers' screens: Your AV protection has blocked an unknown application while performing suspicious activities. The application was put in quarantine. Which of the following would be the SAFEST next step to address the issue?

Accepted Answer

A)  Immediately delete the detected file from the quarantine to secure the environment and clear the alert from the antivirus console. 
B)  Perform a manual antivirus signature update directly from the antivirus vendor's cloud. 
C)  Centrally activate a full scan for the entire set of industrial computers, looking for new threats. 
D)  Check the antivirus vendor's documentation about the security modules, incompatibilities, and software whitelisting.

Question 14

Joe, a user at a company, clicked an email link that led to a website that infected his workstation. Joe was connected to the network, and the virus spread to the network shares. The protective measures failed to stop this virus, and it has continued to evade detection. Which of the following should a security administrator implement to protect the environment from this malware?

Accepted Answer

A)  Install a definition-based antivirus. 
B)  Implement an IDS/IPS. 
C)  Implement a heuristic behavior-detection solution. 
D)  Implement CASB to protect the network shares.

Question 15

A network administrator adds an ACL to allow only HTTPS connections form host 192.168.2.3 to web server 192.168.5.2. After applying the rule, the host is unable to access the server. The network administrator runs the output and notices the configuration below:  Which of the following rules would be BEST to resolve the issue?

Accepted Answer

A)   
B)   
C)   
D)

Question 16

Which of the following are the MAIN reasons why a systems administrator would install security patches in a staging environment before the patches are applied to the production server? (Select two.)

Accepted Answer

A)  To prevent server availability issues 
B)  To verify the appropriate patch is being installed 
C)  To generate a new baseline hash after patching 
D)  To allow users to test functionality 
E)  To ensure users are trained on new functionality

Question 17

A network operations manager has added a second row of server racks in the datacenter. These racks face the opposite direction of the first row of racks. Which of the following is the reason the manager installed the racks this way?

Accepted Answer

A)  To lower energy consumption by sharing power outlets 
B)  To create environmental hot and cold isles 
C)  To eliminate the potential for electromagnetic interference 
D)  To maximize fire suppression capabilities

Question 18

An attacker compromises a public CA and issues unauthorized X.509 certificates for Company.com. In the future, Company.com wants to mitigate the impact of similar incidents. Which of the following would assist Company.com with its goal?

Accepted Answer

A)  Certificate pinning 
B)  Certificate stapling 
C)  Certificate chaining 
D)  Certificate with extended validation

Question 19

An information security specialist is reviewing the following output from a Linux server.  Based on the above information, which of the following types of malware was installed on the server?

Accepted Answer

A)  Logic bomb 
B)  Trojan 
C)  Backdoor 
D)  Ransomware 
E)  Rootkit

Question 20

During an incident, a company's CIRT determines it is necessary to observe the continued network-based transactions between a callback domain and the malware running on an enterprise PC. Which of the following techniques would be BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any changes?

Accepted Answer

A)  Physically move the PC to a separate Internet point of presence. 
B)  Create and apply microsegmentation rules. 
C)  Emulate the malware in a heavily monitored DMZ segment. 
D)  Apply network blacklisting rules for the adversary domain.

Exam 15: CompTIA Security+