Question 1

A security engineer is analyzing the following line of JavaScript code that was found in a comment field on a web forum, which was recently involved in a security breach: Given the line of code above, which of the following BEST represents the attack performed during the breach?

Accepted Answer

A)  CSRF 
B)  DDoS 
C)  DoS 
D)  XSS

Question 2

A security administrator is reviewing the following network capture:  Which of the following malware is MOST likely to generate the above information?

Accepted Answer

A)  Keylogger 
B)  Ransomware 
C)  Logic bomb 
D)  Adware

Question 3

A network administrator wants to ensure that users do not connect any unauthorized devices to the company network. Each desk needs to connect a VoIP phone and computer. Which of the following is the BEST way to accomplish this?

Accepted Answer

A)  Enforce authentication for network devices 
B)  Configure the phones on one VLAN, and computers on another 
C)  Enable and configure port channels 
D)  Make users sign an Acceptable use Agreement

Question 4

A security operations team recently detected a breach of credentials. The team mitigated the risk and followed proper processes to reduce risk. Which of the following processes would BEST help prevent this issue from happening again?

Accepted Answer

A)  Risk assessment 
B)  Chain of custody 
C)  Lessons learned 
D)  Penetration test

Question 5

An organization has implemented a two-step verification process to protect user access to data that is stored in the cloud. Each employee now uses an email address or mobile number to receive a code to access the data. Which of the following authentication methods did the organization implement?

Accepted Answer

A)  Token key 
B)  Static code 
C)  Push notification 
D)  HOTP

Question 6

A company is developing a new system that will unlock a computer automatically when an authorized user sits in front of it, and then lock the computer when the user leaves. The user does not have to perform any action for this process to occur. Which of the following technologies provides this capability?

Accepted Answer

A)  Facial recognition 
B)  Fingerprint scanner 
C)  Motion detector 
D)  Smart cards

Question 7

A security technician has been given the task of preserving emails that are potentially involved in a dispute between a company and a contractor. Which of the following BEST describes this forensic concept?

Accepted Answer

A)  Legal hold 
B)  Chain of custody 
C)  Order of volatility 
D)  Data acquisition

Question 8

Which of the following BEST describes the purpose of authorization?

Accepted Answer

A)  Authorization provides logging to a resource and comes after authentication. 
B)  Authorization provides authentication to a resource and comes after identification. 
C)  Authorization provides identification to a resource and comes after authentication. 
D)  Authorization provides permissions to a resource and comes after authentication.

Question 9

An auditor is reviewing the following output from a password-cracking tool:  Which of the following methods did the auditor MOST likely use?

Accepted Answer

A)  Hybrid 
B)  Dictionary 
C)  Brute force 
D)  Rainbow table

Question 10

A technician must configure a firewall to block external DNS traffic from entering a network. Which of the following ports should they block on the firewall?

Accepted Answer

A)  53 
B)  110 
C)  143 
D)  443

Question 11

A user typically works remotely over the holidays using a web-based VPN to access corporate resources. The user reports getting untrusted host errors and being unable to connect. Which of the following is MOST likely the cause?

Accepted Answer

A)  The certificate has expired 
B)  The browser does not support SSL 
C)  The user's account is locked out 
D)  The VPN software has reached the seat license maximum

Question 12

While reviewing the monthly internet usage it is noted that there is a large spike in traffic classified as "unknown" and does not appear to be within the bounds of the organizations Acceptable Use Policy. Which of the following tool or technology would work BEST for obtaining more information on this traffic?

Accepted Answer

A)  Firewall logs 
B)  IDS logs 
C)  Increased spam filtering 
D)  Protocol analyzer

Question 13

A security analyst is implementing mobile device security for a company. To save money, management has decided on a BYOD model. The company is most concerned with ensuring company data will not be exposed if a phone is lost or stolen. Which of the following techniques BEST accomplish this goal? (Choose two.)

Accepted Answer

A)  Containerization 
B)  Full device encryption 
C)  Geofencing 
D)  Remote wipe 
E)  Application management
F) Storage segmentation

Question 14

A security professional wants to test a piece of malware that was isolated on a user's computer to document its effect on a system. Which of the following is the FIRST step the security professional should take?

Accepted Answer

A)  Create a sandbox on the machine. 
B)  Open the file and run it. 
C)  Create a secure baseline of the system state. 
D)  Harden the machine.

Question 15

A security analyst is diagnosing an incident in which a system was compromised from an external IP address. The socket identified on the firewall was traced to 207.46.130.0:6666. Which of the following should the security analyst do to determine if the compromised system still has an active connection?

Accepted Answer

A)  tracert 
B)  netstat 
C)  ping 
D)  nslookup

Question 16

An incident involving a workstation that is potentially infected with a virus has occurred. The workstation may have sent confidential data to an unknown internet server. Which of the following should a security analyst do FIRST?

Accepted Answer

A)  Make a copy of everything in memory on the workstation. 
B)  Turn off the workstation. 
C)  Consult information security policy. 
D)  Run a virus scan.

Question 17

After attempting to harden a web server, a security analyst needs to determine if an application remains vulnerable to SQL injection attacks. Which of the following would BEST assist the analyst in making this determination?

Accepted Answer

A)  tracert 
B)  Fuzzer 
C)  nslookup 
D)  Nmap 
E)  netcat

Question 18

A security program manager wants to actively test the security posture of a system.  The system is not yet in production and has no uptime requirement or active user base. Which of the following methods will produce a report which shows vulnerabilities that were actually exploited?

Accepted Answer

A)  Peer review 
B)  Component testing 
C)  Penetration testing 
D)  Vulnerability testing

Question 19

A security administrator has replaced the firewall and notices a number of dropped connections. After looking at the data the security administrator sees the following information that was flagged as a possible issue:  Which of the following can the security administrator determine from this?

Accepted Answer

A)  An SQL injection attack is being attempted 
B)  Legitimate connections are being dropped 
C)  A network scan is being done on the system 
D)  An XSS attack is being attempted

Question 20

Before an infection was detected, several of the infected devices attempted to access a URL that was similar to the company name but with two letters transported. Which of the following BEST describes the attack vector used to infect the devices?

Accepted Answer

A)  Cross-site scripting 
B)  DNS poisoning 
C)  Typo squatting 
D)  URL hijacking

Exam 15: CompTIA Security+

A security administrator is reviewing the following network capture: Which of the following malware is MOST likely to generate the above information?