Question 1

An organization has several production-critical SCADA supervisory systems that cannot follow the normal 30- day patching policy. Which of the following BEST maximizes the protection of these systems from malicious software?

Accepted Answer

A)  Configure a firewall with deep packet inspection that restricts traffic to the systems. 
B)  Configure a separate zone for the systems and restrict access to known ports. 
C)  Configure the systems to ensure only necessary applications are able to run. 
D)  Configure the host firewall to ensure only the necessary applications have listening ports

Question 2

Users are attempting to access a company's website but are transparently redirected to another websites. The users confirm the URL is correct. Which of the following would BEST prevent this issue in the future?

Accepted Answer

A)  DNSSEC 
B)  HTTPS 
C)  IPSec 
D)  TLS/SSL

Question 3

A systems administrator is deploying a new mission essential server into a virtual environment. Which of the following is BEST mitigated by the environment's rapid elasticity characteristic?

Accepted Answer

A)  Data confidentiality breaches 
B)  VM escape attacks 
C)  Lack of redundancy 
D)  Denial of service

Question 4

An organization uses SSO authentication for employee access to network resources. When an employee resigns, as per the organization's security policy, the employee's access to all network resources is terminated immediately. Two weeks later, the former employee sends an email to the help desk for a password reset to access payroll information from the human resources server. Which of the following represents the BEST course of action?

Accepted Answer

A)  Approve the former employee's request, as a password reset would give the former employee access to only the human resources server. 
B)  Deny the former employee's request, since the password reset request came from an external email address. 
C)  Deny the former employee's request, as a password reset would give the employee access to all network resources. 
D)  Approve the former employee's request, as there would not be a security issue with the former employee gaining access to network.

Question 5

Which of the following is a major difference between XSS attacks and remote code exploits?

Accepted Answer

A)  XSS attacks use machine language, while remote exploits use interpreted language 
B)  XSS attacks target servers, while remote code exploits target clients 
C)  Remote code exploits aim to escalate attackers' privileges, while XSS attacks aim to gain access only 
D)  Remote code exploits allow writing code at the client side and executing it, while XSS attacks require no code to work

Question 6

Which of the following differentiates ARP poisoning from a MAC spoofing attack?

Accepted Answer

A)  ARP poisoning uses unsolicited ARP replies. 
B)  ARP poisoning overflows a switch's CAM table. 
C)  MAC spoofing uses DHCPOFFER/DHCPACK packets. 
D)  MAC spoofing can be performed across multiple routers.

Question 7

Which of the following attack types is being carried out where a target is being sent unsolicited messages via Bluetooth?

Accepted Answer

A)  War chalking 
B)  Bluejacking 
C)  Bluesnarfing 
D)  Rogue tethering

Question 8

A security auditor is putting together a report for the Chief Executive Officer (CEO) on personnel security and its impact on the security posture of the whole organization. Which of the following would be the MOST important factor to consider when it comes to personnel security?

Accepted Answer

A)  Insider threats 
B)  Privilege escalation 
C)  Hacktivist 
D)  Phishing through social media 
E)  Corporate espionage

Question 9

An audit takes place after company-wide restricting, in which several employees changed roles. The following deficiencies are found during the audit regarding access to confidential data:  Which of the following would be the BEST method to prevent similar audit findings in the future?

Accepted Answer

A)  Implement separation of duties for the payroll department. 
B)  Implement a DLP solution on the payroll and human resources servers. 
C)  Implement rule-based access controls on the human resources server. 
D)  Implement regular permission auditing and reviews.

Question 10

A manager suspects that an IT employee with elevated database access may be knowingly modifying financial transactions for the benefit of a competitor. Which of the following practices should the manager implement to validate the concern?

Accepted Answer

A)  Separation of duties 
B)  Mandatory vacations 
C)  Background checks 
D)  Security awareness training

Question 11

A transitive trust:

Accepted Answer

A)  is automatically established between a parent and a child 
B)  is used to update DNS records 
C)  allows access to untrusted domains 
D)  can be used in place of a hardware token for logins

Question 12

A vulnerability scan is being conducted against a desktop system. The scan is looking for files, versions, and registry values known to be associated with system vulnerabilities. Which of the following BEST describes the type of scan being performed?

Accepted Answer

A)  Non-intrusive 
B)  Authenticated 
C)  Credentialed 
D)  Active

Question 13

Anne, the Chief Executive Officer (CEO), has reported that she is getting multiple telephone calls from someone claiming to be from the helpdesk. The caller is asking to verify her network authentication credentials because her computer is broadcasting across the network. This is MOST likely which of the following types of attacks?

Accepted Answer

A)  Vishing 
B)  Impersonation 
C)  Spim 
D)  Scareware

Question 14

A security team received reports of increased latency on a highly utilized e-commerce server. This led to eventual service unavailability as a result of internal scanning activity. The following web-server log was shared with the team to support this claim:  Which of the following actions would BEST address the service impact caused by scanning?

Accepted Answer

A)  Enable proper error handling on the web server 
B)  Run scans during off peak hours 
C)  Stop scanning the affected servers 
D)  Disable directory enumeration in the scanning policy

Question 15

An organization is using a tool to perform a source code review. Which of the following describes the case in which the tool incorrectly identifies the vulnerability?

Accepted Answer

A)  False negative 
B)  True negative 
C)  False positive 
D)  True positive

Question 16

Given the log output: Max 15 00:15:23.431 CRT: #SEC_LOGIN-5-LOGIN_SUCCESS:   Login Success [user: msmith] [Source: 10.0.12.45] [localport: 23] at 00:15:23:431 CET Sun Mar 15 2015 Which of the following should the network administrator do to protect data security?

Accepted Answer

A)  Configure port security for logons 
B)  Disable telnet and enable SSH 
C)  Configure an AAA server 
D)  Disable password and enable RSA authentication

Question 17

A company's user lockout policy is enabled after five unsuccessful login attempts. The help desk notices a user is repeatedly locked out over the course of a workweek. Upon contacting the user, the help desk discovers the user is on vacation and does not have network access. Which of the following types of attacks are MOST likely occurring? (Select two.)

Accepted Answer

A)  Replay 
B)  Rainbow tables 
C)  Brute force 
D)  Pass the hash 
E)  Dictionary

Question 18

An organization with very high security needs wants to implement a biometric system. It is required to minimize unauthorized access by ensuring authorized personnel are not denied access. Which of the following solutions will work?

Accepted Answer

A)  A device with a low false acceptance rate and a high false rejection rate 
B)  A device with a high false acceptance rate and a high false rejection rate 
C)  A device with a high false acceptance rate and a low false rejection rate 
D)  A device with a low false acceptance rate and a low false rejection rate

Question 19

Malware that changes its binary pattern on specific dates at specific times to avoid detection is known as a (n):

Accepted Answer

A)  armored virus 
B)  logic bomb 
C)  polymorphic virus 
D)  Trojan

Question 20

Which of the following authentication concepts is a gait analysis MOST closely associated?

Accepted Answer

A)  Somewhere you are 
B)  Something you are 
C)  Something you do 
D)  Something you know

Exam 15: CompTIA Security+