Question 1

The chief Security Officer (CSO) has reported a rise in data loss but no break ins have occurred. By doing which of the following is the CSO most likely to reduce the number of incidents?

Accepted Answer

A)  Implement protected distribution 
B)  Empty additional firewalls 
C)  Conduct security awareness training 
D)  Install perimeter barricades

Question 2

A company has critical systems that are hosted on an end-of-life OS. To maintain operations and mitigate potential vulnerabilities, which of the following BEST accomplishes this objective?

Accepted Answer

A)  Use application whitelisting. 
B)  Employ patch management. 
C)  Disable the default administrator account. 
D)  Implement full-disk encryption.

Question 3

A recent internal audit is forcing a company to review each internal business unit's VMs because the cluster they are installed on is in danger of running out of computer resources. Which of the following vulnerabilities exists?

Accepted Answer

A)  Buffer overflow 
B)  End-of-life systems 
C)  System sprawl 
D)  Weak configuration

Question 4

Which of the following types of attack is being used when an attacker responds by sending the MAC address of the attacking machine to resolve the MAC to IP address of a valid server?

Accepted Answer

A)  Session hijacking 
B)  IP spoofing 
C)  Evil twin 
D)  ARP poisoning

Question 5

A critical enterprise component whose loss or destruction would significantly impede business operations or have an outsized impact on corporate revenue is known as:

Accepted Answer

A)  a single point of failure. 
B)  critical system infrastructure. 
C)  proprietary information. 
D)  a mission-essential function.

Question 6

A remote intruder wants to take inventory of a network so exploits can be researched. The intruder is looking for information about software versions on the network. Which of the following techniques is the intruder using?

Accepted Answer

A)  Banner grabbing 
B)  Port scanning 
C)  Packet sniffing 
D)  Virus scanning

Question 7

Which of the following BEST explains "likelihood of occurrence"?

Accepted Answer

A)  The chance that an event will happen regardless of how much damage it may cause 
B)  The overall impact to the organization once all factors have been considered 
C)  The potential for a system to have a weakness or flaw that might be exploited 
D)  The probability that a threat actor will target and attempt to exploit an organization's systems

Question 8

Ann, a security administrator, wants to ensure credentials are encrypted in transit when implementing a RADIUS server for SSO. Which of the following are needed given these requirements? (Choose two.)

Accepted Answer

A)  Public key 
B)  Shared key 
C)  Elliptic curve 
D)  MD5 
E)  Private key
F) DES

Question 9

Which of the following cloud models is used to share resources and information with business partners and like businesses without allowing everyone else access?

Accepted Answer

A)  Public 
B)  Hybrid 
C)  Community 
D)  Private

Question 10

Given the information below: MD5HASH document.doc 049eab40fd36caadlfab10b3cdf4a883 MD5HASH image. jpg 049eab40fd36caadlfab10b3cdf4a883 Which of the following concepts are described above? (Choose two.)

Accepted Answer

A)  Salting 
B)  Collision 
C)  Steganography 
D)  Hashing 
E)  Key stretching

Question 11

A hospital has received reports from multiple patients that their PHI was stolen after completing forms on the hospital's website. Upon investigation, the hospital finds a packet analyzer was used to steal data. Which of the following protocols would prevent this attack from reoccurring?

Accepted Answer

A)  SFTP 
B)  HTTPS 
C)  FTPS 
D)  SRTP

Question 12

After a merger, it was determined that several individuals could perform the tasks of a network administrator in the merged organization. Which of the following should have been performed to ensure that employees have proper access?

Accepted Answer

A)  Time-of-day restrictions 
B)  Change management 
C)  Periodic auditing of user credentials 
D)  User rights and permission review

Question 13

An organization is drafting an IRP and needs to determine which employees have the authority to take systems offline during an emergency situation. Which of the following is being outlined?

Accepted Answer

A)  Reporting and escalation procedures 
B)  Permission auditing 
C)  Roles and responsibilities 
D)  Communication methodologies

Question 14

A company wants to implement an access management solution that allows employees to use the same usernames and passwords for multiple applications without having to keep multiple credentials synchronized. Which of the following solutions would BEST meet these requirements?

Accepted Answer

A)  Multifactor authentication 
B)  SSO 
C)  Biometrics 
D)  PKI 
E)  Federation

Question 15

A security administrator wishes to implement a secure a method of file transfer when communicating with outside organizations. Which of the following protocols would BEST facilitate secure file transfers? (Select TWO)

Accepted Answer

A)  SCP 
B)  TFTP 
C)  SNMP 
D)  FTP 
E)  SMTP
F) FTPS

Question 16

An organization's policy requires users to create passwords with an uppercase letter, lowercase letter, number, and symbol. This policy is enforced with technical controls, which also prevents users from using any of their previous 12 passwords. The quantization does not use single sign-on, nor does it centralize storage of passwords. The incident response team recently discovered that passwords for one system were compromised. Passwords for a completely separate system have NOT been compromised, but unusual login activity has been detected for that separate system. Account login has been detected for users who are on vacation. Which of the following BEST describes what is happening?

Accepted Answer

A)  Some users are meeting password complexity requirements but not password length requirements. 
B)  The password history enforcement is insufficient, and old passwords are still valid across many different systems. 
C)  Some users are reusing passwords, and some of the compromised passwords are valid on multiple systems. 
D)  The compromised password file has been brute-force hacked, and the complexity requirements are not adequate to mitigate this risk.

Question 17

A systems administrator needs to integrate multiple IoT and small embedded devices into the company's wireless network securely. Which of the following should the administrator implement to ensure low-power and legacy devices can connect to the wireless network?

Accepted Answer

A)  WPS 
B)  WPA 
C)  EAP-FAST 
D)  802.1X

Question 18

A corporation is concerned that, if a mobile device is lost, any sensitive information on the device could be accessed by third parties. Which of the following would BEST prevent this from happening?

Accepted Answer

A)  Initiate remote wiping on lost mobile devices 
B)  Use FDE and require PINs on all mobile devices 
C)  Use geolocation to track lost devices 
D)  Require biometric logins on all mobile devices

Question 19

A security administrator receives alerts from the perimeter UTM. Upon checking the logs, the administrator finds the following output: Time: 12/25 0300 From Zone: Untrust To Zone: DMZ Attacker: externalip.com Victim: 172.16.0.20 To Port: 80 Action: Alert Severity: Critical When examining the PCAP associated with the event, the security administrator finds the following information: Which of the following actions should the security administrator take?

Accepted Answer

A) Upload the PCAP to the IDS in order to generate a blocking signature to block the traffic. B) Manually copy the

Question 20

An organization requires secure configuration baselines for all platforms and technologies that are used. If any system cannot conform to the secure baseline, the organization must process a risk acceptance and receive approval before the system is placed into production. It may have non-conforming systems in its lower environments (development and staging) without risk acceptance, but must receive risk approval before the system is placed in production. Weekly scan reports identify systems that do not conform to any secure baseline. The application team receives a report with the following results:  There are currently no risk acceptances for baseline deviations. This is a mission-critical application, and the organization cannot operate if the application is not running. The application fully functions in the development and staging environments. Which of the following actions should the application team take?

Accepted Answer

A)  Remediate 2633 and 3124 immediately. 
B)  Process a risk acceptance for 2633 and 3124. 
C)  Process a risk acceptance for 2633 and remediate 3124. 
D)  Shut down NYAccountingProd and investigate the reason for the different scan results.

Exam 15: CompTIA Security+