Question 1

A company has limited storage space available and an online presence that cannot be down for more than four hours. Which of the following backup methodologies should the company implement to allow for the FASTEST database restore time in the event of a failure, while being mindful of the limited available storage space?

Accepted Answer

A)  Implement full tape backups every Sunday at 8:00 p.m. and perform nightly tape rotations. 
B)  Implement differential backups every Sunday at 8:00 p.m. and nightly incremental backups at 8:00 p.m. 
C)  Implement nightly full backups every Sunday at 8:00 p.m. 
D)  Implement full backups every Sunday at 8:00 p.m. and nightly differential backups at 8:00 p.m.

Question 2

A network administrator needs to build out a new datacenter, with a focus on resiliency and uptime. Which of the following would BEST meet this objective? (Choose two.)

Accepted Answer

A)  Dual power supply 
B)  Off-site backups 
C)  Automatic OS upgrades 
D)  NIC teaming 
E)  Scheduled penetration testing
F) Network-attached storage

Question 3

A security analyst discovers that a company's username and password database was posted on an Internet forum. The usernames and passwords are stored in plain text. Which of the following would mitigate the damage done by this type of data exfiltration in the future?

Accepted Answer

A)  Create DLP controls that prevent documents from leaving the network. 
B)  Implement salting and hashing. 
C)  Configure the web content filter to block access to the forum. 
D)  Increase password complexity requirements.

Question 4

A network administrator would like to configure a site-to-site VPN utilizing IPsec. The administrator wants the tunnel to be established with data integrity, encryption, authentication, and anti-replay functions. Which of the following should the administrator use when configuring the VPN?

Accepted Answer

A)  AH 
B)  EDR 
C)  ESP 
D)  DNSSEC

Question 5

Which of the following BEST explains the difference between a data owner and a data custodian?

Accepted Answer

A)  The data owner is responsible for adhering to the rules for using the data, while the data custodian is responsible for determining the corporate governance regarding the data 
B)  The data owner is responsible for determining how the data may be used, while the data custodian is responsible for implementing the protection to the data 
C)  The data owner is responsible for controlling the data, while the data custodian is responsible for maintaining the chain of custody when handling the data 
D)  The data owner grants the technical permissions for data access, while the data custodian maintains the database access controls to the data

Question 6

A small company that does not have security staff wants to improve its security posture. Which of the following would BEST assist the company?

Accepted Answer

A)  MSSP 
B)  SOAR 
C)  IaaS 
D)  PaaS

Question 7

An organization has a growing workforce that is mostly driven by additions to the sales department. Each newly hired salesperson relies on a mobile device to conduct business. The Chief Information Officer (CIO) is wondering if the organization may need to scale down just as quickly as it scaled up. The CIO is also concerned about the organization's security and customer privacy. Which of the following would be BEST to address the CIO's concerns?

Accepted Answer

A)  Disallow new hires from using mobile devices for six months. 
B)  Select four devices for the sales department to use in a CYOD model. 
C)  Implement BYOD for the sales department while leveraging the MDM. 
D)  Deploy mobile devices using the COPE methodology.

Question 8

A user contacts the help desk to report the following: Two days ago, a pop-up browser window prompted the user for a name and password after connecting to the corporate wireless SSID. This had never happened before, but the user entered the information as requested. The user was able to access the Internet but had trouble accessing the department share until the next day. The user is now getting notifications from the bank about unauthorized transactions. Which of the following attack vectors was MOST likely used in this scenario?

Accepted Answer

A)  Rogue access point 
B)  Evil twin 
C)  DNS poisoning 
D)  ARP poisoning

Question 9

A security analyst is running a vulnerability scan to check for missing patches during a suspected security incident. During which of the following phases of the response process is this activity MOST likely occurring?

Accepted Answer

A)  Containment 
B)  Identification 
C)  Recovery 
D)  Preparation

Question 10

Which of the following refers to applications and systems that are used within an organization without consent or approval?

Accepted Answer

A)  Shadow IT 
B)  OSINT 
C)  Dark web 
D)  Insider threats

Question 11

A website developer is working on a new e-commerce website and has asked an information security expert for the most appropriate way to store credit card numbers to create an easy reordering process. Which of the following methods would BEST accomplish this goal?

Accepted Answer

A)  Salting the magnetic strip information 
B)  Encrypting the credit card information in transit 
C)  Hashing the credit card numbers upon entry 
D)  Tokenizing the credit cards in the database

Question 12

A startup company is using multiple SaaS and IaaS platforms to stand up a corporate infrastructure and build out a customer-facing web application. Which of the following solutions would be BEST to provide security, manageability, and visibility into the platforms?

Accepted Answer

A)  SIEM 
B)  DLP 
C)  CASB 
D)  SWG

Question 13

A recently discovered zero-day exploit utilizes an unknown vulnerability in the SMB network protocol to rapidly infect computers. Once infected, computers are encrypted and held for ransom. Which of the following would BEST prevent this attack from reoccurring?

Accepted Answer

A)  Configure the perimeter firewall to deny inbound external connections to SMB ports. 
B)  Ensure endpoint detection and response systems are alerting on suspicious SMB connections. 
C)  Deny unauthenticated users access to shared network folders. 
D)  Verify computers are set to install monthly operating system, updates automatically.

Question 14

A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site. Upon investigation, a security analyst identifies the following: The legitimate website's IP address is 10.1.1.20 and eRecruit.local resolves to this IP. The forged website's IP address appears to be 10.2.12.99, based on NetFlow records. All three of the organization's DNS servers show the website correctly resolves to the legitimate IP. DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise. Which of the following MOST likely occurred?

Accepted Answer

A)  A reverse proxy was used to redirect network traffic. 
B)  An SSL strip MITM attack was performed. 
C)  An attacker temporarily poisoned a name server. 
D)  An ARP poisoning attack was successfully executed.

Question 15

A company recently experienced a data breach and the source was determined to be an executive who was charging a phone in a public area. Which of the following would MOST likely have prevented this breach?

Accepted Answer

A)  A firewall 
B)  A device pin 
C)  A USB data blocker 
D)  Biometrics

Question 16

A company processes highly sensitive data and senior management wants to protect the sensitive data by utilizing classification labels. Which of the following access control schemes would be BEST for the company to implement?

Accepted Answer

A)  Discretionary 
B)  Rule-based 
C)  Role-based 
D)  Mandatory

Question 17

A user reports constant lag and performance issues with the wireless network when working at a local coffee shop. A security analyst walks the user through an installation of Wireshark and gets a five-minute pcap to analyze. The analyst observes the following output:  Which of the following attacks does the analyst MOST likely see in this packet capture?

Accepted Answer

A)  Session replay 
B)  Evil twin 
C)  Bluejacking 
D)  ARP poisoning

Question 18

A cybersecurity administrator has a reduced team and needs to operate an on-premises network and security infrastructure efficiently. To help with the situation, the administrator decides to hire a service provider. Which of the following should the administrator use?

Accepted Answer

A)  SDP 
B)  AAA 
C)  IaaS 
D)  MSSP 
E)  Microservices

Question 19

Which of the following is a team of people dedicated to testing the effectiveness of organizational security programs by emulating the techniques of potential attackers?

Accepted Answer

A)  Red team 
B)  White team 
C)  Blue team 
D)  Purple team

Question 20

A cybersecurity analyst reviews the log files from a web server and sees a series of files that indicate a directory-traversal attack has occurred. Which of the following is the analyst MOST likely seeing?

Accepted Answer

A) http://sample.url.com/ http://sample.url.com/ B) http://sample.url.com/someotherpageonsite/../../../etc/shadow C) http://sample.url.com/select-from-database-where-password-null D) http://redirect.sameple.url.sampleurl.com/malicious-dns-redirect

Exam 16: CompTIA Security+ 2021