Question 1

During a routine scan of a wireless segment at a retail company, a security administrator discovers several devices are connected to the network that do not match the company's naming convention and are not in the asset inventory. WiFi access is protected with 256-bit encryption via WPA2. Physical access to the company's facility requires two-factor authentication using a badge and a passcode. Which of the following should the administrator implement to find and remediate the issue? (Choose two.)

Accepted Answer

A)  Check the SIEM for failed logins to the LDAP directory. 
B)  Enable MAC filtering on the switches that support the wireless network. 
C)  Run a vulnerability scan on all the devices in the wireless network. 
D)  Deploy multifactor authentication for access to the wireless network. 
E)  Scan the wireless network for rogue access points.
F) Deploy a honeypot on the network.

Question 2

After a ransomware attack, a forensics company needs to review a cryptocurrency transaction between the victim and the attacker. Which of the following will the company MOST likely review to trace this transaction?

Accepted Answer

A)  The public ledger 
B)  The NetFlow data 
C)  A checksum 
D)  The event log

Question 3

Under GDPR, which of the following is MOST responsible for the protection of privacy and website user rights?

Accepted Answer

A)  The data protection officer 
B)  The data processor 
C)  The data owner 
D)  The data controller

Question 4

A network engineer needs to build a solution that will allow guests at the company's headquarters to access the Internet via WiFi. This solution should not allow access to the internal corporate network, but it should require guests to sign off on the acceptable use policy before accessing the Internet. Which of the following should the engineer employ to meet these requirements?

Accepted Answer

A)  Implement open PSK on the APs 
B)  Deploy a WAF 
C)  Configure WIPS on the APs 
D)  Install a captive portal

Question 5

A company's bank has reported that multiple corporate credit cards have been stolen over the past several weeks. The bank has provided the names of the affected cardholders to the company's forensics team to assist in the cyber-incident investigation. An incident responder learns the following information: The timeline of stolen card numbers corresponds closely with affected users making Internet-based purchases from diverse websites via enterprise desktop PCs. All purchase connections were encrypted, and the company uses an SSL inspection proxy for the inspection of encrypted traffic of the hardwired network. Purchases made with corporate cards over the corporate guest WiFi network, where no SSL inspection occurs, were unaffected. Which of the following is the MOST likely root cause?

Accepted Answer

A)  HTTPS sessions are being downgraded to insecure cipher suites 
B)  The SSL inspection proxy is feeding events to a compromised SIEM 
C)  The payment providers are insecurely processing credit card charges 
D)  The adversary has not yet established a presence on the guest WiFi network

Question 6

A security analyst is reviewing information regarding recent vulnerabilities. Which of the following will the analyst MOST likely consult to validate which platforms have been affected?

Accepted Answer

A)  OSINT 
B)  SIEM 
C)  CVSS 
D)  CVE

Question 7

An organization suffered an outage, and a critical system took 90 minutes to come back online. Though there was no data loss during the outage, the expectation was that the critical system would be available again within 60 minutes. Which of the following is the 60-minute expectation an example of?

Accepted Answer

A)  MTBF 
B)  RPO 
C)  MTTR 
D)  RTO

Question 8

A Chief Security Officer (CSO) is concerned about the amount of PII that is stored locally on each salesperson's laptop. The sales department has a higher-than-average rate of lost equipment. Which of the following recommendations would BEST address the CSO's concern?

Accepted Answer

A)  Deploy an MDM solution. 
B)  Implement managed FDE. 
C)  Replace all hard drives with SEDs. 
D)  Install DLP agents on each laptop.

Question 9

An employee has been charged with fraud and is suspected of using corporate assets. As authorities collect evidence, and to preserve the admissibility of the evidence, which of the following forensic techniques should be used?

Accepted Answer

A)  Order of volatility 
B)  Data recovery 
C)  Chain of custody 
D)  Non-repudiation

Question 10

Which of the following describes the BEST approach for deploying application patches?

Accepted Answer

A)  Apply the patches to systems in a testing environment, then to systems in a staging environment, and finally to production systems. 
B)  Test the patches in a staging environment, develop against them in the development environment, and then apply them to the production systems. 
C)  Test the patches in a test environment, apply them to the production systems, and then apply them to a staging environment. 
D)  Apply the patches to the production systems, apply them in a staging environment, and then test all of them in a testing environment.

Question 11

A global pandemic is forcing a private organization to close some business units and reduce staffing at others. Which of the following would be BEST to help the organization's executives determine their next course of action?

Accepted Answer

A)  An incident response plan 
B)  A communications plan 
C)  A disaster recovery plan 
D)  A business continuity plan

Question 12

A cybersecurity administrator needs to add disk redundancy for a critical server. The solution must have a two-drive failure for better fault tolerance. Which of the following RAID levels should the administrator select?

Accepted Answer

A)  0 
B)  1 
C)  5 
D)  6

Question 13

In which of the following common use cases would steganography be employed?

Accepted Answer

A)  Obfuscation 
B)  Integrity 
C)  Non-repudiation 
D)  Blockchain

Question 14

A RAT that was used to compromise an organization's banking credentials was found on a user's computer. The RAT evaded antivirus detection. It was installed by a user who has local administrator rights to the system as part of a remote management tool set. Which of the following recommendations would BEST prevent this from reoccurring?

Accepted Answer

A)  Create a new acceptable use policy. 
B)  Segment the network into trusted and untrusted zones. 
C)  Enforce application whitelisting. 
D)  Implement DLP at the network boundary.

Question 15

An organization with a low tolerance for user inconvenience wants to protect laptop hard drives against loss or data theft. Which of the following would be the MOST acceptable?

Accepted Answer

A)  SED 
B)  HSM 
C)  DLP 
D)  TPM

Question 16

The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread unhindered throughout the network and infect a large number of computers and servers. Which of the following recommendations would be BEST to mitigate the impacts of a similar incident in the future?

Accepted Answer

A)  Install a NIDS device at the boundary. 
B)  Segment the network with firewalls. 
C)  Update all antivirus signatures daily. 
D)  Implement application blacklisting.

Question 17

A company recently transitioned to a strictly BYOD culture due to the cost of replacing lost or damaged corporate-owned mobile devices. Which of the following technologies would be BEST to balance the BYOD culture while also protecting the company's data?

Accepted Answer

A)  Containerization 
B)  Geofencing 
C)  Full-disk encryption 
D)  Remote wipe

Question 18

Which of the following ISO standards is certified for privacy?

Accepted Answer

A)  ISO 9001 
B)  ISO 27002 
C)  ISO 27701 
D)  ISO 31000

Question 19

A security analyst has been asked to investigate a situation after the SOC started to receive alerts from the SIEM. The analyst first looks at the domain controller and finds the following events:  To better understand what is going on, the analyst runs a command and receives the following output:  Based on the analyst's findings, which of the following attacks is being executed?

Accepted Answer

A)  Credential harvesting 
B)  Keylogger 
C)  Brute-force 
D)  Spraying

Question 20

On which of the following is the live acquisition of data for forensic analysis MOST dependent? (Choose two.)

Accepted Answer

A)  Data accessibility 
B)  Legal hold 
C)  Cryptographic or hash algorithm 
D)  Data retention legislation 
E)  Value and volatility of data
F) Right-to-audit clauses

Exam 16: CompTIA Security+ 2021