Terms in this set (148)
An achievement is providing worldwide internet security was the signing of certificates associated with which of the following
A chief information security officer CISO wants to implement two-factor authentication within the company. which of the following would fulfill the CISO's requirements?
USB token and PIN
Which or the following security administrator implement on mobile devices that will help prevent unwanted people from viewing the data if the device is left unattended?
Which of the following would a security administrator implement in order to identify a problem between two systems that are not communicating properly?
Which of the following can result in significant administrative overhead form incorrect reporting?
A security administrator wants to perform routine tests on the network during working hours when certain applications are being accessed by the most people. Which of the following would allow the security administrator to test the lack of security controls for those applications with the least impact to the system?
Which of the following risk concepts requires an organization to determine the number of failures per year?
A system security analyst using an enterprise monitoring tool notices an unknown internal host exfiltrating files to several foreign IP addresses. Which of the following would be an appropriate mitigation technique?
Rogue machine detection
Three of the primary security control types that can be implemented are:
Operational, technical, and management
The helpdesk reports increased calls from clients reporting spikes in malware infections on their systems. Which of the following phases of incident response is MOST appropriate as a FIRST response?
Which of the following protocols operates at the HIGHEST level of the OSI model?
Joe, the system administratior, has been asked to calculate the Annual Loss Expectancy (ALE) for a $5,000 server, which often crashes. In the past year, the server has crashed 10 times, requiring a system reboot to recover with only 10% loss of data or function. Which of the following is the ALE of this server?
Which of the following should an administrator implement to research current attack methodologies?
Which of the following can be implemented in hardware or software to protect a web sever from cross-site scripting attacks?
Web Application Firewall
Which of the following means of wireless authentication is easily vulnerable to spoofing?
The BEST methods for a web developer to prevent the website application code from being vulnerable to cross-site request forgery (XSRF) are to: (select TWO)
Validate and filter input on the server side and client side
Restrict and sanitize use of special characters in input and URLs.
Jane, a security administrator, needs to implement a secure wireless authentication method that uses a remote RADIUS server for authentication. Which of the following is an authentication method Jane should use?
Computer evidence at a crime scene is documented with a tag stating who had possession of the evidence at a given time.
Which of the following does this illustrate?
Chain of Custody
A network administrator is configuring access control for the sales department which has high employee turnover. Which of the following is BEST suited when assigning user rights to individuals in the sales department?
Group based privileges
Which of the following is being tested when a company's payroll server is powered off for eight hours?
Continuity of operations plan
A security analyst, Ann, is reviewing an IRC channel and notices that a malicious exploit has been created for a frequently used application. She notifies the software vendor and asks them for remediation steps, but is alarmed to find that no patches are available to mitigate this vulnerability. Which of the following BEST describes this exploit?
A security administrator has concerns about new type of media which allows for the mass distribution of personal comments to a select group of people. To mitigate the risks involved with this media, employees should receive training on which of the following?
A network administrator is responsible for securing applications against external attacks. every month, the underlying operating system is updated. There is no process in place for other software updates. Which of the following processes could MOST effectively mitigate these risks?
Application patch management
A software developer is responsible for writing the code on an accounting applications. Another software developer is responsible for developing code on a system in human resources. Once a year they have to switch roles for several weeks. Which of the following practices is being implemented?
A network engineer is designing a secure tunneled VPN. Which of the following protocols would be the MOST secure?
Which of the following implementation steps would be appropriate for a public wireless hot-spot?
Open system authentication
Which of the following is a step in deploying a WPA2-Enterprise wireless network?
Install a digital certificate on the authentication server
Which of the following controls would allow a company to reduce the exposure of sensitive systems from unmanaged devices on internal networks?
Which of the following preventative controls would be appropriate for responding to a directive to reduce the attack surface of a specific host?
Disabling unnecessary services
A security manager must remain aware of the security posture of each system. Which of the following supports this requirement?
Establishing baseline reporting
Deploying a wildcard certificate is one strategy to:
Reduce the certificate management burden
The security administrator needs to manage traffic on a layer 3 device to support FTP from a new remote site. Which of the following would need to be implemented?
Access control lists
Which of the following ports is used for SSH, by default?
A server with the IP address of 10.10.2.4 has been having intermittent connection issues. The logs show repeated connection attempts from the following IPs:
These attempts are overloading the server to the point it cannot respond to traffic. Which of the following attacks is occurring?
Which of the following ciphers would be BEST used too encrypt streaming video?
A user attempting to log on to a workstation for the first time is prompted for the following information before being grated access: username, password, and four-digit security pin that was mailed to him during account registration. This is and example of which of the following?
Single factor authentication
After analyzing and correlating activity from multiple sensors, the security administrator has determined that a group of very well organized individuals form an enemy country is responsible for various attempts to breach the company network, through the use of very sophisticated and targeted attacks. which of the following is this an example of?
Advanced persistent threat
Which of the following is true about input validation in a client-server architecture, when data integrity is critical to the organization?
It should be performed on the server side
A merchant acquirer has the need to store credit card numbers in a transactional database in a high performance environment. Which of the following BEST protects the credit card data?
Database field encryption
A bank has a fleet of aging payment terminals used by merchants for transactional processing. The terminals currently support single DES but require an upgrade in order to be compliant with security standards. Which of the following is likely to be the simplest upgrade to the aging terminals which will improve in-transit protection of transactional data?
Which of the following is BEST at blocking attacks and providing security at layer 7 of the OSI model?
Which of the following is BEST used to capture and analyze network traffic between hosts on the same network segment?
After a number of highly publicized and embarrassing customer data leaks as a result of social engineering attacks by phone, the Chief Information Officer (CIO) has decided user training will reduce the risk of another data leak. Which of the following would be MOST effective in reducing data leaks in this situation?
Information Security Awareness
Which of the following functions provides an output which cannot be reserved and converts data into a string of characters?
Which of the following encrypts data a single bit at a time?
Which of the following is used to verify data integrity?
By default, which of the following uses TCP port 22? (select three)
Access mechanisms to data on encrypted USB hard drives must be implemented correctly otherwise:
The security controls on the USB drive can be bypassed
Maintenance workers find an active network switch hidden above a dropped-ceiling tile in the CEO's office with various connected cables from the office. Which of the following describes the type of attack that was occurring?
A security administrator is segregating all web-facing server traffic from the internal network and restricting it to a single interface on a firewall. Which of the following BEST describes this new network?
Which of the following was based on a previous X.500 specification and allows either unencrypted authentication or encrypted authentication through the use of TLS?
The quality Assurance team is testing a new third party developed application. The Quality team does not have any experience with the application. Which of the following is the team performing?
Black box testing
Which of the following has a storage root key?
A datacenter requires that staff be able to identify whether or not items have been removed from the facility. Which of the following controls will allow the organization to provide automated notification of item removal?
A malicious person gained access to a datacenter by ripping the proximity badge reader off the wall near the datacenter entrance. This caused the electronic locks on the datacenter door to release because the:
System was designed to fail open for life-safety
The concept of rendering data passing between two points over an IP based network impervious to all but the most sophisticated advanced persistent threats is BEST categorized as which of the following?
On Monday, all company employees report being unable to connect to the corporate wireless network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were made to the wireless network and its supporting infrastructure, and that there are no outages. Which of the following is the MOST likely causes for this issue?
The Remote Authentication Dial-In User Service server certificate has expired
A network administrator has been tasked with securing the WLAN. Which of the following cryptographic products would be used to provide the MOST secure environment for the WLAN?
Which of the following would BEST deter an attacker trying to brute force 4-digit PIN numbers to access an account at a bank teller machine?
Account lockout settings
An administrator discovers that many users have used their same passwords for years even though the network requires that the passwords be changed every six weeks. Which of the following, when used together, would BEST prevent users from reusing their existing password? (select TWO)
Minimum password age
A recent audit has discovered that at the time of password expiration clients are able to recycle the previous credentials for authentication. Which of the following controls should be used together to prevent this from occurring? (select TWO)
A system administrator is configuring UNIX accounts to authenticate against external server. The configuration file asks for the following information DC=ServerName and DC=COM. Which of the following authentication services is being used?
In Kerberos, the Ticket Granting Ticket (TGT) is used for which of the following?
Which of the following network design elements allows for many internal devices to share one public IP address?
Which of the following components of an all-in-one security appliance would MOST likely be configured in order to restrict access to peer-to-peer file sharing websites?
When considering a vendor-specific vulnerability in critical industrial control systems which of the following techniques supports availability?
Incorporating diversity into redundant design
During the information gathering stage of a deploying role-based access control model, which of the following information is MOST likely required?
Matrix of job titles with required access privileges
The Chief Technical Officer (CTO) has been unformed of a potential fraud committed by a database administrator performing several other job functions within the company. Which of the following is the BEST method to prevent such activities in the future?
Separation of duties
Ann would like to forward some Personal Identifiable Information to her HR department by email, but she is worried about the confidentiality of the information. Which of the following will accomplish this task securely?
A company is trying to limit the risk associated with the use of unapproved USB devices to copy documents. Which of the following would be the BEST technology control to use in this scenario?
A company us trying to implement physical deterrent controls to improve the overall security posture of their data center. Which of the following BEST meets their goal?
A company's employees were victims of a spear phishing campaign impersonating the CEO. The company would now like to implement a solution to improve the overall security posture by assuring their employees that email originated from the CEO. Which of the following controls could they implement to BEST meet this goal?
A security technician is attempting to improve the overall security posture of an internal mail server. Which of the following actions would BEST accomplish this goal?
Disabling unnecessary services
A bank has recently deployed mobile tablets to all loan officers for use at customer sites. Which of the following would BEST prevent the disclosure of customer data in the event that a tablet is lost or stolen?
Which of the following is the primary security concern when deploying a mobile device on a network?
Which of the following technical controls is BEST used to define which applications a user can install and run on a company issued mobile devices?
After a company has standardized to a single operating system, not all servers are immune to a well-known OS vulnerability. Which of the following solutions would mitigate this issue?
Patch management system
A security administrator discovers an image file that has several plain text documents hidden in the file. Which of the following security goals is met by camouflaging data inside of other files?
A company determines a need for additional protection from rogue devices plugging into physical ports around the building. Which of the following provides the highest degree of protection from unauthorized wired network access?
A company is preparing to decommission an offline, non-networked root certificate server. Before sending the server's drives to be destroyed by a contracted company, the Chief Security Officer (CSO) wants to be certain that the data will not be accessed. Which of the following implemented, would BEST reassure the CSO? (select TWO)
Full disk encryption
Disk wiping procedures
During the analysis of a PCAP file, a security analyst noticed several communications with a remote server on port 53. Which of the following protocol types is observed in this traffic?
A compromised workstation utilized in a Distributed Denial of Service (DDoS) attack has been removed from the network and an image of the hard drive has been created. However, the system administrator stated that the system was left unattended for several hours before the image was created. In the event of a court case, which of the following is likely to be an issue with this incident?
Chain of Custody
During which of the following phases of the Incident Response process should a security administrator define and implement general defense against malware?
Due to hardware limitation, a technician must implement a wireless encryption algorithm that uses RC4 protocol. Which of the following is wireless encryption solution that the technician should implement while ensuring the STRONGEST level of security?
Joe, a user, wants to send an encrypted email to Ann. Which of the following will Ann need to use to verify that the email came from Joe and decrypt it? (select TWO)
Ann's private key
Joe's public key
Joe, a user, wants to send an encrypted email to Ann. Which of the following will Ann need to use to verify the validity's of Joe's certificate? (select TWO)
The CA's public key
Joe's public key
A technician wants to implement a dual factor authentication system that will enable the organization to authorize access to sensitive systems on a need-to-know basis. Which of the following should be implemented during the authorization stage?
A security researcher wants to reverse engineer an executable file to determine if it is malicious. The file was found on an underused server and appears to contain a zero-day exploit. Which of the following can the researcher do to determine if the file is malicious in nature?
OS Baseline comparison
A recent spike in virus detection has been attributed to end-users visiting www.company.com. The business has an established relationship with an organization using the URL of www.company.com but not with the site that has been causing the infections. Which of the following would BEST describe this type of attack?
A company has proprietary mission critical devices connected to their network which are configured remotely by both employees and approved customers. The administrator wants to monitor device security without changing their baseline configuration. Which of the following should be implemented to secure the devices without risking availability?
An administrator has a network subnet dedicated to a group of users. Due to concerns regarding data and network security, the administrator desires to provide network access for this group only. Which of the following would BEST address this desire?
Configure the switch to allow only traffic from computers based upon their physical address
Which of the following is a security concern regarding users bringing personally-owned devices that they connect to the corporate network?
Lack of controls in place to ensure that the devices have the latest system patches and signature files
Due to issues with building keys being duplicated and distributed, a security administrator wishes to change to a different security control regarding a restricted area. The goal is to provide access based upon facial recognition. Which of the following will address this requirement?
Placed a guard at the entrance to approve access
A security administrator has concerns regarding employees saving data on company provided mobile devices. Which of the following would BEST address the administrator's concerns?
Configure the devices so that removable media used disabled
Identifying residual risk is MOST important to which of the following concepts?
The information security technician wants to ensure security controls are deployed and functioning as intended to be able to maintain an appropriate security posture. Which of the following security techniques is MOST appropriate to do this?
Continuous security monitoring
A small company can only afford to buy an all-in-one wireless router/switch. The company has 3 wireless BYOD users and 2 web servers without wireless access. Which of the following should the company configure to protect the servers from the users devices? (select TWO)
Create a server VLAN
Create an ACL to access the server
Users can authenticate to a company's web applications using their credentials from a popular social media site. Which of the following poses the greatest risk with this integration?
Password breaches to the social media site affect the company application as well
A security team has established a security awareness program. Which of the following would BEST prove the success f the program?
A company needs to receive data that contains personally identifiable information. The company requires both the transmission and data at rest to be encrypted. Which of the following achieves this goal? (select Two)
An organization does not have adequate resources to administrator wishes to combine the security controls of some of the network devices in the organization. Which of the following methods would BEST accomplish this goal?
Unified Threat Management
Which of the following would allow the organization to divide a class C IP address range into several ranges?
The security administrator is currently unaware of an incident that occurred a week ago. Which of the following will ensure the administrator is notified in a timely manner in the future?
An access point has been configured for AES encryption but a client is unable to connect to it. Which of the following should be configured on the client to fix issue?
A forensic analysis is asked to respond to an ongoing network attack on server. What is the correct order in which the forensic analyst should preserve them?
The system administrator is tasked with changing the administrator password across all 2000 computers in the organization. Which of the following should the system administrator implement to accomplish this task?
A Group Policy
A network administrator wants to block both DNS requests and zone transfers coming from outside IP addresses. The company uses a firewall which implements an implicit allow and is currently configured with the following ACL applied to its external interface:
permit tcp any any 80
permit tcp any any 443
Which of the following rules would accomplish this task? (Select TWO)
Change the firewall default settings so that it implements an implicit deny
Add the following ACL at the bottom of the current ACL deny ip any any 53
Which of the following attacks would cause all mobile devices to lose their association with corporate access points while the attack is underway?
An administrator wants to ensure that the reclaimed spaced of a hard drive has been sanitized while the computer is in use. Which of the following can be implemented?
Cluster tip wiping
A company is looking to improve their security posture by addressing risks uncovered by a recent penetration test. Which of the following risks in MOST likely to affect the business on a day-to-day basis?
Lack of antivirus software
Ann, an employee, is cleaning out her desk and disposes of paperwork containing confidential customer information in a recycle bin without shredding it first. This is MOST likely to increase the risk of loss from which of the following attacks?
A recently installed application update caused a vital application to crash during the middle of the workday. The application remained down until a previous version could be reinstalled on the server, and this resulted in a significant loss of date and revenue. Which of the following could BEST prevent this issue from occurring again?
Application patch management
A security administrator wishes to increase the security of the wireless network. Which of the following BEST addresses this concern?
Change the encryption from TKIP-based to CCMP-based
The system administrator has deployed updated security controls for the network to limit risk of attack. The security manager is concerned that controls continue to function as intended to maintain appropriate security posture. Which of the following risk mitigation strategies is MOST important to the security manager?
A company is about to release a very large patch to its customers. An administrator is required to test patch installations several times prior to distributing them to customer PCs. Which of the following should the administrator use to test the patching process quickly and often?
Create a virtualized sandbox and utilize snapshots
An auditing team has found that passwords do not meet best business practices. Which of the following will MOST increase the security of the passwords? (select TWO)
A vulnerability scan is reporting that patches are missing on a server. After a review, it is determined that the application requiring the patch not exist on the operating system. Which of the following describes this cause?
Company A submitted a bid on a contract to do work for Company B via email. Company B was insisted that the bid did not come from Company A. Which of the following would have assured that the bid was submitted by company A?
Ann, a sales manager, successfully connected her company-issued smartphone to the wireless network in her office without supplying a username/password combination. Upon disconnecting from the wireless network, she attempted to connect her personal tablet computer to the same wireless network and could not connect. Which of the following is MOST likely the reason?
The company wireless is using an MAC filter
A network technician is on the phone with the system administration team. Power to the server room was lost and servers need to be restarted. The DNS services must be the first to be restarted. Several machines are powered off. Assuming each server only provides one service, which of the following should be powered on FIRST to establish DNS services?
A security administrator is reviewing the company's continuity plan. the plan specifies an RTO of six hours and RPO of two days. which of the following is the plan describing?
Systems should be restored within six hours with a minimum of two days worth of data
The incident response team has received the following email message:
[ From: email@example.com
Subject: Copyright infringement
A copyright infringement alert was triggered by IP address 18.104.22.168, the team is unable to correlate and identify the incident.
09:45:33 22.214.171.124 http://remote.site.com/login.asp?user=john
09:50:22 126.96.36.199 http://remote.site.com/login.asp?user=anne
10:50:01 188.8.131.52 http://remote.site.com/access.asp?file=movie.mov
11:02:45 184.108.40.206 http://remote.site.com/download.asp?movie.mov=ok ]
Which of the following is MOST likely the reason why the incident response team is unable to identify and correlate the incident
Incident time offsets were not accounted for
A server dedicated to the storage and processing of sensitive information was compromised with a rootkit and sensitive data was exfiltrated. Which of the following incident response procedures is best suited to restore the server?
Wipe the storage, reinstall the OS from original media and restore the data from the last known good backup
Which of the following describes a type of malware which is difficult to reverse engineer in a virtual lab?
Using a heuristic system to detect an anomaly in a computer's baseline, a system administrator was able to detect an attack event though the company signature based IDS and antivirus did not detect it. Further analysis revealed that the attacker had downloaded an executable file onto the company PC from the USB port, and executed it to trigger a privilege escalation flaw. Which of the following attacks had MOST likely occurred
After copying a sensitive document from his desktop to a flash drive, Joe, a user, realizes that the document is no longer encrypted. Which of the following can a security technician implement to ensure that documents stored on Joe's desktop remain encrypted when moved to external media or other network based storage?
File level encryption
A security administrator must implement a system to allow clients to securely negotiate encryption keys with the company's server over a public unencrypted communication channel. Which of the following implements the required secure key negotiation? (select TWO)
Acme Corps has selectively outsourced proprietary business processes to ABC services. Due to some technical issues, ABC services wants to send some of Acme Corp's debug data to a third party vendor for problem resolution. Which of the following MUST be considered prior to sending data to a third party?
This may violate data ownership and non-disclosure agreements
An organization has introduced token-based authentication to system administrators due to risk of password compromise. The tokens have a set of numbers that automatically change every 30 seconds. Which of the following type of authentication mechanism is this?
A security technician at a small business is worried about the Layer 2 switches in the network suffering from a DoS style attack caused by staff incorrectly cabling network connections between switches. Which of the following will BEST mitigate the risk is implemented on the switches?
An administrator wants to establish a WiFi network using a high gain directional antenna with a narrow radiation pattern to connect two buildings separated by a very long distance. Which of the following antennas would be BEST for this situation?
An attacker used an undocumented and unknown application exploit to gain access to a file server. Which of the following BEST describes this type of attack?
Which of the following is an XML based open standard used in exchange of authentication and authorization information between different parties?
Which of the following ports and protocol types must be opened on a host with a host-based firewall to allow incoming SFTF connections
A user, Ann, is reporting to the company IT support group that her workstation screen is blank other than a window with a message requesting payment or else her hard drive will be formatted. Which of the following types of malware is on Ann's workstation?
Which of the following controls can be implemented together to prevent data loss in the event of theft of a mobile device storing sensitive information? (select TWO)
Full device encryption
A way to assure data at-rest is secure even in the even of loss or theft is to use:
Full device encryption
A security audit identifies a number of large email messages being sent by a specific user from their company email account to another address external to the company. These messages were sent prior to a company data breach, which prompted the security audit. The user was one of a few people who had access to the leaked data. Review of the suspect's emails show they consist mostly of pictures of the user at various locations during recent vacation. No suspicious activities from other users who have access to the data were discovered. Which of the following is occurring?
The user is using steganography
A security analyst is reviewing firewall logs while investigation a compromised web server. The following ports appear in the log:
22, 25, 445, 1433, 3128, 3389, 6667
Which of the following protocols was used to access the server remotely?
An organization does not want the wireless network name to be easily discovered. Which of the following software features should be configured on the access points?
A computer is suspected to be compromised by malware. The security analyst examines the computer and finds that the service Telnet is running and connected to an external website over port 443. This telnet service was found by comparing the system's services to the list of standard services on the company's system image. This review process depends on:
YOU MIGHT ALSO LIKE...
Security+ SY0-401 Practice Exam 2
SEC+ Volume A
SY0 501 July01
Security+ SY0-401 Practice Exam 8
OTHER SETS BY THIS CREATOR
DLI Spanish Chapter 2
THIS SET IS OFTEN IN FOLDERS WITH...
CompTIA SYS-401 Actual Tests