CompTIA Security+ Exam Questions (Practice)

Question 1

Which of the following actions should a security analyst take to resolve the, "This website cannot be trusted" message?

Accepted Answer

Verify the certificate has not expired on the server.

Question 2

Which of the following best describes routine in which semicolons, dashes, quotes, and commas are removed from a string?

Accepted Answer

Input validation to protect against SQL injection.

Question 3

Which of the following categories does a smart refrigerator belong to?

Accepted Answer

IoT

Question 4

Which of the following actions is represented when a penetration tester is on a website that's available to the public?

Accepted Answer

Reconnaissance

Question 5

Which of the following encryption methods does PKI typically use to securely project keys?

Accepted Answer

Asymmetric

Question 6

What subnet would best meet the requirements of the corporate firewall interfaces to use as a DMZ for 14 physical hosts?

Accepted Answer

192.168.0.16/28

Question 7

If a group of non-profit agencies wants to implement a cloud service to share resources with each other, which is best?

Accepted Answer

Community

Question 8

Which of the following technical controls would help prevent weak passwords and old passwords within a company network?

Accepted Answer

Password history, Password complexity

Question 9

Which of the following can be provided to an AAA system for the identification phase?

Accepted Answer

Username

Question 10

Company policy requires usage of passphrases. What must be in place in order to promote usage of passphrases?

Accepted Answer

Complexity

Question 11

Which of the following attacks specifically impact data availability?

Accepted Answer

DDoS

Question 12

When performing data acquisition on a desktop, what should be captured based on memory volatility? (There are 2 choices)

Accepted Answer

RAM, Swap/Pagefile

Question 13

Which of the following characteristics best describes what a cost-effective, high demanding architecture would be?

Accepted Answer

Elasticity

Question 14

An employee receives an email from the CEO, asking for a report of credentials. What type of attack is likely occurring?

Accepted Answer

Spear phishing

Question 15

Which access control model has been applied to user's accounts if they can't access data at a higher permissions level?

Accepted Answer

MAC

Question 16

Which policy or procedure could have stopped an employee from deleting files from a server while the store was closed?

Accepted Answer

Offboarding

Question 17

Which of the following describes the case in which a source code review tool incorrectly identifies a vulnerability?

Accepted Answer

False positive

Question 18

Which of the following allows third party applications to be installed onto a mobile device using a computer?

Accepted Answer

Sideloading, Rooting/jailbreaking

Question 19

If an administrator is encrypting a service, why should the administrator take advantage of the SAM of a certificate?

Accepted Answer

It provides extended site validation.

Question 20

Joe downloads an app not from the app store. Which of the choices allowed Joe to install the app? (There are 2 answers)

Accepted Answer

Sideloading, Rooting/Jailbreaking

Question 21

Which of the following characteristics differentiate a rainbow table attack from a brute force attack?

Accepted Answer

Rainbow table attacks greatly reduce compute cycles at attack time., Rainbow tables must include precomputed hashes.

Question 22

What should a security analyst use to prevent random inputs of data on corporate web pages for security purposes (SQL)?

Accepted Answer

Input validation

Question 23

If a database backs up every Saturday and it is restored on Tuesday, how many backups will it take for a full recovery?

Accepted Answer

2

Question 24

Which of the following types of cloud infrastructures would show organizations to realize the benefits of shared drives?

Accepted Answer

Community

Question 25

Which of the following should be implemented if multiple organizations use the native 802.1x client on their devices?

Accepted Answer

RADIUS federation

Question 26

Which of the following would a security specialist be able to determine upon examination of a server’s certificate?

Accepted Answer

OID

Question 27

Which of the following should a security analyst do to determine if a compromised system still has an active connection?

Accepted Answer

nslookup

Question 28

What should be implemented if an administrator does not want to provide the wireless password to any of his employees?

Accepted Answer

WPS

Question 29

A web application is configured to target browsers and allow access to bank accounts. This is an example of what attack?

Accepted Answer

Cross-site scripting

Question 30

A technician has installed new vulnerability scanner, and is able to provide visibility of clients. What is being use?

Accepted Answer

Credentialed Scan

Question 31

Which of the following differentiates a collision attack from a rainbow table attack?

Accepted Answer

A rainbow table attack performs a hash lookup.

Question 32

Which of the following explains why vendors publish hash values when they provide software patches for their downloads?

Accepted Answer

The recipient can verify integrity of the software patch.

Question 33

An attacker discovers a new vulnerability and takes advantage of it by developing new malware. What is being described?

Accepted Answer

Zero-day exploit

Question 34

A portable storage device has been determined to be malicious. What is the best course of action for confidentiality?

Accepted Answer

Perform virus scan in the device

Question 35

Which of the following should an analyst implement to ensure LDAP traffic cannot be monitored and/or sniffed?

Accepted Answer

Ensure port 389 is open between the clients and the servers., Generate an X.509-compliant certificate that is signed by a trusted CA.

Question 36

An organization has determined it can tolerate a maximum of three hours of downtime. Which choice has been specified?

Accepted Answer

RTO

Question 37

Which of the following certificate formats should an engineer use to obtain the information in an X.509 required format?

Accepted Answer

PEM

Question 38

Which of the following best describes an important security advantage yielded by implementing vendor diversity?

Accepted Answer

Resiliency

Question 39

While reviewing the internet usage there was a large spike in "unknown" traffic. What tool would help get info about it?

Accepted Answer

IDS Logs

Question 40

To fix a domain controller an admin needs to provide the domain admin password, which account type is the admin using?

Accepted Answer

User account

Question 41

Which is a company doing if they purchase insurance to cover the cost of any potential loss because of new credit rules?

Accepted Answer

Transferring the risk

Question 42

Which choice is the best reason that the company added a Proprietary data type after adding Private & Public data types?

Accepted Answer

Better data classification

Question 43

What has an application programmer failed to implement if a malicious user was able to carry an SQL injection attack?

Accepted Answer

Server side validation

Question 44

If company is making a new system that will unlock a computer automatically, what is the best choice for this scenario?

Accepted Answer

Facial recognition

Question 45

An administrator wants to ensure that users don't use unauthorized devices. What is the best way to go about it?

Accepted Answer

Enforce authentication for network devices.

Question 46

Which of the following methods should an administrator implement for securing internal routing?

Accepted Answer

VPN

Question 47

When connected to a router, what encryption technology is most likely to be configured when using the WPA2-PSK option?

Accepted Answer

AES

Question 48

Which of the following security controls does an iris scanner provide?

Accepted Answer

Physical

Question 49

Which of the following would best accomplish full security of an FTP server while keeping the same port and protocol?

Accepted Answer

Use explicit FTPS for connections.

Question 50

During a routine audit, someone used a stale account for inappropriate websites. What could of have best prevented this?

Accepted Answer

Account expiration policy

Question 51

Which choice of network-based security controls should someone consider implementing for malicious traffic protection?

Accepted Answer

ACLs

Question 52

Which of the following can be provided to an AAA system for the identification phase?

Accepted Answer

Username

Question 53

An attacker compromises a CA and issues unauthorized X.509 certificates. What would help the company fix the public CA?

Accepted Answer

Certificate pinning

Question 54

A mobile application is being developed. What security activities should be used to discover it's vulnerabilities?

Accepted Answer

Code review

Question 55

What works by implanting software on a system but delays execution until a specific set of conditions is met?

Accepted Answer

Logic Bomb

Question 56

Which of the following types of keys is found in a key escrow?

Accepted Answer

Private

Question 57

Which of the following should identify critical systems and components?

Accepted Answer

BCP

Question 58

Which of the following threat actors is most likely to steal a company’s proprietary information to gain a market edge?

Accepted Answer

Competitor

Question 59

Which of the following implements two-factor authentication?

Accepted Answer

At ATM requiring a credit card and PIN.

Question 60

An information security analyst should seek out which type of employee that can answer questions about specific data?

Accepted Answer

Owner

CompTIA Security+ Exam Questions (Practice)

Questions 60

CompTIA Security+ Exam Questions (Practice)

Questions 60