SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Cyber Ops
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Which of the following combinations represents multifactor authentication?
Worm outbreak
Cross-site scripting
Create file hashes for website and critical system files - and compare the current file hashes to the baseline at regular time intervals.
Cipher lock combination and proximity badge
2. Which of the following is BEST associated with PKI?
Cold site
Private key
Evil twin
The capacity of a system to resist unauthorized changes to stored information
3. Which of the following does Starbuck - a software developer - need to do after compiling the source code of a program to attest the authorship of the binary?
Warning
: Invalid argument supplied for foreach() in
/var/www/html/basicversity.com/show_quiz.php
on line
183
4. River Tam - a security administrator - suspects that a web server may be under attack. The web logs have several entries containing variations of the following entries: 'or 1=1-- or1'=1-- 'or1=1'
PEAP
Account lockout
SQL injection
Fraggle attack
5. To mitigate the adverse effects of network modifications - which of the following should Jayne - the security administrator - implement?
Change management
Remote data wipe
Clean desk policy
Mandatory vacations
6. The Chief Information Security Officer (CISO) tells the network administrator that a security company has been hired to perform a penetration test against their network. The security company asks the CISO which type of testing would be most beneficia
22
Cold site
The security company is provided with no information about the corporate network or physical locations.
Mitigate risk and develop a maintenance plan.
7. Jayne - a systems security engineer - is determining which credential-type authentication to use within a planned 802.1x deployment. He is looking for a method that does not require a client certificate - has a server side certificate - and uses TLS
Power levels
PEAP-MSCHAPv2
Humidity controls
Zero day attack
8. While performing basic forensic analysis of a hard drive in River Tam's - the security administrator - possession - which of the following should be verified during the analysis?
Impersonation
Separation of duties
Image hashes
Change management
9. A company has sent all of its private keys to a third party. The third party company has created a secure list of these keys. Which of the following has just been implemented?
Compare hashes of the original source and system image.
Key escrow
Log reviews
Risk
10. Which of the following is the MOST secure protocol for Mal - an administrator - to use for managing network devices?
Rogue access point
SSH
Update the CRL; Deploy OCSP
VLAN mismatch is occurring.
11. Which of the following security chips does BitLocker utilize?
SSH
TPM
Impersonation
It is faster to encrypt an individual file.
12. Starbuck - an administrator - is primarily concerned with blocking external attackers from gaining information on remote employees by scanning their laptops. Which of the following security applications is BEST suited for this task?
Port scanner
To limit the number of endpoints connected through the same switch port
Mandate additional security awareness training for all employees.
Personal firewall
13. Which of the following is used by Jayne - a security administrator - to lower the risks associated with electrostatic discharge - corrosion - and thermal breakdown?
Single point of failure
Temperature and humidity controls
Deploying and using a trusted OS
Cold site
14. Which of the following is based on X.500 standards?
Log reviews
LDAP
To limit the number of endpoints connected through the same switch port
PEAP-MSCHAPv2
15. Which of the following is a feature of Kerberos?
Account expiration
Humidity controls
Single sign-on
NAC
16. Mal - a network administrator - implements the spanning tree protocol on network switches. Which of the following issues does this address?
MAC filtering
Loop protection
Rootkit
Application hardening
17. Which of the following should River Tam - a security technician - perform as the FIRST step when creating a disaster recovery plan for a mission critical accounting system?
Ask the programmer to replicate the problem in a test environment.
Cable locks
Business impact assessment
AP power levels
18. Starbuck - the administrator - is tasked with deploying a strong encryption cipher. Which of the following ciphers would she be the LEAST likely to choose?
Business impact assessment
Two fish
Ticket granting server
Spam filter
19. Which of the following functions of a firewall allows Mal - an administrator - to map an external service to an internal host?
Port forwarding
Deploy an anti-spam device to protect the network.
Account expiration
File encryption
20. An administrator responsible for building and validating security configurations is a violation of which of the following security principles?
Separation of duties
Notify security to identify employee's whereabouts.
SQL injection
Enforced acceptable usage policy - encryption of confidential emails - and monitoring of communications leaving the organization.
21. Which of the following is an improved version of the LANMAN hash?
NTLM
MD5
Enforced acceptable usage policy - encryption of confidential emails - and monitoring of communications leaving the organization.
Personally owned devices
22. Which of the following are security relevant policies?
Information classification policy; Network access policy; Auditing and monitoring policy
Fail state of the system
Remote data wipe
PEAP-MSCHAPv2
23. Which of the following security concepts establishes procedures where creation and approval are performed through distinct functions?
River Tam - the attacker - overwhelms a system or application - causing it to crash and bring the server down to cause an outage.
Assign multiple roles to the existing user ID
Separation of duties
Penetration test
24. Which of the following is BEST described by a scenario where organizational management chooses to implement an internal Incident Response Structure for the business?
Use Starbuck's private key to sign the binary
Mitigation
Software as a Service
Social engineering
25. Which of the following ports would be blocked if Mal - a security administrator - wants to disable FTP?
Disable unused ports
Mandatory Access Controls
Application hardening
21
26. Which of the following is where an unauthorized device is found allowing access to a network?
Zero day
Compare hashes of the original source and system image.
Encrypt all confidential data.
Rogue access point
27. Which of the following web application security weaknesses can be mitigated by preventing the use of HTML tags?
The intermediate CA's public key
RAID 5 and a storage area network
SSH
Cross-site scripting
28. Marketing creates a new folder and requests the following access be assigned: Sales Department - Read Marketing Department - Full Control Inside Sales - Read Write This is an example of which of the following?
Install application updates
Fail state of the system
CRL
RBAC
29. A company needs to remove sensitive data from hard drives in leased computers before the computers are returned to the supplier. Which of the following is the BEST solution?
Create file hashes for website and critical system files - and compare the current file hashes to the baseline at regular time intervals.
Update the CRL; Deploy OCSP
Sanitization using appropriate software
Business impact assessment
30. Jayne - the security administrator - notices a spike in the number of SQL injection attacks against a web server connected to a backend SQL database. Which of the following practices should be used to prevent an application from passing these attacks
Humidity controls
Account expiration
Remote data wipe
Input validation
31. Which of the following practices reduces the attack surface of a wireless network?
Sanitization using appropriate software
Information classification policy; Network access policy; Auditing and monitoring policy
Antenna placement; Power-level control
Verify the user's identity
32. Mal - a security administrator - has observed repeated attempts to break into the network. Which of the following is designed to stop an intrusion on the network?
Mandatory Access Controls
LDAP
NIPS
Deploy an anti-spam device to protect the network.
33. Which of the following is the MAIN benefit of server-side versus client-side input validation?
Cold site
Server-side input validation results in a more secure system than client-side input validation.
Mandatory Access Controls
Sanitization using appropriate software
34. An example of a false negative
Botnets
Gray box
Something you are - something you have
The IDS does not identify a buffer overflow
35. A valid server-role in a Kerberos authentication system
Ticket granting server
TPM
Spam fitters
Account expiration
36. Which of the following is a reason why Mal - a security administrator - would implement port security?
Input validation
Notify security to identify employee's whereabouts.
To limit the number of endpoints connected through the same switch port
Botnets
37. Jayne - a server administrator - sets up database forms based on security rating levels. If a user has the lowest security rating then the database automatically determines what access that user has. Which of the following access control methods does
Mandatory access control
Integrity
Time of day restrictions;Access control lists
The intermediate CA's public key
38. Mal - a security administrator - would like to implement laptop encryption to protect data. The Chief Executive Officer (CEO) believes this will be too costly to implement and decides the company will purchase an insurance policy instead. Which of th
Cold site
Shoulder surfing
Risk avoidance
Ask the programmer to replicate the problem in a test environment.
39. A company notices that there is a flaw in one of their proprietary programs that the company runs in-house. The flaw could cause damage to the HVAC system. Which of the following would the company transfer to an insurance company?
Information classification policy; Network access policy; Auditing and monitoring policy
22
TPM
Risk
40. Which of the following network devices will prevent port scans?
Succession planning
The capacity of a system to resist unauthorized changes to stored information
Encrypt all confidential data.
Firewall
41. Jayne - the administrator - has been told to confirm what account an email was sent from. Which of the following is this an example of?
Proxy server
E-discovery
Clean desk policy
The system is virtualized
42. When used alone - which of the following controls mitigates the risk of River Tam - an attacker - launching an online brute force password attack?
Change management
Remotely initiate a device wipe
Account lockout
Gray box
43. 3DES is created when which of the following scenarios occurs?
The DES algorithm is run three consecutive times against the item being encrypted.
War chalking
Personal firewall
Mandatory access control
44. Which of the following attacks is manifested as an embedded HTML image object or JavaScript image tag in an email?
The system shall require users to authenticate to the system with a combination of a password or PIN and a smartcard
WPA2-Enterprise
Cross-site scripting
Information classification policy; Network access policy; Auditing and monitoring policy
45. River Tam - a security administrator - has generated a key pair for the company web server. Which of the following should she do next to ensure all web traffic to the company web server is encrypted?
MD5 checksum
RADIUS
Penetration testing
Install both the private and the public key on the web server.
46. When integrating source material from an open source project into a highly secure environment - which of the following precautions should prevent hidden threats?
Firewall
Device encryption
Code review
Failsafe
47. Traffic has stopped flowing to and from the company network after the inline IPS hardware failed. Which of the following has occurred?
Image hashes
Failsafe
Trust model
Power levels
48. Which of the following is the BEST solution to securely administer remote servers?
SSH
dcfldd
Worm outbreak
Humidity controls
49. Which of the following would be the BEST reason for Starbuck - a security administrator - to initially select individual file encryption over whole disk encryption?
The system is virtualized
Personally owned devices
It is faster to encrypt an individual file.
Fuzzing
50. A company is installing a wireless network in a building that houses several tenants. Which of the following should be considered to make sure none of the other tenants can detect the company's wireless network?
Remotely initiate a device wipe
Antenna placement; Power levels
Sanitization using appropriate software
Compare hashes of the original source and system image.