Test your basic knowledge |

Comptia Security +: Cyber Ops

Subjects : certifications, comptia-security-+, it-skills

Instructions:

Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. River Tam - an administrator - suspects a denial of service attack on the network - but does not know where the network traffic is coming from or what type of traffic it is. Which of the following would help River Tam further assess the situation?
Mandatory vacations
Warm site
Protocol analyzer
Something you are - something you have

2. The log management system at Company A is inadequate to meet the standards required by their corporate governance team. A new automated log management system has been put in place. This is an example of which of the following?
Shoulder surfing
IV attack
Mandated security configurations have been made to the operating system.
Continuous monitoring

3. Which of the following implements two factor authentication based on something you know and something you have?
The system shall require users to authenticate to the system with a combination of a password or PIN and a smartcard
Use Starbuck's private key to sign the binary
Account lockout
Continuous monitoring

4. While traveling Jayne - an employee - decides he would like to download some new movies onto his corporate laptop. While installing software designed to download movies from multiple computers across the Internet. Jayne agrees to share portions of hi
NIPS
River Tam - the attacker - overwhelms a system or application - causing it to crash and bring the server down to cause an outage.
P2P
PEAP-MSCHAPv2

5. Mal - a network administrator - implements the spanning tree protocol on network switches. Which of the following issues does this address?
Confidentiality
Compare hashes of the original source and system image.
Loop protection
Vishing

6. Which of the following is an example of authentication using something Starbuck - a user - has and something she knows?
dcfldd
Mandatory access control
PGP
GSM phone card and PIN

7. 3DES is created when which of the following scenarios occurs?
MD5
Rogue access point
The DES algorithm is run three consecutive times against the item being encrypted.
Subnetting

8. Which of the following combinations represents multifactor authentication?
Penetration test
Business impact assessment
Cipher lock combination and proximity badge
Full disk encryption

9. Which of the following are security relevant policies?
Port forwarding
Protocol analyzer
Information classification policy; Network access policy; Auditing and monitoring policy
Impersonation

10. In the event of a mobile device being lost or stolen - which of the following BEST protects against sensitive information leakage?
Cable locks
The DES algorithm is run three consecutive times against the item being encrypted.
The system shall require users to authenticate to the system with a combination of a password or PIN and a smartcard
Remote wipe

11. Mal - a user - submitted a form on the Internet but received an unexpected response shown below Server Error in "/" Application Runtime error in script on asp.net version 2.0 Which of the following controls should be put in place to prevent Mal from
Create file hashes for website and critical system files - and compare the current file hashes to the baseline at regular time intervals.
NIPS
Error handling
TACACS+; SSH

12. Which of the following would River Tam - a security administrator - utilize to identity a weakness within various applications without exploiting that weakness?
Use Starbuck's private key to sign the binary
Software as a Service
Vulnerability scan
Rogue access point

13. Which of the following web application security weaknesses can be mitigated by preventing the use of HTML tags?
Cross-site scripting
To limit the number of endpoints connected through the same switch port
Private key
Social engineering

14. Mal - a user - is having trouble dialing into the network from their house. The administrator checks the RADIUS server - the switch connected to the server - and finds that the switch lost configuration after a recent power outage. The administrator
Botnets
To limit the number of endpoints connected through the same switch port
VLAN mismatch is occurring.
Server-side input validation results in a more secure system than client-side input validation.

15. Starbuck - a user - has reported an increase in email phishing attempts. Which of the following can be implemented to mitigate the attacks?
Anti-spam
LDAP
PGP
Install both the private and the public key on the web server.

16. Which of the following multifactor authentication methods uses biometrics?
CRL
Something you are
MAC filtering
Use Starbuck's private key to sign the binary

17. Jayne - the security administrator - notices a spike in the number of SQL injection attacks against a web server connected to a backend SQL database. Which of the following practices should be used to prevent an application from passing these attacks
Input validation
The capacity of a system to resist unauthorized changes to stored information
WPA2-PSK
Power levels

18. Which of the following technologies would allow the removal of a single point of failure?
Dual-homing a server
Change management
Disable unused ports
Vishing

19. River Tam - a security guard - reports that the side of the company building has been marked with spray paint. Which of the following could this be an example of?
Device encryption
Enforced acceptable usage policy - encryption of confidential emails - and monitoring of communications leaving the organization.
War chalking
Protocol analyzer

20. Which of the following security controls enforces user permissions based on a job role?
IV attack
Port forwarding
Install both the private and the public key on the web server.
Group based privileges

21. Mal - a security administrator - has observed repeated attempts to break into the network. Which of the following is designed to stop an intrusion on the network?
NIPS
Group based privileges
Full disk
Separation of duties

22. Jayne - a server administrator - sets up database forms based on security rating levels. If a user has the lowest security rating then the database automatically determines what access that user has. Which of the following access control methods does
MAC filtering
Social engineering
Mandatory access control
Two fish

23. Mal - a security administrator - wants to secure remote telnet services and decides to use the services over SSH. Which of the following ports should Mal allow on the firewall by default?
22
Device encryption
River Tam - the attacker - overwhelms a system or application - causing it to crash and bring the server down to cause an outage.
Shoulder surfing

24. Which of the following protocols provides Mal - an administrator - with the HIGHEST level of security for device traps?
Sanitization using appropriate software
SNMPv3
Mandated security configurations have been made to the operating system.
Remote data wipe

25. Which of the following BEST describes a denial of service attack?
Warm site
Integrity
Port scan
River Tam - the attacker - overwhelms a system or application - causing it to crash and bring the server down to cause an outage.

26. Mal - a security engineer - is trying to inventory all servers in a rack. The engineer launches RDP sessions to five different PCs and notices that the hardware properties are similar. Additionally - the MAC addresses of all five servers appear on th
The system is virtualized
Deploying and using a trusted OS
Zero day
NIPS

27. Which of the following BEST explains the security benefit of a standardized server image?
Fail state of the system
Detective
SQL injection
Mandated security configurations have been made to the operating system.

28. Which of the following is based on X.500 standards?
LDAP
Anti-spam
P2P
Notify security to identify employee's whereabouts.

29. Which of the following is a policy that would force all users to organize their areas as well as help in reducing the risk of possible data theft?
MAC filtering
NIPS
Server-side input validation results in a more secure system than client-side input validation.
Clean desk policy

30. Which of the following mitigates the risk of proprietary information being compromised?
Protocol analyzers
Dictionary; Brute force
File encryption
WPA2-Enterprise

31. Which of the following can River Tam - a security administrator - implement to ensure that encrypted files and devices can be recovered if the passphrase is lost?
The system is virtualized
Logic bomb
Key escrow
Signature based

32. Which of the following is the purpose of the spanning tree protocol?
Loop protection
Detective
The intermediate CA's public key
Failsafe

33. River Tam - a security analyst - discovers which operating systems the client devices on the network are running by only monitoring a mirror port on the router. Which of the following techniques did River Tam use?
UDP 53
Single sign-on
Passive finger printing
Something you are

34. Which of the following data loss prevention strategies mitigates the risk of replacing hard drives that cannot be sanitized?
RAID 5 and a storage area network
Full disk encryption
Dictionary; Brute force
PGP

35. Which of the following elements makes up the standard equation used to define risk?
WPA2-PSK
CA
The system is virtualized
Impact; Likelihood

36. The public key is used to perform which of the following?
Establish a MAC limit and age
Validate the identity of an email sender;Encrypt messages;Decrypt messages
Account expiration
Remote wipe

37. Which of the following should be implemented to restrict wireless access to the hardware address of a NIC?
MAC filtering
Single sign-on
Proxies
Disable unused ports

38. Mal - a security administrator - has configured and implemented an additional public intermediate CA. Which of the following must Mal submit to the major web browser vendors in order for the certificates - signed by this intermediate - to be trusted?

39. A computer is put into a restricted VLAN until the computer's virus definitions are up-to-date. Which of the following BEST describes this system type?
PEAP-MSCHAPv2
Impersonation
NAC
Discretionary access control

40. A company is installing a wireless network in a building that houses several tenants. Which of the following should be considered to make sure none of the other tenants can detect the company's wireless network?
Botnets
Server-side input validation results in a more secure system than client-side input validation.
Antenna placement; Power levels
Warm site

41. Mal - a security administrator - would like to implement laptop encryption to protect data. The Chief Executive Officer (CEO) believes this will be too costly to implement and decides the company will purchase an insurance policy instead. Which of th
SNMPv3
Risk avoidance
Failsafe
Fail state of the system

42. Which of the following is the BEST solution to securely administer remote servers?
SSH
Temperature and humidity controls
Zero day attack
Warm site

43. Which of the following techniques floods an application with data in an attempt to find vulnerabilities?
Fuzzing
The capacity of a system to resist unauthorized changes to stored information
Penetration test
Full disk encryption

44. Which of the following procedures would be used to mitigate the risk of an internal developer embedding malicious code into a production system?
Personal firewall
Notify security to identify employee's whereabouts.
Change management
To limit the number of endpoints connected through the same switch port

45. Which of the following could River Tam - an administrator - use in a workplace to remove sensitive data at rest from the premises?
Private key
UDP 53
Personally owned devices
PEAP-MSCHAPv2

46. Workers of a small local organization have implemented an off-site location in which the organization can resume operations within 10 business days in the event of a disaster. This type of site is BEST known as which of the following?
AP power levels
Deploying and using a trusted OS
ARP poisoning
Cold site

47. After setting up a root CA. which of the following can Mal - a security administrator - implement to allow intermediate CAs to handout keys and certificates?
Trust model
Zero day attack
22
TPM

48. Which of the following is BEST utilized to actively test security controls on a particular system?
E-discovery
Zero day exploit
Penetration test
SNMPv3

49. When reviewing a digital certificate for accuracy - which of the following would Jayne - a security administrator - focus on to determine who affirms the identity of the certificate owner?
CA
Vulnerability scan
Encrypt all confidential data.
Information classification policy; Network access policy; Auditing and monitoring policy

50. Which of the following malware types is MOST likely to execute its payload after Starbuck - an employee - has left the company?
Discretionary access control
Input validation
Vishing
Logic bomb