Test your basic knowledge |

Comptia Security +: Cyber Ops

Subjects : certifications, comptia-security-+, it-skills

Instructions:

Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. The fundamental information security principals include confidentiality - availability and which of the following?
SQL injection
Temperature and humidity controls
The capacity of a system to resist unauthorized changes to stored information
Account lockout

2. River Tam - a security analyst - discovers which operating systems the client devices on the network are running by only monitoring a mirror port on the router. Which of the following techniques did River Tam use?
Passive finger printing
RAS
PEAP-MSCHAPv2
NAC

3. Jayne - a security administrator - has noticed that the website and external systems have been subject to many attack attempts. To verify integrity of the website and critical files - Jayne should
Create file hashes for website and critical system files - and compare the current file hashes to the baseline at regular time intervals.
Mandatory vacations
The capacity of a system to resist unauthorized changes to stored information
Antenna placement; Power levels

4. Which of the following control types is video monitoring?
Detective
Logic bomb
Install application updates
Port scan

5. Which of the following could River Tam - an administrator - use in a workplace to remove sensitive data at rest from the premises?
Personally owned devices
Confidentiality
Penetration testing
80

6. When integrating source material from an open source project into a highly secure environment - which of the following precautions should prevent hidden threats?
Code review
Mandatory vacations
Mandate additional security awareness training for all employees.
Social engineering

7. River Tam - a security administrator - has generated a key pair for the company web server. Which of the following should she do next to ensure all web traffic to the company web server is encrypted?
Penetration test
Continuous monitoring
Install both the private and the public key on the web server.
Use Starbuck's private key to sign the binary

8. Mal - a security engineer - is trying to inventory all servers in a rack. The engineer launches RDP sessions to five different PCs and notices that the hardware properties are similar. Additionally - the MAC addresses of all five servers appear on th
Detective
Mandated security configurations have been made to the operating system.
SSH
The system is virtualized

9. Which of the following is where an unauthorized device is found allowing access to a network?
Rogue access point
Mean time to restore
Warm site
Proxy server

10. Which of the following is the purpose of the spanning tree protocol?
Clustering
Loop protection
Cipher lock combination and proximity badge
Error handling

11. Which of the following may cause Starbuck - the security administrator - to seek an ACL work around?
Change management
Zero day exploit
File encryption
SSH

12. Which of the following should River Tam - a security technician - perform as the FIRST step when creating a disaster recovery plan for a mission critical accounting system?
Improper input validation
Two fish
Business impact assessment
23

13. Which of the following would Mal - a security administrator - change to limit how far a wireless signal will travel?
Application hardening
Power levels
Remotely initiate a device wipe
Port scan

14. The log management system at Company A is inadequate to meet the standards required by their corporate governance team. A new automated log management system has been put in place. This is an example of which of the following?
WPA2-Enterprise
Risk
Continuous monitoring
Zero day

15. The Chief Information Officer (CIO) wants to protect laptop users from zero day attacks. Which of the following would BEST achieve the CIO's goal?
Host based firewall
Confidentiality
Mandatory access control
Use Starbuck's private key to sign the binary

16. While traveling - users need access to an internal company web server that contains proprietary information. Mal - the security administrator - should implement a...
Separation of duties
Impersonation
RAS
DES;3 DES

17. Which of the following open standards should Mal - a security administrator - select for remote authentication of users?
Personal firewall
Shoulder surfing
NTLM
RADIUS

18. Starbuck - a security administrator - has applied security labels to files and folders to manage and restrict access. Which of the following is Starbuck using?
MD5 checksum
WPA2-PSK
Single point of failure
Mandatory access control

19. River Tam - an attacker - is recording a person typing in their ID number into a keypad to gain access to the building. River Tam then calls the helpdesk and informs them that their PIN no longer works and would like to change it. Which of the follow
Error handling
NTLM
Shoulder surfing
Impersonation

20. Which of the following is based on X.500 standards?
LDAP
Signature based
Deploy an anti-spam device to protect the network.
PEAP-MSCHAPv2

21. Which of the following authentication protocols forces centralized wireless authentication?
Blue jacking
CA
WPA2-Enterprise
Change management

22. River Tam - a network security administrator - has been tasked with setting up a guest wireless network for her corporation. The requirements for this connection state that it must have password authentication - with passwords being changed every wee
River Tam - the attacker - overwhelms a system or application - causing it to crash and bring the server down to cause an outage.
MAC filtering
WPA2-PSK
IPS

23. Which of the following allows a server to request a website on behalf of Starbuck - a user?
DES;3 DES
Mandatory Access Controls
Spam filter
Proxies

24. Which of the following implements two factor authentication based on something you know and something you have?
The system shall require users to authenticate to the system with a combination of a password or PIN and a smartcard
Input validation
Use Starbuck's private key to sign the binary
80

25. Which of the following accurately describes the STRONGEST multifactor authentication?
Personally owned devices
Mitigation
Server-side input validation results in a more secure system than client-side input validation.
Something you are - something you have

26. Mal - a security administrator - has configured and implemented an additional public intermediate CA. Which of the following must Mal submit to the major web browser vendors in order for the certificates - signed by this intermediate - to be trusted?

27. Which of the following malware types is MOST commonly associated with command and control?
Shoulder surfing
Signature based
Something you are
Botnets

28. Which of the following procedures would be used to mitigate the risk of an internal developer embedding malicious code into a production system?
Cross-site scripting
Cross-site scripting
Change management
RAS

29. Which of the following activities should be completed in order to detect anomalies on a network?
Install both the private and the public key on the web server.
Log reviews
Accounting should be given read/write access to network share A and read access to network share B. River Tam should be given read access for the specific document on network share A.
Antenna placement; Power-level control

30. Which of the following functions of a firewall allows Mal - an administrator - to map an external service to an internal host?
RAS
Port forwarding
Mandatory Access Controls
Account lockout

31. Employees are reporting that they are receiving unusual calls from the help desk for the purpose of verifying their user credentials. Which of the following attack types is occurring?
Dictionary; Brute force
Account lockout
Impact; Likelihood
Vishing

32. Starbuck - an IT security technician working at a bank - has implemented encryption between two locations. Which of the following security concepts BEST exemplifies the protection provided by this example?
Ticket granting server
Single point of failure
Remote wipe
Confidentiality

33. Which of the following BEST describes a denial of service attack?
File encryption
River Tam - the attacker - overwhelms a system or application - causing it to crash and bring the server down to cause an outage.
Group based privileges
VLAN mismatch is occurring.

34. The human resources department of a company has requested full access to all network resources - including those of the financial department. Starbuck - the administrator - denies this - citing...
Account expiration
Separation of duties
Firewall
Two fish

35. A company has sent all of its private keys to a third party. The third party company has created a secure list of these keys. Which of the following has just been implemented?
The DES algorithm is run three consecutive times against the item being encrypted.
Fraggle attack
Sanitization using appropriate software
Key escrow

36. Which of the following would MOST likely be implemented in order to prevent employees from accessing certain websites?
Proxy server
23
dcfldd
Loop protection

37. Which of the following is a reason why Mal - a security administrator - would implement port security?
IPS
Software as a Service
To limit the number of endpoints connected through the same switch port
Zero day exploit

38. A company notices that there is a flaw in one of their proprietary programs that the company runs in-house. The flaw could cause damage to the HVAC system. Which of the following would the company transfer to an insurance company?
Notify security to identify employee's whereabouts.
Succession planning
Risk
Public key

39. Which of the following BEST allows Mal - a security administrator - to determine the type - source - and flags of the packet traversing a network for troubleshooting purposes?
Integrity
Protocol analyzers
Sanitization using appropriate software
Rootkit

40. Starbuck - a security administrator - has completed the imaging process for 20 computers that were deployed. The image contains the operating system and all required software. Which of the following is this an example of?
Deploying and using a trusted OS
Mitigate risk and develop a maintenance plan.
Validate the identity of an email sender;Encrypt messages;Decrypt messages
Firewall

41. Which of the following inspects traffic entering or leaving a network to look for anomalies against expected baselines?
Enforced acceptable usage policy - encryption of confidential emails - and monitoring of communications leaving the organization.
Private key
Vishing
IPS

42. The accounting department needs access to network share A to maintain a number of financial reporting documents. The department also needs access to network share B in HR to view payroll documentation for cross-referencing items. River Tam - an admin
Clean desk policy
Anti-spam
MD5
Accounting should be given read/write access to network share A and read access to network share B. River Tam should be given read access for the specific document on network share A.

43. Which of the following should Mal - an administrator - use to verify the integrity of a downloaded file?
Account lockout
MD5
Information classification policy; Network access policy; Auditing and monitoring policy
PEAP

44. When used alone - which of the following controls mitigates the risk of River Tam - an attacker - launching an online brute force password attack?
Account lockout
Detective
Proxy server
UDP 53

45. Which of the following is BEST associated with PKI?
Install both the private and the public key on the web server.
Private key
Signature based
Firewall

46. Traffic has stopped flowing to and from the company network after the inline IPS hardware failed. Which of the following has occurred?
It is faster to encrypt an individual file.
Failsafe
NIPS
Zero day attack

47. Which of the following is a policy that would force all users to organize their areas as well as help in reducing the risk of possible data theft?
Application hardening
Clean desk policy
Code review
Penetration testing

48. An administrator responsible for building and validating security configurations is a violation of which of the following security principles?
Separation of duties
The IDS does not identify a buffer overflow
Cross-site scripting
Port scanner

49. Which of the following will help Jayne - an administrator; mitigate the risk of static electricity?
SSH
Deploy an anti-spam device to protect the network.
DES;3 DES
Humidity controls

50. Which of the following is the BEST solution to securely administer remote servers?
23
SSH
Proxy server
Ask the programmer to replicate the problem in a test environment.