Test your basic knowledge |

Comptia Security + Exam

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A small company needs to invest in a new expensive database. The company's budget does not include the purchase of additional servers or personnel. Which of the following solutions would allow the small company to save money on hiring additional pers






2. Which of the following network devices would MOST likely be used to detect but not react to suspicious behavior on the network?






3. A security administrator needs to implement a site-to-site VPN tunnel between the main office and a remote branch. Which of the following protocols should be used for the tunnel?






4. Logs from an IDS show that a computer has been compromised with a botnet and is actively communicating with a command and control which of the following data types will be unavailable for later investigation?






5. Which of the following authentication protocols utilizes the MD4 hashing algorithm?






6. You want to improve security for remote administration to several Linux web servers on the Internet. The data as well as the authentication process needs to be encrypted. Which of the following should you do?






7. A security administrator wants to determine what data is allowed to be collected from users of the corporate Internet-facing web application. Which of the following should be referenced?






8. Which of the following MUST a programmer implement to prevent cross-site scripting?






9. Which of the following are accomplished when a message is digitally signed?






10. Which of the following is a method to prevent ad-hoc configuration mistakes?






11. The server log shows 25 SSH login sessions it is a large company and the administrator does not know if this is normal behavior or if the network is under attack. Where should the administrator look to determine if this is normal behavior?






12. Used in conjunction which of the following are PII?






13. Which solution should you use?






14. Which of the following should be performed on a computer to protect the operating system from malicious software?






15. You are performing risk assessment for an organization. What should you do during impact assessment?






16. A helpdesk engineer just received a phone call from an administrator at a remote branch office. The administrator claimed to have forgotten the password for the root account of the UNIX servers. Although the helpdesk engineer didn't know of any admin






17. Which of the following BEST describes the proper method and reason to implement port security?






18. Which of the following would be the BEST action to perform when conducting a corporate vulnerability assessment?






19. Which of the following should the security administrator look at FIRST when implementing an AP to gain more coverage?






20. Upon investigation an administrator finds a suspicious system-level kernel module which modifies file system operations. This is an example of which of the following?






21. The detection of a NOOP sled is an indication of which of the following attacks?






22. A security firm has been engaged to assess a software application. A production-like test environment login details - production documentation and source code have been provided. Which of the following types of testing is being described?






23. Which of the following threats corresponds with an attacker targeting specific employees of a company?






24. Which of the following is MOST relevant to a buffer overflow attack?






25. Which of the following malicious code will do its objectionable deed after a predetermined action takes place or at a specific time?






26. Which of the following functions is MOST likely performed by a web security gateway?






27. You are looking for ways to protect data on a network. Your solution should: Provide for easy backup of all user data.






28. You installed a new e-commerce application on your web server that will allow your company to take orders from their website. You want to ensure that information that customers enter into their web browser is sent securely to the web server. Which of






29. A programmer allocates 16 bytes for a string but does not adequately ensure that more than 16 bytes cannot be copied into the variable. This program may be vulnerable to which of the following attacks?






30. You are designing a secure application environment. You need to ensure that data is kept as secure as possible. You need to select the strictest access control model. What access control model should you use?






31. A system administrator could have a user level account and an administrator account to prevent:...






32. Which of the following includes a photo and can be used for identification?






33. Which of the following is the BEST way to secure data for the purpose of retention?






34. Which of the following devices BEST allows a security administrator to identify malicious activity after it has occurred?






35. Which of the following is MOST commonly a part of routine system audits?






36. Which of the following is a best practice when securing a switch from physical access?






37. During the analysis of malicious code a security analyst discovers JavaScript being used to send random data to another service on the same system. This is MOST likely an example of which of the following?






38. Which of the following is a technique designed to obtain information from a specific person?






39. Data can potentially be stolen from a disk screen-lock protected - smartphone by which of the following?






40. NIDS can also be used to help identify...






41. A rogue access point with the same SSID as the production wireless network is found. Which of the following BEST describes this attack?






42. Which of the following is specific to a buffer overflow attack?






43. Which of the following attacks is manifested as an embedded HTML image object or JavaScript image tag in an email?






44. Which of the following protocols should be blocked at the network perimeter to prevent host enumeration by sweep devices?






45. Which of the following manages peer authentication and key exchange for an IPSec connection?






46. Which of the following should NOT be used with username/password authentication?






47. You need to advise a new wiring system for a company with several locations partly open to the public. A primary requirement is to make tapping into the network as difficult as possible. Which of the following cable types should you advice?






48. What can you prevent when you deploy wireless devices inside a TEMPEST-certified building?






49. Which of the following describes the purpose of chain of custody as applied to forensic image retention?






50. Which of the following attacks would password masking help mitigate?