SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security + Exam
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. What asymmetric key is used to encrypt when using HTTPS?
Warning
: Invalid argument supplied for foreach() in
/var/www/html/basicversity.com/show_quiz.php
on line
183
2. Which of the following web application security weaknesses can be mitigated by preventing the use of HTML tags?
Hierarchical list of critical systems
Cross-site scripting
Clustering
Symmetric
3. An existing application has never been assessed from a security perspective. Which of the following is the BEST assessment technique in order to identify the application's security posture?
Install a network-based IDS
Baseline reporting
Bluesnarfing
Availability
4. Several staff members working in a datacenter have reported instances of tailgating. Which of the following could be implemented to prevent this security concern?
extremely slow and numerous antivirus alerts
Mantraps
IPv6
HSM
5. Your daily bandwidth monitoring report of your Internet connection shows an excessive amount of outgoing traffic on port 25. You have seen peaks in the reports before but this report shows many peaks outside office times. What should you do?
Mantrap
Check if relaying is denied for unauthorized domains
IKE
Steganography
6. You are performing risk assessment for an organization. What should you do during impact assessment?
Separation of duties
Determine the potential monetary costs related to a threat
Clean desk policy
Ensure a proper chain of custody
7. A security firm has been engaged to assess a software application. A production-like test environment login details - production documentation and source code have been provided. Which of the following types of testing is being described?
SSL
MAC
Clean desk policy
White box
8. A targeted email attack sent to the company's Chief Executive Officer (CEO) is known as which of the following?
Apply a security control which ties specific ports to end-device MAC addresses and prevents additional devices from being connected to the network.
Whaling
Content filtering
MS-CHAP
9. Which of the following devices is used to optimize and distribute data workloads across multiple computers or networks?
Implicit deny
Risk assessmentproduct Answer: D
Load balancer
Risk transference
10. Which of the following ports would a security administrator block if the administrator wanted to stop users from accessing outside SMTP services?
25
se file servers attached to an NAS system.
Bluesnarfing
Check if relaying is denied for unauthorized domains
11. Which of the following network devices would MOST likely be used to detect but not react to suspicious behavior on the network?
Add input validation to forms.
Asset value
NIDS
Birthday - Full name
12. Which of the following can prevent an unauthorized employee from entering a data center?
Vulnerability scanner
Mantrap
Security guard - Proximity reader
Run the image through SHA256. Answer: D
13. Which of the following should the security administrator look at FIRST when implementing an AP to gain more coverage?
Loop protection
mitigation - acceptance - transference
Software as a Service (SaaS)
Power levels
14. Which of the following should be performed on a computer to protect the operating system from malicious software?
Visibility - Accessibility - Neighborhood crime rate
NIPS is blocking activities from those specific websites.
Disable unused services - Update HIPS signatures
Fiber optic
15. Which of the following is the default rule found in a corporate firewall's access control list?
Spear phishing
Integrity
Cognitive passwords
Deny all
16. A system administrator could have a user level account and an administrator account to prevent:...
Risk assessmentproduct Answer: D
escalation of privileges.
WPA2
Accountability
17. You need to advise a new wiring system for a company with several locations partly open to the public. A primary requirement is to make tapping into the network as difficult as possible. Which of the following cable types should you advice?
The server is missing the default gateway.
Privacy policy
Segmentation of each wireless user from other wireless users
Fiber optic
18. A rogue access point with the same SSID as the production wireless network is found. Which of the following BEST describes this attack?
CCTV
Vulnerability scanning
Evil twin
Check if relaying is denied for unauthorized domains
19. Which of the following is the BEST choice for encryption on a wireless network?
Enact a policy banning users from bringing in personal music devices.
WPA2-PSK
TPM
Integrity and Authentication
20. You are designing a secure application environment. You need to ensure that data is kept as secure as possible. You need to select the strictest access control model. What access control model should you use?
MAC
Change Management System
Check if relaying is denied for unauthorized domains
se file servers attached to an NAS system.
21. Which of the following will educate employees about malicious attempts from an attacker to obtain bank account information?
Software as a Service (SaaS)
Diffie-Hellman
Phishing techniques
Fiber optic
22. A user receives an automated call which appears to be from their bank. The automated recording provides details about the bank's privacy policy security policy and requests that the user clearly state their name - birthday and enter the banking detai
se file servers attached to an NAS system.
content inspection.
IPv6
Vishing
23. Which of the following attacks is NOT aimed at fragmentation vulnerabilities of the IP stack?
Smurf attack
WPA2
Buffer overflow
1433
24. Which of the following is NOT an application layer security protocol?
Availability
IPSec
DMZ
Spear phishing
25. Network users whose computers are running Windows7 complain that the extra windows that appear when they browse the Internet are becoming a nuisance. You need to minimize how often these windows appear. What should you do?
ACLs
Validate input to remove hypertext
By masking the IP address of internal computers from the Internet
Configure the IE popup blockers
26. Which of the following is the MOST likely cause of a single computer communicating with an unknown IRC server and scanning other systems on the network?
Hot and cold aisles
Mandatory vacation
Botnet
DAC
27. Data can potentially be stolen from a disk screen-lock protected - smartphone by which of the following?
Tailgating
Bluesnarfing
Hierarchical list of critical systems
22
28. Used in conjunction which of the following are PII?
Dumpster diving
Privacy policy
Data Encryption Standard (DES)
Birthday - Full name
29. What allows for all activities on a network or system to be traced to the user who performed them?
A system that stops an attack in progress.
Judgment
Accountability
Software as a Service (SaaS)
30. An application log shows that the text 'test; rm -rf /etc/passwd' was entered into an HTML form. Which of the following describes the type of attack that was attempted?
Network Access Control
Buffer overflow
Command injection
Polymorphic
31. During the analysis of malicious code a security analyst discovers JavaScript being used to send random data to another service on the same system. This is MOST likely an example of which of the following?
Detective
The remote router has ICMP blocked.
Baseline reporting
Buffer overflow
32. An administrator identifies a security issue on but does not attempt to exploit it. Which of the following describes what the administrator has done?
Vulnerability scanning
Shielding
Trojans
Vulnerability scan
33. For which of the following is centralized key management most complicated?
Hardware RAID 5 - Software RAID 1
80 - 443
Symmetric Key
A system that stops an attack in progress.
34. Which of the following devices is often used to cache and filter content?
Change Management System
Run the image through SHA256. Answer: D
Proxies
Minimize risk of physical data theft. - Minimize the impact of the failure of any one file server.
35. Which of the following access control models allows classification and labeling of objects?
IPv6
MAC
Asymmetric and Hashing
MAC address
36. The security administrator notices a number of TCP connections from the development department to the test network segregation. Large volumes of data are being transmitted between the two networks only on port 22. Which of the following is MOST likel
The development team is transferring data to test systems using SFTP and SCP.
Footprinting
Multi-factor authentication.
SNMP (also use to monitor the parameters of network devices)
37. Which of the following is a best practice when securing a switch from physical access?
Polymorphic
Disable unused ports
Security guard - Proximity reader
Mandatory vacations
38. Which of the following risks may result from improper use of social networking and P2P software?
Content filtering
NIPS is blocking activities from those specific websites.
Information disclosure
Visibility - Accessibility - Neighborhood crime rate
39. Which of the following environmental controls would BEST be used to regulate cooling within a datacenter?
Organize data based on severity and asset value.
Cross-site scripting
Hot and cold aisles
Dumpster diving - Shoulder surfing
40. Which of the following is the BEST way to secure data for the purpose of retention?
Virtual servers have the same information security requirements as physical servers.
Vulnerability scan
Off-site backup
WPA Enterprise
41. Which environmental control is part of TEMPEST compliance?
To provide documentation as to who has handled the evidence
Rogue access points
Shielding
Privacy policy
42. A set of instructions normally implemented on a computer system as a procedure to manipulate data is called a(n)?
Algorithm
Run the image through SHA256. Answer: D
The server is missing the default gateway.
Diffie-Hellman
43. In which of the following locations would a forensic analyst look to find a hooked process?
BIOS
VLAN segregation
The new access point was mis-configured and is interfering with another nearby access point.
Software as a Service (SaaS)
44. What port does the Domain Name Service (DNS) use by default?
Before and after the imaging process and then hash the forensic image
Disable unused ports
Video surveillance
53
45. A security administrator working for a health insurance company needs to protect customer data by installing an HVAC system and a mantrap in the data center. Which of the following are being addressed?
IKE
53
1433
Confidentiality - Availability
46. What asymmetric key is used to decrypt when using HTTPS?
Warning
: Invalid argument supplied for foreach() in
/var/www/html/basicversity.com/show_quiz.php
on line
183
47. Which of the following is specific to a buffer overflow attack?
Initial vector
Provider cloud
ACLs
Vulnerability scanner
48. Which of the following is true regarding the WTLS protocol?
Integrity and Authentication
Block port 23 on the network firewall.
It is used to provide data encryption for WAP connections.
User rights and permissions reviews
49. Which of the following is used when performing a quantitative risk analysis?
Footprinting
Social Engineering attack
TCP SYN flood attack
Asset value
50. Which of the following should be enabled to ensure only certain wireless clients can access the network?
MAC filtering
Confidentiality
mitigation - acceptance - transference
Vulnerability scan