SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security + Exam
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A security administrator wants to determine what data is allowed to be collected from users of the corporate Internet-facing web application. Which of the following should be referenced?
Fault tolerance
Vishing
Privacy policy
Network Access Control
2. Which of the following is not an asymmetric system?
Firewall rulesflow of network traffic at the edge of the network
DES
Confidentiality - Availability
IDS
3. You want to improve security for remote administration to several Linux web servers on the Internet. The data as well as the authentication process needs to be encrypted. Which of the following should you do?
Off-site backup
Trojans
Use SSH to connect to the Linux shell
DAC
4. You are designing a Web-based application. You design the application so that it runs under a security context that allows only those privileges required for the application to run to minimize risk in the event of an attack. This is an example of whi
Principle of least privilege
Protocol analyzer
Hardware RAID 5 - Software RAID 1
ARP poisoning
5. Which of the following is the default rule found in a corporate firewall's access control list?
Deny all
To ensure that staff understands what data they are handling and processing
MAC address
IDS
6. You have several computers that use the NTLM authentication protocol for client authentication. Network policy requires user passwords with at least 16 characters. What hash algorithm is used for password authentication?
Mandatory vacation
MD5
FTPS
It is used to provide data encryption for WAP connections.
7. Which of the following should NOT be used with username/password authentication?
The web site's public key.
Implicit deny
Cognitive passwords
To ensure that staff understands what data they are handling and processing
8. What asymmetric key is used to decrypt when using HTTPS?
Warning
: Invalid argument supplied for foreach() in
/var/www/html/basicversity.com/show_quiz.php
on line
183
9. An application log shows that the text 'test; rm -rf /etc/passwd' was entered into an HTML form. Which of the following describes the type of attack that was attempted?
Fault tolerance
Organize data based on severity and asset value.
Command injection
mitigation - acceptance - transference
10. Which of the following is a security control that is lost when using cloud computing?
Minimize risk of physical data theft. - Minimize the impact of the failure of any one file server.
53
ARP poisoning
Physical control of the data
11. In an 802.11n network which of the following provides the MOST secure method of both encryption and authorization?
WPA Enterprise
Chain of custody
Data Encryption Standard (DES)
Mantrap
12. Which of the following threats corresponds with an attacker targeting specific employees of a company?
WPA2
Confidentiality
Spear phishing
Fraud
13. Which of the following reduces the likelihood of a single point of failure when a server fails?
Vishing
Apply a security control which ties specific ports to end-device MAC addresses and prevents additional devices from being connected to the network.
Clustering
WPA2
14. The security administrator notices a number of TCP connections from the development department to the test network segregation. Large volumes of data are being transmitted between the two networks only on port 22. Which of the following is MOST likel
Determine the potential monetary costs related to a threat
MD5
The development team is transferring data to test systems using SFTP and SCP.
Detective
15. Which of the following should be installed to prevent employees from receiving unsolicited emails?
Segmentation of each wireless user from other wireless users
DoS
Asset value
Spam filters
16. Which of the following is true regarding the WTLS protocol?
Blind FTP
It is used to provide data encryption for WAP connections.
Forward to different RDP listening ports.
NOOP instructions
17. What is the term used to describe the type of attack where a DNS server accepts and uses incorrect information from a host that does not have authority to supply that information?
System A fails open. System B fails closed.
DNS spoofing
TLS
Cross-site scripting
18. NIDS can also be used to help identify...
smurf attacks
Ensure a proper chain of custody
Having the offsite location of tapes also be the hot siteservers
VPN concentrator
19. Which of the following uses TCP port 22 by default?
WPA2-PSK
User rights
The server is missing the default gateway.
SSH - SCP - and SFTP (the MOST secure method to transfer files from a host machine)
20. A remote office is reporting they are unable to access any of the network resources from the main office. The security administrator realizes the error and corrects it. The administrator then tries to ping the router at the remote office and receives
1433
Lets you minimize the attack surface relating to the application
IKE
The remote router has ICMP blocked.
21. Which of the following port numbers is used for SCP by default?
HSM
22
smurf attacks
Business impact analysis
22. Which of the following attacks is BEST described as the interruption of network traffic accompanied by the insertion of malicious code?
MAC
1433
Man-in-the-middle
AC filtering - Disabled SSID broadcast
23. What is the advantage of using application virtualization?
ID badges
Gas
Hierarchical list of critical systems
Lets you minimize the attack surface relating to the application
24. Upon investigation an administrator finds a suspicious system-level kernel module which modifies file system operations. This is an example of which of the following?
AES and TKIP
Rootkit
A system that stops an attack in progress.
Spam filters
25. The detection of a NOOP sled is an indication of which of the following attacks?
VLAN
By masking the IP address of internal computers from the Internet
22
Buffer overflow
26. You want to setup a secure method of sending and receiving email. Which two of the following protocols can be used for this purpose?
DNS spoofing
Judgment
ARP poisoning
S/MIME PGP
27. Your daily bandwidth monitoring report of your Internet connection shows an excessive amount of outgoing traffic on port 25. You have seen peaks in the reports before but this report shows many peaks outside office times. What should you do?
Check if relaying is denied for unauthorized domains
Cognitive passwords
Mandated security configurations have been made to the operating system.
Load balancer
28. In order to provide flexible working conditions a company has decided to allow some employees remote access into corporate headquarters. Which of the following security technologies could be used to provide remote access?
Cognitive passwords
Rogue access points
Evil twin
Firewall - VPN
29. How a Trojan works: A user downloads a keygen to install pirated software. After running the keygen - system performance is ________________ are displayed.
extremely slow and numerous antivirus alerts
Protocol analyzer
Asymmetric and Hashing
Rootkit
30. Which of the following environmental variables reduces the potential for static discharges?
CAC
Buffer overflow
Load balancer
Humidity
31. Upper management decides which risk to mitigate based on cost. This is an example of:
Hot and cold aisles
VPN concentrator
quantitative risk assessment
The security posture is enabled on the network and remediation must take place before access is given to the visitor on that laptop.
32. Which of the following should be reviewed periodically to ensure a server maintains the correct security configuration?
User rights
DAC
ICMP
It is used to provide data encryption for WAP connections.
33. You discover that company confidential information is being encoded into graphics files and sent to a destination outside of the company. This is an example of what kind of cryptography?
PEAP-TLS
Risk assessmentproduct Answer: D
Steganography
To provide documentation as to who has handled the evidence
34. The 64 bit block cipher with 16 iterations giving a 56 bit key is called?
Data Encryption Standard (DES)
Command injection
TLS
A worm is self-replicating
35. Which of the following is the BEST way to secure data for the purpose of retention?
Content filtering
Evil twin
Social Engineering attack
Off-site backup
36. Your organization has an existing server and you want to add a hardware device to provide encryption capabilities. What is the easiest way to accomplish this?
HSM
Logic Bomb
Vulnerability scan
Principle of least privilege
37. Which of the following would be the BEST action to perform when conducting a corporate vulnerability assessment?
To provide documentation as to who has handled the evidence
Organize data based on severity and asset value.
Rogue access point
Lets you minimize the attack surface relating to the application
38. Which of the following attacks is NOT aimed at fragmentation vulnerabilities of the IP stack?
mitigation - acceptance - transference
Disable unused services - Update HIPS signatures
Smurf attack
Check if relaying is denied for unauthorized domains
39. Which type of virus is able to alter its own code to avoid being detected by anti-virus software?
War driving
The security posture is enabled on the network and remediation must take place before access is given to the visitor on that laptop.
Polymorphic
Protocol analyzer
40. Which of the following is specific to a buffer overflow attack?
To provide documentation as to who has handled the evidence
AES and TKIP
WPA Enterprise
Initial vector
41. A new enterprise solution is currently being evaluated due to its potential to increase the company's profit margins. The security administrator has been asked to review its security implications. While evaluating the various vulnerability scans were
Asset value
80 - 443
Risk assessmentproduct Answer: D
IKE
42. Which of the following describes when forensic hashing should occur on a drive?
Initial vector
Buffer overflow
Before and after the imaging process and then hash the forensic image
Dumpster diving - Shoulder surfing
43. You are looking for ways to protect data on a network. Your solution should: Provide for easy backup of all user data.
Confidentiality
escalation of privileges.
Integrity and Authentication
Minimize risk of physical data theft. - Minimize the impact of the failure of any one file server.
44. Webmail is classified under which of the following cloud-based technologies?
Software as a Service (SaaS)
Mandatory vacations
Social Engineering attack
Hierarchical list of critical systems
45. Which of the following BEST explains the security benefit of a standardized server image?
Implicit deny
Mandated security configurations have been made to the operating system.
SYN attacks
To minimize the organizational risk posed by users
46. An attacker forces a Windows service that uses the Local System account as its service account to crash. The attacker is able to access administrator-level resources as a result. What kind of attack is this?
Vulnerability scan
Privilege escalation
Command injection
80 - 443
47. A security administrator is in charge of a a hot site and a cold site. Due to a recent disaster - the administrator needs to ensure that their cold site is ready to go in case of a disaster. Which of the following does the administrator need to ensur
Location that meets power and connectivity requirementsdatacenter
HSM
IDEA and TripleDes
By masking the IP address of internal computers from the Internet
48. Your organization recently purchased several new laptop computers for employees. You're asked to encrypt the laptop's hard drives without purchasing any additional hardware. What would you use?
IDEA and TripleDes
quantitative risk assessment
TPM
HSM
49. The security administrator is getting reports from users that they are accessing certain websites and are unable to download anything off of those sites. The security administrator is also receiving several alarms from the IDS about suspicious traffi
Evil twin
Botnet
NIPS is blocking activities from those specific websites.
Configure the IE popup blockers
50. A rogue access point with the same SSID as the production wireless network is found. Which of the following BEST describes this attack?
Evil twin
smurf attacks
Vishing
It is used to provide data encryption for WAP connections.