SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
Search
Test your basic knowledge |
Comptia Security + Exam
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. What asymmetric key is used to encrypt when using HTTPS?
2. A targeted email attack sent to the company's Chief Executive Officer (CEO) is known as which of the following?
Physical control of the data
Change Management System
Configure the IE popup blockers
Whaling
3. When examining HTTP server logs the security administrator notices that the company's online store crashes after a particular search string is executed by a single external user. Which of the following BEST describes this type of attack?
DoS
Clustering
Privilege escalation
Provider cloud
4. Which of the following devices is often used to cache and filter content?
WPA2-PSK
Cognitive passwords
Loop protection
Proxies
5. Which of the following BEST describes the proper method and reason to implement port security?
BIOS
Apply a security control which ties specific ports to end-device MAC addresses and prevents additional devices from being connected to the network.
EMI shielding
CAC
6. Several staff members working in a datacenter have reported instances of tailgating. Which of the following could be implemented to prevent this security concern?
Vulnerability scan
Content filtering
Mantraps
Enact a policy banning users from bringing in personal music devices.
7. Which of the following logical controls does a flood guard protect against?
A system that stops an attack in progress.
SYN attacks
Virtual servers have the same information security requirements as physical servers.
Steganography
8. Data can potentially be stolen from a disk screen-lock protected - smartphone by which of the following?
Account disablement
Bluesnarfing
Software as a Service (SaaS)
By masking the IP address of internal computers from the Internet
9. What types of encryption are used for adding a digital signature to a message?
Command injection
Asymmetric and Hashing
Having the offsite location of tapes also be the hot siteservers
Dumpster diving
10. Which of the following identifies some of the running services on a system?
Cross-site scripting
Determine open ports
The development team is transferring data to test systems using SFTP and SCP.
Network Access Control
11. Which of the following would be the BEST action to perform when conducting a corporate vulnerability assessment?
80 - 443
EMI shielding
Power levels
Organize data based on severity and asset value.
12. An administrator identifies a security issue on but does not attempt to exploit it. Which of the following describes what the administrator has done?
Vulnerability scan
User rights
Lets you minimize the attack surface relating to the application
WPA2
13. A security administrator is tasked with ensuring that all servers are highly available and that hard drive failure will not affect an individual server. Which of the following configurations will allow for high availability?
Hardware RAID 5 - Software RAID 1
Mandatory vacations
IPSec
MS-CHAP
14. The detection of a NOOP sled is an indication of which of the following attacks?
Rogue access points
WPA2
Botnet
Buffer overflow
15. Which of the following is not an asymmetric system?
Visibility - Accessibility - Neighborhood crime rate
Loop protection
DES
smurf attacks
16. What port does the Domain Name Service (DNS) use by default?
Asset value
The web site's private key.
53
Memory - network processes - and system processesserver. If the computer is powered off
17. Which of the following is NOT an application layer security protocol?
WPA2
Multi-factor authentication.
IPSec
VLAN segregation
18. A security administrator performs several war driving routes each month and recently has noticed a certain area with a large number of unauthorized devices. Which of the following attack types is MOST likely occurring?
Rogue access points
It is used to provide data encryption for WAP connections.
AES and TKIP
The web site's private key.
19. A user receives an automated call which appears to be from their bank. The automated recording provides details about the bank's privacy policy security policy and requests that the user clearly state their name - birthday and enter the banking detai
Vishing
Accountability
SYN attacks
By masking the IP address of internal computers from the Internet
20. An administrator who wishes to block all database ports at the firewall should include which of the following ports in the block list?
Block port 23 on the network firewall.
Steganography
1433
Implement a change management strategy
21. Which of the following describes a passive attempt to identify weaknesses?
Vulnerability scanning
quantitative risk assessment
White box
Proxies
22. Which of the following are important physical security considerations when choosing a location for a new remote branch office?
Dumpster diving - Shoulder surfing
Visibility - Accessibility - Neighborhood crime rate
Validate input to remove hypertext
Vulnerability scanning
23. In an 802.11n network which of the following provides the MOST secure method of both encryption and authorization?
WPA Enterprise
Spear phishing
CAC
IPSec
24. Which of the following describes when forensic hashing should occur on a drive?
Protocol analyzer
Before and after the imaging process and then hash the forensic image
Validate input to remove hypertext
25
25. Which of the following would need to be configured correctly to allow remote access to the network?
DNS spoofing
ACLs
Before and after the imaging process and then hash the forensic image
Firewall - VPN
26. You want to setup a secure method of sending and receiving email. Which two of the following protocols can be used for this purpose?
NIDS
Shoulder surfing
S/MIME PGP
Location that meets power and connectivity requirementsdatacenter
27. Which of the following web application security weaknesses can be mitigated by preventing the use of HTML tags?
Cross-site scripting
The user's PC is missing the authentication agent.
PEAP-TLS
IPSec
28. Which of the following is specific to a buffer overflow attack?
Baseline reporting
Rootkit
MAC
Initial vector
29. A security firm has been engaged to assess a software application. A production-like test environment login details - production documentation and source code have been provided. Which of the following types of testing is being described?
The web site's private key.
ARP poisoning
MAC
White box
30. Which of the following is MOST commonly a part of routine system audits?
IPSec
Determine the potential monetary costs related to a threat
User rights and permissions reviews
NIPS is blocking activities from those specific websites.
31. A security administrator needs to separate two departments. Which of the following would the administrator implement to perform this?
VLAN
Account disablement
Risk transference
Information disclosure
32. What asymmetric key is used to decrypt when using HTTPS?
33. Which of the following is used for exchanging secret keys over an insecure public network?
Vulnerability scanner
The development team is transferring data to test systems using SFTP and SCP.
PEAP-TLS
Diffie-Hellman
34. What fire suppression method should be used to extinguish an electrical fire in one of the racks in the server room?
Gas
Fiber optic
Algorithm
The server is missing the default gateway.
35. Upper management decides which risk to mitigate based on cost. This is an example of:
Network Access Control
Availability
quantitative risk assessment
Mandatory vacation
36. A programmer allocates 16 bytes for a string but does not adequately ensure that more than 16 bytes cannot be copied into the variable. This program may be vulnerable to which of the following attacks?
Blind FTP
Buffer overflow
Apply a security control which ties specific ports to end-device MAC addresses and prevents additional devices from being connected to the network.
Footprinting
37. On-going annual awareness security training should be coupled with:..
WPA Enterprise
signing of a user agreement.
escalation of privileges.
Data Encryption Standard (DES)
38. Two systems are being designed. System A has a high availability requirement. System B has a high security requirement with less emphasis on system uptime. Which of the following configurations BEST fits the need for each system?
Minimize risk of physical data theft. - Minimize the impact of the failure of any one file server.
Configure the IE popup blockers
Hot and cold aisles
System A fails open. System B fails closed.
39. A security administrator finished taking a forensic image of a computer's memory. Which of the following should the administrator do to ensure image integrity?
Judgment
Vulnerability scanning
Run the image through SHA256. Answer: D
Algorithm
40. Which of the following ports would a security administrator block if the administrator wanted to stop users from accessing outside SMTP services?
Social Engineering attack
25
Cross-site scripting
Data Encryption Standard (DES)
41. Which of the following is true regarding the WTLS protocol?
It is used to provide data encryption for WAP connections.
SSL
Least privilege
Vulnerability scan
42. Risk can be managed in the following ways...
mitigation - acceptance - transference
53
Enact a policy banning users from bringing in personal music devices.
Power levels
43. Which of the following is an example of allowing another user physical access to a secured area without validation of their credentials?
Algorithm
DES
DoS
Tailgating
44. Applying detailed instructions to manage the including allowing or denying traffic based on port - protocol - address - or direction is an implementation of which of the following?
Mantrap
Command injection
Before and after the imaging process and then hash the forensic image
Firewall rulesflow of network traffic at the edge of the network
45. With which of the following is RAID MOST concerned?
Availability
Change Management System
smurf attacks
ICMP
46. Which of the following is the default rule found in a corporate firewall's access control list?
Pharming - Logic bomb
Vulnerability scan
Confidentiality - Availability
Deny all
47. Which solution should you use?
se file servers attached to an NAS system.
TPM
White box
Initial vector
48. Which of the following should be enabled to ensure only certain wireless clients can access the network?
Cross-site scripting
Shoulder surfing
Principle of least privilege
MAC filtering
49. Users of specific systems are reporting that their data has been corrupted. After a recent patch update to those systems the users are still reporting issues of data being corrupt. Which of the following assessment techniques need to be performed to
IPSec
Visibility - Accessibility - Neighborhood crime rate
MS-CHAP
Vulnerability scan
50. Which of the following is MOST relevant to a buffer overflow attack?
NOOP instructions
Spear phishing
53
MAC