Question 1

An organization plans to transition the intrusion detection and prevention techniques on a critical subnet to an anomaly-based system. Which of the following does the organization need to determine for this to be successful?

Accepted Answer

An anomaly-based intrusion detection system requires a baseline of normal network behavior to identify deviations that may indicate potential threats.

Question 2

A security team has downloaded a public database of the largest collection of password dumps on the Internet. This collection contains the cleartext credentials of every major breach for the last four years. The security team pulls and compares users' credentials to the database and discovers that more than 30% of the users were still using passwords discovered in this list. Which of the following would be the BEST combination to reduce the risks discovered?

Accepted Answer

Implementing password reuse policies, enforcing password complexity, and setting password expiration can help ensure users create stronger, unique passwords and change them regularly, reducing the risk of using compromised passwords.

Question 3

Which of the following BEST distinguishes Agile development from other methodologies in terms of vulnerability management?

Accepted Answer

The answer of Which of the following BEST distinguishes Agile...

Question 4

After being alerted to potential anomalous activity related to trivial DNS lookups, a security analyst looks at the following output of implemented firewall rules:  The analyst notices that the expected policy has no hit count for the day. Which of the following MOST likely occurred?

Accepted Answer

The answer of After being alerted to potential anomalous activity...

Question 5

The exploitation of a buffer-overrun vulnerability in an application will MOST likely lead to:

Accepted Answer

Buffer-overrun vulnerabilities often allow attackers to execute arbitrary code by overwriting the memory beyond the buffer's boundary, potentially leading to system compromise.

Question 6

An organization is concerned about video emissions from users' desktops. Which of the following is the BEST solution to implement?

Accepted Answer

The answer of An organization is concerned about video emissions...

Question 7

A security analyst is performing a BIA. The analyst notes that in a disaster, failover systems must be up and running within 30 minutes. The failover systems must use backup data that is no older than one hour. Which of the following should the analyst include in the business continuity plan?

Accepted Answer

The answer of A security analyst is performing a BIA....

Question 8

An intruder sniffs network traffic and captures a packet of internal network transactions that add funds to a game card. The intruder pushes the same packet multiple times across the network, which increments the funds on the game card. Which of the following should a security administrator implement to BEST protect against this type of attack?

Accepted Answer

Implementing an IPSec VPN would encrypt the network traffic, making it difficult for an intruder to capture and replay packets, thus protecting against replay attacks.

Question 9

A systems administrator is auditing the company's Active Directory environment. It is quickly noted that the username "company\bsmith" is interactively logged into several desktops across the organization. Which of the following has the systems administrator MOST likely come across?

Accepted Answer

The username "company\bsmith" being logged into several desktops suggests that it is a shared credential, as it is unlikely for a single user to be logged into multiple machines simultaneously.

Question 10

A systems engineer is setting up a RADIUS server to support a wireless network that uses certificate authentication. Which of the following protocols must be supported by both the RADIUS server and the WAPs?

Accepted Answer

EAP (Extensible Authentication Protocol) is used for certificate-based authentication in wireless networks and must be supported by both the RADIUS server and the Wireless Access Points (WAPs).

Question 11

A first responder needs to collect digital evidence from a compromised headless virtual host. Which of the following should the first responder collect FIRST?

Accepted Answer

A snapshot captures the entire state of a virtual machine at a specific point in time, including memory, disk, and device state, making it a comprehensive first step in evidence collection.

Question 12

A contracting company recently completed its period of performance on a government contract and would like to destroy all information associated with contract performance. Which of the following is the best NEXT step for the company to take?

Accepted Answer

The company should first consult the data disposition policies outlined in the contract to ensure compliance with any specific requirements or regulations before proceeding with data destruction.

Question 13

A security professional wants to test a piece of malware that was isolated on a user's computer to document its effect on a system. Which of the following is the FIRST step the security professional should take?

Accepted Answer

Creating a secure baseline of the system state is the first step in testing malware, as it allows the security professional to compare the system's state before and after running the malware to document its effects.

Question 14

After discovering a security incident and removing the affected files, an administrator disabled an unneeded service that led to the breach. Which of the following steps in the incident response process has the administrator just completed?

Accepted Answer

The answer of After discovering a security incident and removing...

Question 15

The help desk received a call from a user who was trying to access a set of files from the day before but received the following error message: File format not recognized . Which of the following types of malware MOST likely caused this to occur?

Accepted Answer

Ransomware is a type of malware that encrypts files and demands payment for the decryption key, which can result in files being unrecognizable or inaccessible.

Question 16

Which of the following types of controls is a turnstile?

Accepted Answer

A turnstile is a physical control as it is a physical barrier used to control access to a secured area.

Question 17

An attacker is able to capture the payload for the following packet: IP 192.168.1.22:2020 10.10.10.5:443 IP 192.168.1.10:1030 10.10.10.1:21 IP 192.168.1.57:5217 10.10.10.1:3389 During an investigation, an analyst discovers that the attacker was able to capture the information above and use it to log on to other servers across the company. Which of the following is the MOST likely reason?

Accepted Answer

The attacker is likely capturing unencrypted credentials from the network traffic and using them to log into other servers. The presence of port 21 (FTP) and port 3389 (RDP) suggests that credentials might be transmitted in plaintext, making them vulnerable to interception.

Question 18

Which of the following serves to warn users against downloading and installing pirated software on company devices?

Accepted Answer

An Acceptable Use Policy (AUP) outlines the rules and guidelines for appropriate use of company resources, including warnings against downloading and installing pirated software.

Question 19

A coding error has been discovered on a customer-facing website. The error causes each request to return confidential PHI data for the incorrect organization. The IT department is unable to identify the specific customers who are affected. As a result, all customers must be notified of the potential breach. Which of the following would allow the team to determine the scope of future incidents?

Accepted Answer

Database access monitoring would allow the team to track and log access to the database, helping to identify which data was accessed and by whom, thus determining the scope of future incidents.

Question 20

An employee opens a web browser and types a URL into the address bar. Instead of reaching the requested site, the browser opens a completely different site. Which of the following types of attacks have MOST likely occurred? (Choose two.)

Accepted Answer

The answer of An employee opens a web browser and...

Exam 15: CompTIA Security+