Question 1

A member of the admins group reports being unable to modify the "changes" file on a server. The permissions on the file are as follows: Permissions User Group File -rwxrw-r--+ Admins Admins changes Based on the output above, which of the following BEST explains why the user is unable to modify the "changes" file?

Accepted Answer

The "+" at the end of the permissions indicates that an Access Control List (ACL) is set, which may restrict the user's ability to modify the file despite the group having write permissions.

Question 2

An incident involving a workstation that is potentially infected with a virus has occurred. The workstation may have sent confidential data to an unknown internet server. Which of the following should a security analyst do FIRST?

Accepted Answer

The first step in handling a potential incident is to preserve evidence. Making a copy of everything in memory ensures that volatile data is captured for further analysis.

Question 3

Ann, a security administrator, wants to ensure credentials are encrypted in transit when implementing a RADIUS server for SSO. Which of the following are needed given these requirements? (Choose two.)

Accepted Answer

The answer of Ann, a security administrator, wants to ensure...

Question 4

An organization identifies a number of hosts making outbound connections to a known malicious IP over port TCP 80. The organization wants to identify the data being transmitted and prevent future connections to this IP. Which of the following should the organization do to achieve this outcome?

Accepted Answer

The answer of An organization identifies a number of hosts...

Question 5

A forensic investigator has run into difficulty recovering usable files from a SAN drive. Which of the following SAN features might have caused the problem?

Accepted Answer

Deduplication reduces storage space by eliminating duplicate copies of data, which can complicate file recovery if the original data is not easily reconstructable.

Question 6

A security engineer is configuring a wireless network with EAP-TLS. Which of the following activities is a requirement for this configuration?

Accepted Answer

EAP-TLS requires the deployment of certificates to endpoint devices to authenticate them securely.

Question 7

A third-party penetration testing company was able to successfully use an ARP cache poison technique to gain root access on a server. The tester successfully moved to another server that was not in the original network. Which of the following is the MOST likely method used to gain access to the other host?

Accepted Answer

Pivoting is a technique used in penetration testing to move from one compromised system to another within a network, allowing the tester to access systems that were not initially accessible.

Question 8

After a recent internal breach, a company decided to regenerate and reissue all certificates used in the transmission of confidential information. The company places the greatest importance on confidentiality and non-repudiation, and decided to generate dual key pairs for each client. Which of the following BEST describes how the company will use these certificates?

Accepted Answer

One key pair is typically used for encryption and decryption to ensure confidentiality, while the other is used for digital signatures to ensure non-repudiation.

Question 9

To determine the ALE of a particular risk, which of the following must be calculated? (Choose two.)

Accepted Answer

The answer of To determine the ALE of a particular...

Question 10

During a routine vulnerability assessment, the following command was successful: echo "vrfy 'perl -e 'print "hi" x 500 ' ' " | nc www.company.com 25 Which of the following vulnerabilities is being exploited?

Accepted Answer

The command is attempting to exploit a buffer overflow vulnerability by sending a large amount of data to the mail server (MTA) on port 25.

Question 11

A security analyst is inspecting the results of a recent internal vulnerability scan that was performed against intranet services. The scan reports include the following critical-rated vulnerability: Title: Remote Command Execution vulnerability in web server Rating: Critical (CVSS 10.0) Threat actor: any remote user of the web server Confidence: certain Recommendation: apply vendor patches Which of the following actions should the security analyst perform FIRST?

Accepted Answer

The answer of A security analyst is inspecting the results...

Question 12

A company offers SaaS, maintaining all customers' credentials and authenticating locally. Many large customers have requested the company offer some form of federation with their existing authentication infrastructures. Which of the following would allow customers to manage authentication and authorizations from within their existing organizations?

Accepted Answer

Implementing SAML (Security Assertion Markup Language) allows the company's services to accept authentication assertions from the customers' existing authentication servers, enabling federation and allowing customers to manage authentication and authorizations within their own infrastructure.

Question 13

Company A agrees to provide perimeter protection, power, and environmental support with measurable goals for Company B, but will not be responsible for user authentication or patching of operating systems within the perimeter. Which of the following is being described?

Accepted Answer

A Service Level Agreement (SLA) outlines the specific services a provider will deliver, including measurable goals, and clarifies responsibilities, such as Company A's commitment to perimeter protection, power, and environmental support, while excluding user authentication and OS patching.

Question 14

A penetration tester is conducting an assessment on Comptia.org and runs the following command from a coffee shop while connected to the public Internet: c:
slookup -querytype=MX comptia.org Server: Unknown Address: 198.51.100.45 comptia.org MX preference=10, mail exchanger = 92.68.102.33 comptia.org MX preference=20, mail exchanger = exchg1.comptia.org exchg1.comptia.org internet address = 192.168.102.67 Which of the following should the penetration tester conclude about the command output?

Accepted Answer

192.168.102.67 is a private IP address, which is not routable on the public Internet. This indicates that the mail server at this IP address is not directly accessible from the public Internet, and is therefore less likely to be targeted by attackers.

Question 15

A security administrator needs to address the following audit recommendations for a public-facing SFTP server: Users should be restricted to upload and download files to their own home directories only. Users should not be allowed to use interactive shell login. Which of the following configuration parameters should be implemented? (Choose two.).

Accepted Answer

The ChrootDirectory parameter can be used to restrict users to their own home directories, ensuring they cannot access other parts of the file system. The PermitTTY parameter can be set to 'no' to prevent users from having an interactive shell login.

Question 16

A security administrator learns that PII, which was gathered by the organization, has been found in an open forum. As a result, several C-level executives found their identities were compromised, and they were victims of a recent whaling attack. Which of the following would prevent these problems in the future? (Choose two.)

Accepted Answer

Implementing an email DLP (Data Loss Prevention) can help prevent sensitive information like PII from being leaked through emails. A spam filter can help prevent phishing and whaling attacks by filtering out malicious emails before they reach executives.

Question 17

Users in a corporation currently authenticate with a username and password. A security administrator wishes to implement two-factor authentication to improve security. Which of the following authentication methods should be deployed to achieve this goal?

Accepted Answer

A smart card is a physical device that can be used in conjunction with a password to provide two-factor authentication, combining something the user knows (password) with something the user has (smart card).

Question 18

An organization has several production-critical SCADA supervisory systems that cannot follow the normal 30- day patching policy. Which of the following BEST maximizes the protection of these systems from malicious software?

Accepted Answer

Configure the systems to ensure only necessary applications are able to run.

Question 19

A vice president at a manufacturing organization is concerned about desktops being connected to the network. Employees need to log onto the desktops' local account to verify that a product is being created within specifications; otherwise, the desktops should be as isolated as possible. Which of the following is the BEST way to accomplish this?

Accepted Answer

Air gapping the desktops ensures they are completely isolated from the network, which aligns with the requirement to keep them as isolated as possible while still allowing local account access for verification purposes.

Question 20

A security analyst is attempting to break into a client's secure network. The analyst was not given prior information about the client, except for a block of public IP addresses that are currently in use. After network enumeration, the analyst's NEXT step is to perform:

Accepted Answer

A gray-box penetration test is the next step because the analyst has some information about the client's network (the public IP addresses), but not complete information.

Exam 15: CompTIA Security+