Question 1

Which of the following incident response steps involves actions to protect critical systems while maintaining business operations?

Accepted Answer

Containment involves taking actions to limit the impact of an incident on critical systems while ensuring that business operations can continue.

Question 2

A computer forensics analyst collected a flash drive that contained a single file with 500 pages of text. Which of the following algorithms should the analyst use to validate the integrity of the file?

Accepted Answer

MD5 is a hashing algorithm used to verify data integrity by generating a unique hash value for the file, which can be compared to a known good hash.

Question 3

Which of the following would provide a safe environment for an application to access only the resources needed to function while not having access to run at the system level?

Accepted Answer

A sandbox provides a controlled environment where an application can run with limited access to system resources, ensuring it only accesses what it needs without affecting the system level.

Question 4

A network administrator at a large organization is reviewing methods to improve the security of the wired LAN. Any security improvement must be centrally managed and allow corporate-owned devices to have access to the intranet but limit others to Internet access only. Which of the following should the administrator recommend?

Accepted Answer

802.1X utilizing the current PKI infrastructure allows for centralized management of network access, enabling the administrator to authenticate corporate-owned devices and control their access to the intranet, while limiting other devices to Internet access only.

Question 5

A mobile application developer wants to secure an application that transmits sensitive information. Which of the following should the developer implement to prevent SSL MITM attacks?

Accepted Answer

Pinning is a technique used to ensure that the application only accepts a specific certificate or public key, which helps prevent man-in-the-middle (MITM) attacks by rejecting any unexpected certificates.

Question 6

Which of the following is the BEST use of a WAF?

Accepted Answer

A Web Application Firewall (WAF) is primarily used to protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet, making it ideal for protecting publicly accessible web servers.

Question 7

An organization is drafting an IRP and needs to determine which employees have the authority to take systems offline during an emergency situation. Which of the following is being outlined?

Accepted Answer

The organization is outlining "Roles and responsibilities" as it is determining which employees have the authority to take systems offline during an emergency. This involves defining who is responsible for specific actions in the incident response process.

Question 8

A technician is designing a solution that will be required to process sensitive information, including classified government data. The system needs to be common criteria certified. Which of the following should the technician select?

Accepted Answer

A Trusted Operating System (TOS) is designed to meet specific security standards and is often Common Criteria certified, making it suitable for processing sensitive and classified information.

Question 9

A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?

Accepted Answer

The IT administrator should first ensure that there is no residual or dormant malware by scanning the NAS and establish a reliable backup system to prevent data loss in future incidents.

Question 10

To further secure a company's email system, an administrator is adding public keys to DNS records in the company's domain. Which of the following is being used?

Accepted Answer

DNSSEC is used to secure DNS records by adding digital signatures to them. This helps to prevent DNS spoofing and other attacks that can compromise the integrity of the DNS system.

Question 11

A user loses a COPE device. Which of the following should the user do NEXT to protect the data on the device?

Accepted Answer

The user should call the company help desk to remotely wipe the device to protect any sensitive data from being accessed by unauthorized individuals.

Question 12

While testing a new vulnerability scanner, a technician becomes concerned about reports that list security concerns that are not present on the systems being tested. Which of the following BEST describes this flaw?

Accepted Answer

False positives occur when a vulnerability scanner incorrectly identifies a security issue that does not actually exist on the system being tested.

Question 13

A forensics investigator is examining a number of unauthorized payments that were reported on the company's website. Some unusual log entries show users received an email for an unwanted mailing attempt to unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be: Click here to unsubscribe Which of the following will the forensics investigator MOST likely determine has occurred?

Accepted Answer

The link in the email is crafted to perform an action on behalf of the user without their consent, which is indicative of a Cross-Site Request Forgery (CSRF) attack.

Question 14

Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?

Accepted Answer

The document named password.txt is likely a honeyfile, which is used to attract and detect unauthorized access by cyberintruders.

Question 15

A cryptographer has developed a new proprietary hash function for a company and solicited employees to test the function before recommending its implementation. An employee takes the plaintext version of a document and hashes it, then changes the original plaintext document slightly and hashes it, and continues repeating this process until two identical hash values are produced from two different documents. Which of the following BEST describes this cryptographic attack?

Accepted Answer

This is a collision attack, where the goal is to find two different inputs that produce the same hash output.

Question 16

A security administrator suspects there may be unnecessary services running on a server. Which of the following tools will the administrator MOST likely use to confirm the suspicions?

Accepted Answer

Nmap is a network scanning tool that can be used to discover services running on a server by identifying open ports and the services associated with them.

Question 17

During a forensic investigation, which of the following must be addressed FIRST according to the order of volatility?

Accepted Answer

RAM is the most volatile and should be addressed first as it loses data when the power is turned off.

Question 18

A large financial services firm recently released information regarding a security breach within its corporate network that began several years before. During the time frame in which the breach occurred, indicators show an attacker gained administrative access to the network through a file download from a social media site and subsequently installed it without the user's knowledge. Since the compromise, the attacker was able to take command and control of the computer systems anonymously while obtaining sensitive corporate and personal employee information. Which of the following methods did the attacker MOST likely use to gain access?

Accepted Answer

The answer of A large financial services firm recently released...

Question 19

A systems administrator is installing and configuring an application service that requires access to read and write to log and configuration files on a local hard disk partition. The service must run as an account with authorization to interact with the file system. Which of the following would reduce the attack surface added by the service and account? (Choose two.)

Accepted Answer

A unique managed service account reduces the attack surface by limiting the service to a specific identity with known permissions. Enforcing least possible privileges for the account further reduces the attack surface by limiting the account's access to only the resources it needs to perform its tasks.

Question 20

A government agency with sensitive information wants to virtualize its infrastructure. Which of the following cloud deployment models BEST fits the agency's needs?

Accepted Answer

A private cloud deployment model is best for a government agency with sensitive information as it offers enhanced security and control over the infrastructure, ensuring that sensitive data is protected and managed internally.

Exam 15: CompTIA Security+