SY0-601 : CompTIA Security+ 2021 : Part 02

SY0-601 : CompTIA Security+ 2021 : Part 02

1. An organization needs to implement more stringent controls over administrator/root credentials and service accounts. Requirements for the project include:
   – Check-in/checkout of credentials
   – The ability to use but not know the password
   – Automated password changes
   – Logging of access to credentials

   Which of the following solutions would meet the requirements?

   • OAuth 2.0
   • Secure Enclave
   • A privileged access management system
   • An OpenID Connect authentication system

2. Several employees return to work the day after attending an industry trade show. That same day, the security manager notices several malware alerts coming from each of the employee’s workstations. The security manager investigates but finds no signs of an attack on the perimeter firewall or the NIDS. Which of the following is MOST likely causing the malware alerts?

   • A worm that has propagated itself across the intranet, which was initiated by presentation media
   • A fileless virus that is contained on a vCard that is attempting to execute an attack
   • A Trojan that has passed through and executed malicious code on the hosts
   • A USB flash drive that is trying to run malicious code but is being blocked by the host firewall

3. After reading a security bulletin, a network security manager is concerned that a malicious actor may have breached the network using the same software flaw. The exploit code is publicly available and has been reported as being used against other industries in the same vertical. Which of the following should the network security manager consult FIRST to determine a priority list for forensic review?

   • The vulnerability scan output
   • The IDS logs
   • The full packet capture data
   • The SIEM alerts

4. A financial organization has adopted a new secure, encrypted document-sharing application to help with its customer loan process. Some important PII needs to be shared across this new platform, but it is getting blocked by the DLP systems. Which of the following actions will BEST allow the PII to be shared with the secure application without compromising the organization’s security posture?

   • Configure the DLP policies to allow all PII
   • Configure the firewall to allow all ports that are used by this application
   • Configure the antivirus software to allow the application
   • Configure the DLP policies to whitelist this application with the specific PII
   • Configure the application to encrypt the PII

5. An auditor is performing an assessment of a security appliance with an embedded OS that was vulnerable during the last two assessments. Which of the following BEST explains the appliance’s vulnerable state?

   • The system was configured with weak default security settings.
   • The device uses weak encryption ciphers.
   • The vendor has not supplied a patch for the appliance.
   • The appliance requires administrative credentials for the assessment.

6. A company’s bank has reported that multiple corporate credit cards have been stolen over the past several weeks. The bank has provided the names of the affected cardholders to the company’s forensics team to assist in the cyber-incident investigation.

   An incident responder learns the following information:
   – The timeline of stolen card numbers corresponds closely with affected users making Internet-based purchases from diverse websites via enterprise desktop PCs.
   – All purchase connections were encrypted, and the company uses an SSL inspection proxy for the inspection of encrypted traffic of the hardwired network.
   – Purchases made with corporate cards over the corporate guest WiFi network, where no SSL inspection occurs, were unaffected.

   Which of the following is the MOST likely root cause?

   • HTTPS sessions are being downgraded to insecure cipher suites
   • The SSL inspection proxy is feeding events to a compromised SIEM
   • The payment providers are insecurely processing credit card charges
   • The adversary has not yet established a presence on the guest WiFi network

7. A pharmaceutical sales representative logs on to a laptop and connects to the public WiFi to check emails and update reports. Which of the following would be BEST to prevent other devices on the network from directly accessing the laptop? (Choose two.)

   • Trusted Platform Module
   • A host-based firewall
   • A DLP solution
   • Full disk encryption
   • A VPN
   • Antivirus software

8. A company is implementing MFA for all applications that store sensitive data. The IT manager wants MFA to be non-disruptive and user friendly. Which of the following technologies should the IT manager use when implementing MFA?

   • One-time passwords
   • Email tokens
   • Push notifications
   • Hardware authentication

9. The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread unhindered throughout the network and infect a large number of computers and servers. Which of the following recommendations would be BEST to mitigate the impacts of a similar incident in the future?

   • Install a NIDS device at the boundary.
   • Segment the network with firewalls.
   • Update all antivirus signatures daily.
   • Implement application blacklisting.

10. A company is adopting a BYOD policy and is looking for a comprehensive solution to protect company information on user devices. Which of the following solutions would BEST support the policy?

    • Mobile device management
    • Full-device encryption
    • Remote wipe
    • Biometrics

11. A development team employs a practice of bringing all the code changes from multiple team members into the same development project through automation. A tool is utilized to validate the code and track source code through version control. Which of the following BEST describes this process?

    • Continuous delivery
    • Continuous integration
    • Continuous validation
    • Continuous monitoring

12. A cybersecurity administrator needs to add disk redundancy for a critical server. The solution must have a two-drive failure for better fault tolerance. Which of the following RAID levels should the administrator select?

    • 0
    • 1
    • 5
    • 6

13. Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?

    • The document is a honeyfile and is meant to attract the attention of a cyberintruder.
    • The document is a backup file if the system needs to be recovered.
    • The document is a standard file that the OS needs to verify the login credentials.
    • The document is a keylogger that stores all keystrokes should the account be compromised.

14. A small company that does not have security staff wants to improve its security posture. Which of the following would BEST assist the company?

    • MSSP
    • SOAR
    • IaaS
    • PaaS

15. An organization’s help desk is flooded with phone calls from users stating they can no longer access certain websites. The help desk escalates the issue to the security team, as these websites were accessible the previous day. The security analysts run the following command: ipconfig /flushdns, but the issue persists. Finally, an analyst changes the DNS server for an impacted machine, and the issue goes away. Which of the following attacks MOST likely occurred on the original DNS server?

    • DNS cache poisoning
    • Domain hijacking
    • Distributed denial-of-service
    • DNS tunneling

16. A cybersecurity manager has scheduled biannual meetings with the IT team and department leaders to discuss how they would respond to hypothetical cyberattacks. During these meetings, the manager presents a scenario and injects additional information throughout the session to replicate what might occur in a dynamic cybersecurity event involving the company, its facilities, its data, and its staff. Which of the following describes what the manager is doing?

    • Developing an incident response plan
    • Building a disaster recovery plan
    • Conducting a tabletop exercise
    • Running a simulation exercise

17. A RAT that was used to compromise an organization’s banking credentials was found on a user’s computer. The RAT evaded antivirus detection. It was installed by a user who has local administrator rights to the system as part of a remote management tool set. Which of the following recommendations would BEST prevent this from reoccurring?

    • Create a new acceptable use policy.
    • Segment the network into trusted and untrusted zones.
    • Enforce application whitelisting.
    • Implement DLP at the network boundary.

18. A security analyst is reviewing a new website that will soon be made publicly available. The analyst sees the following in the URL:

    http://dev-site.comptia.org/home/show.php?sessionID=77276554&loc=us

    The analyst then sends an internal user a link to the new website for testing purposes, and when the user clicks the link, the analyst is able to browse the website with the following URL:

    http://dev-site.comptia.org/home/show.php?sessionID=98988475&loc=us

    Which of the following application attacks is being tested?

    • Pass-the-hash
    • Session replay
    • Object deference
    • Cross-site request forgery

19. A network administrator has been asked to install an IDS to improve the security posture of an organization. Which of the following control types is an IDS?

    • Corrective
    • Physical
    • Detective
    • Administrative

20. Which of the following should be put in place when negotiating with a new vendor about the timeliness of the response to a significant outage or incident?

    • MOU
    • MTTR
    • SLA
    • NDA