CompTIA Security+ (SY0-601) Practice Exam #5 Questions and
Answers with Explanations.
Which of the following utilizes a well-written set of carefully developed and tested scripts
to orchestrate runbooks and generate consistent server builds across an enterprise?
A. Software-Defined Networking (SDN)
B. Infrastructure as Code (IaC)
C. Infrastructure as a Service (IaaS)
D. Software as a Service (SaaS) - Correct Answer B. Infrastructure as Code (IaC)
Explanation
OBJ-2.2: Infrastructure as Code (IaC) is designed with the idea that a well-coded
description of the server/network operating environment will produce consistent results
across an enterprise and significantly reduce IT overhead costs through automation while
precluding the existence of security vulnerabilities. SDN uses software to define
networking boundaries but does not necessarily handle server architecture in the same
way that IaC can. Infrastructure as a Service (IaaS) is a computing method that uses the
cloud to provide any or all infrastructure needs. Software as a Service (SaaS) is a
computing method that uses the cloud to provide users with application services.
What sanitization technique uses only logical techniques to remove data, such as
overwriting a hard drive with a random series of ones and zeroes?
A. Clear
B. Degauss
C. Purge
D. Destroy - Correct Answer A. Clear
,Explanation
OBJ-2.7: Clear applies logical techniques to sanitize data in all user-addressable storage
locations for protection against simple non-invasive data recovery techniques. Clearing
involves overwriting data once (and seldom more than three times) with repetitive data
(such as all zeros) or resetting a device to factory settings. Purging data is meant to
eliminate information from being feasibly recovered even in a laboratory environment.
Destroy requires physical destruction of the media, such as pulverization, melting,
incineration, and disintegration. Degaussing is the process of decreasing or eliminating a
remnant magnetic field. Degaussing is an effective method of sanitization for magnetic
media, such as hard drives and floppy disks.
The public library has had a recent issue with their laptops being stolen from their
computer lab.Since this is a public library, it is not a high-security area and is fully
accessible by patrons during the day. What is the best way to prevent the theft of laptops?
A. Mobile Device Management
B. CCTV
C. Cable Locks
D. Motion Sensorsx - Correct Answer C. Cable Locks
Explanation
OBJ-2.7: Cable locks are the best solution to allow the laptops to be connected physically
to the desks and prevent theft. CCTV is a deterrent or detective control but will require
someone to monitor it to detect the theft. Mobile device management focuses on tablets or
phones, not laptops. Motion sensors are not useful during the library's open hours since
authorized patrons are allowed into the lab during the day. If laptop theft occurs during the
day, motion sensors will be useless to stop them.
Which of the following cryptographic algorithms is classified as symmetric?
A. DSA
B. DES
C. GPG
,D. ECC - Correct Answer B. DES
Explanation
OBJ-2.8: The Data Encryption Standard (DES) is a symmetric-key algorithm for the
encryption of digital data. Although its short key length of 56 bits makes it too insecure for
applications, it was the standard used from 1977 until the early 2000s. GPG, ECC, and
DSA are all asymmetric algorithms.
A new alert has been distributed throughout the information security community regarding
a critical Apache vulnerability. What action could you take to ONLY identify the known
vulnerability?
A. Perform an unauthenticated vulnerability scan on all servers in the environment
B. Perform a scan for the specific vulnerability on all web servers
C. Perform an authenticated scan on all web servers in the environment
D. Perform a web vulnerability scan on all servers in the environment - Correct Answer B.
Perform a scan for the specific vulnerability on all web servers
Explanation
OBJ-1.7: Since you wish to check for only the known vulnerability, you should scan for that
specific vulnerability on all web servers. All web servers are chosen because Apache is a
web server application. While performing an authenticated scan of all web servers or
performing a web vulnerability scan of all servers would also find these vulnerabilities, it is
a much larger scope. It would waste time and processing power by conducting these
scans instead of properly scoping the scans based on your needs. Performing
unauthenticated vulnerability scans on all servers is also too large in scope (all servers)
while also being less effective (unauthenticated scan).
You have signed up for a web-based appointment scheduling application to help you
manage your new IT technical support business. What type of solution would this be
categorized as?
A. IaaS
B. DaaS
, C. PaaS
D. SaaS - Correct Answer D. SaaS
Explanation
OBJ-2.2: Software as a Service (SaaS) is a cloud computing service that enables a
service provider to make applications available over the Internet to end-users. This can be
a calendar, scheduling, invoicing, word processor, database, or other programs. For
example, Google Docs and Office 365 are both word processing SaaS solutions. Platform
as a Service (PaaS) is a cloud computing service that enables consumers to rent fully
configured systems that are set up for specific purposes. Infrastructure as a Service
(IaaS) is a cloud computing service that enables a consumer to outsource computing
equipment purchases and running their own data center.
Recently, you discovered an unauthorized device during a search of your corporate
network. The device provides nearby wireless hosts to access the corporate network's
resources. What type of attack is being utilized?
A. Bluesnarfing
B. Rogue access point
C. Bluejacking
D. IV attack - Correct Answer B. Rogue access point
Explanation
OBJ-1.4: A rogue access point is a wireless access point that has been installed on a
secure network without explicit authorization from a local network administrator, whether
added by a well-meaning employee or by a malicious attacker. The question describes
the unauthorized device, indicating it is a rogue device. An access point performs the
ability to connect wireless hosts to the corporate network. Therefore, the unauthorized
device in this question would be considered a rogue access point.
Which of the following password policies defines the types of alphanumeric characters
required to be utilized in a user's password?
A. Password expiration
Answers with Explanations.
Which of the following utilizes a well-written set of carefully developed and tested scripts
to orchestrate runbooks and generate consistent server builds across an enterprise?
A. Software-Defined Networking (SDN)
B. Infrastructure as Code (IaC)
C. Infrastructure as a Service (IaaS)
D. Software as a Service (SaaS) - Correct Answer B. Infrastructure as Code (IaC)
Explanation
OBJ-2.2: Infrastructure as Code (IaC) is designed with the idea that a well-coded
description of the server/network operating environment will produce consistent results
across an enterprise and significantly reduce IT overhead costs through automation while
precluding the existence of security vulnerabilities. SDN uses software to define
networking boundaries but does not necessarily handle server architecture in the same
way that IaC can. Infrastructure as a Service (IaaS) is a computing method that uses the
cloud to provide any or all infrastructure needs. Software as a Service (SaaS) is a
computing method that uses the cloud to provide users with application services.
What sanitization technique uses only logical techniques to remove data, such as
overwriting a hard drive with a random series of ones and zeroes?
A. Clear
B. Degauss
C. Purge
D. Destroy - Correct Answer A. Clear
,Explanation
OBJ-2.7: Clear applies logical techniques to sanitize data in all user-addressable storage
locations for protection against simple non-invasive data recovery techniques. Clearing
involves overwriting data once (and seldom more than three times) with repetitive data
(such as all zeros) or resetting a device to factory settings. Purging data is meant to
eliminate information from being feasibly recovered even in a laboratory environment.
Destroy requires physical destruction of the media, such as pulverization, melting,
incineration, and disintegration. Degaussing is the process of decreasing or eliminating a
remnant magnetic field. Degaussing is an effective method of sanitization for magnetic
media, such as hard drives and floppy disks.
The public library has had a recent issue with their laptops being stolen from their
computer lab.Since this is a public library, it is not a high-security area and is fully
accessible by patrons during the day. What is the best way to prevent the theft of laptops?
A. Mobile Device Management
B. CCTV
C. Cable Locks
D. Motion Sensorsx - Correct Answer C. Cable Locks
Explanation
OBJ-2.7: Cable locks are the best solution to allow the laptops to be connected physically
to the desks and prevent theft. CCTV is a deterrent or detective control but will require
someone to monitor it to detect the theft. Mobile device management focuses on tablets or
phones, not laptops. Motion sensors are not useful during the library's open hours since
authorized patrons are allowed into the lab during the day. If laptop theft occurs during the
day, motion sensors will be useless to stop them.
Which of the following cryptographic algorithms is classified as symmetric?
A. DSA
B. DES
C. GPG
,D. ECC - Correct Answer B. DES
Explanation
OBJ-2.8: The Data Encryption Standard (DES) is a symmetric-key algorithm for the
encryption of digital data. Although its short key length of 56 bits makes it too insecure for
applications, it was the standard used from 1977 until the early 2000s. GPG, ECC, and
DSA are all asymmetric algorithms.
A new alert has been distributed throughout the information security community regarding
a critical Apache vulnerability. What action could you take to ONLY identify the known
vulnerability?
A. Perform an unauthenticated vulnerability scan on all servers in the environment
B. Perform a scan for the specific vulnerability on all web servers
C. Perform an authenticated scan on all web servers in the environment
D. Perform a web vulnerability scan on all servers in the environment - Correct Answer B.
Perform a scan for the specific vulnerability on all web servers
Explanation
OBJ-1.7: Since you wish to check for only the known vulnerability, you should scan for that
specific vulnerability on all web servers. All web servers are chosen because Apache is a
web server application. While performing an authenticated scan of all web servers or
performing a web vulnerability scan of all servers would also find these vulnerabilities, it is
a much larger scope. It would waste time and processing power by conducting these
scans instead of properly scoping the scans based on your needs. Performing
unauthenticated vulnerability scans on all servers is also too large in scope (all servers)
while also being less effective (unauthenticated scan).
You have signed up for a web-based appointment scheduling application to help you
manage your new IT technical support business. What type of solution would this be
categorized as?
A. IaaS
B. DaaS
, C. PaaS
D. SaaS - Correct Answer D. SaaS
Explanation
OBJ-2.2: Software as a Service (SaaS) is a cloud computing service that enables a
service provider to make applications available over the Internet to end-users. This can be
a calendar, scheduling, invoicing, word processor, database, or other programs. For
example, Google Docs and Office 365 are both word processing SaaS solutions. Platform
as a Service (PaaS) is a cloud computing service that enables consumers to rent fully
configured systems that are set up for specific purposes. Infrastructure as a Service
(IaaS) is a cloud computing service that enables a consumer to outsource computing
equipment purchases and running their own data center.
Recently, you discovered an unauthorized device during a search of your corporate
network. The device provides nearby wireless hosts to access the corporate network's
resources. What type of attack is being utilized?
A. Bluesnarfing
B. Rogue access point
C. Bluejacking
D. IV attack - Correct Answer B. Rogue access point
Explanation
OBJ-1.4: A rogue access point is a wireless access point that has been installed on a
secure network without explicit authorization from a local network administrator, whether
added by a well-meaning employee or by a malicious attacker. The question describes
the unauthorized device, indicating it is a rogue device. An access point performs the
ability to connect wireless hosts to the corporate network. Therefore, the unauthorized
device in this question would be considered a rogue access point.
Which of the following password policies defines the types of alphanumeric characters
required to be utilized in a user's password?
A. Password expiration
