CompTIA Security+ h
USBhTokenhandhPINh-
hAnswerhAhChief hInformationhSecurityhOfficerh(CISO)hwantshtohimplementhtwo-
factorhauthenticationhwithin
thehcompany.hWhichhofhthehfollowinghwouldhfulfillhthehCISO'shrequirements?
ScreenhLockh-
hAnswerhWhichhofhthehfollowinghcanhahsecurityhadministratorhimplementhonhmobilehdevicesh
thathwillhhelp
preventhunwantedhpeoplehfromhviewinghthehdatahifhthehdevicehishlefthunattended?
Protocolhanalyzerh-
hAnswerhWhichhofhthehfollowinghwouldhahsecurityhadministratorhimplementhinhorderhtohidenti
fyhahproblem
betweenhtwohsystemshthatharehnothcommunicatinghproperly?
Falsehpositivesh-
hAnswerhWhichhofhthehfollowinghcanhresulthinhsignificanthadministrativehoverheadhfromhinco
rrecthreporting?
Vulnerabilityhscanh-
hAnswerhAhsecurityhadministratorhwantshtohperformhroutinehtestshonhthehnetworkhduringhwor
kinghhourshwhenhcertainhapplicationsharehbeinghaccessedhbyhthehmosthpeople.hWhichhofhth
ehfollowinghwouldhallowhthehsecurityhadministratorhtohtesththehlackhofhsecurityhcontrolshforhth
osehapplicationshwithhthehleast
impacthtohthehsystem?
ALEh-
hAnswerhWhichhofhthehfollowinghriskhconceptshrequireshanhorganizationhtohdeterminehthehnu
mberhofhfailures
perhyear?
RETURNhTOhEXAMh-
hAnswerhPleasehbehawarehthathifhyouhdohnothaccepththesehtermshyouhwillhnothbehallowedhtoht
akehthis
CompTIAhexamhandhyouhwillhforfeiththehfeehpaid.
operational,htechnical,handhmanagementh-
hAnswerhThreehofhthehprimaryhsecurityhcontrolhtypeshthathcanhbehimplementedhare.
Identificationh-
hAnswerhThehhelpdeskhreportshincreasedhcallshfromhclientshreportinghspikeshinhmalwarehinf
ectionshonhtheir
,systems.hWhichhofhthehfollowinghphaseshofhincidenthresponsehishMOSThappropriatehashahFI
RST
response?
SCPh-
hAnswerhWhichhofhthehfollowinghprotocolshoperateshaththehHIGHESThlevelhof hthehOSIhmode
l?
$5,000h-
hAnswerhJoe,hthehsystemhadministrator,hhashbeenhaskedhtohcalculatehthehAnnualhLosshExp
ectancyh(ALE)hfor
ah$5,000hserver,hwhichhoftenhcrashes.hInhthehpasthyear,hthehserverhhashcrashedh10htimes,hr
equiring
ahsystemhreboothtohrecoverhwithhonlyh10%hlosshofhdatahorhfunction.hWhichhofhthehfollowinghi
shthe
ALEhofhthishserver?
Honeypoth-
hAnswerhWhichhofhthehfollowinghshouldhanhadministratorhimplementhtohresearchhcurrenthatt
ack
methodologies?
WebhApplicationhFirewallh-
hAnswerhWhichhofhthehfollowinghcanhbehimplementedhinhhardwarehorhsoftwarehtohprotecthah
webhserverhfrom
cross-sitehscriptinghattacks?
MAChFilteringh-
hAnswerhWhichhofhthehfollowinghmeanshofhwirelesshauthenticationhisheasilyhvulnerablehtohsp
oofing?
validatehandhfilterhinputhonhthehserverhsidehandhclienthsidehANDhrestricthandhsanitizehusehofh
specialhcharactershinhinputhandhURLsh-
hAnswerhThehBESThmethodshforhahwebhdeveloperhtohprevenththehwebsitehapplicationhcodeh
fromhbeing
vulnerablehtohcross-sitehrequesthforgeryh(XSRF)harehto:h(SelecthTWO).
LEAPh-
hAnswerhJane,hahsecurityhadministrator,hneedshtohimplementhahsecurehwirelesshauthenticat
ionhmethodhthat
useshahremotehRADIUShserverhforhauthentication.h
WhichhofhthehfollowinghishanhauthenticationhmethodhJanehshouldhuse?
Chainhofhcustodyh-
hAnswerhComputerhevidencehathahcrimehscenehishdocumentedhwithhahtaghstatinghwhohhadhp
ossessionhofhthe
,evidencehathahgivenhtime.
Grouphbasedhprivilegesh-
hAnswerhAhnetworkhadministratorhishconfiguringhaccesshcontrolhforhthehsaleshdepartmenthw
hichhhashhigh
employeehturnover.hWhichhofhthehfollowinghishBESThsuitedhwhenhassigninghuserhrightshtohi
ndividuals
inhthehsaleshdepartment?
Continuityhofhoperationshplanh-
hAnswerhWhichhofhthehfollowinghishbeinghtestedhwhenhahcompany'shpayrollhserverhishpower
edhoffhforheight
hours?
Zero-dayh-
hAnswerhAhsecurityhanalyst,hAnn,hishreviewinghanhIRChchannelhandhnoticeshthathahmalicious
hexploithhashbeen
createdhforhahfrequentlyhusedhapplication.hShehnotifieshthehsoftwarehvendorhandhaskshthem
hfor
remediationhsteps,hbuthishalarmedhtohfindhthathnohpatchesharehavailablehtohmitigatehthishvuln
erability.
WhichhofhthehfollowinghBESThdescribeshthishexploit?
Socialhnetworkingh-
hAnswerhAhsecurityhadministratorhhashconcernshabouthnewhtypeshofhmediahwhichhallowhforht
hehmass
distributionhofhpersonalhcommentshtohahselecthgrouphofhpeople.hTohmitigatehthehriskshinvolv
edhwith
thishmedia,hemployeeshshouldhreceivehtraininghonhwhichhofhthehfollowing?
Applicationhpatchhmanagementh-
hAnswerhAhnetworkhadministratorhishresponsiblehforhsecuringhapplicationshagainsthexternalh
attacks.hEvery
month,hthehunderlyinghoperatinghsystemhishupdated.hTherehishnohprocesshinhplacehforhother
hsoftware
updates.h
WhichhofhthehfollowinghprocesseshcouldhMOSTheffectivelyhmitigatehthesehrisks?
Jobhrotationh-
hAnswerhAhsoftwarehdeveloperhishresponsiblehforhwritinghthehcodehonhanhaccountinghapplic
ation.hAnother
softwarehdeveloperhishresponsiblehforhdevelopinghcodehonhahsystemhinhhumanhresources.h
Onceha
yearhtheyhhavehtohswitchhroleshforhseveralhweeks.h
Whichhofhthehfollowinghpracticeshishbeinghimplemented?
, IPsech-
hAnswerhAhnetworkhengineerhishdesigninghahsecurehtunneledhVPN.hWhichhof hthehfollowingh
protocolshwould
behthehMOSThsecure?
Openhsystemhauthenticationh-
hAnswerhWhichhofhthehfollowinghimplementationhstepshwouldhbehappropriatehforhahpublichwi
relesshhot-spot?
Installhahdigitalhcertificatehonhthehauthenticationhserverh-
hAnswerhWhichhofhthehfollowinghishahstephinhdeployinghahWPA2-
Enterprisehwirelesshnetwork?
802.1xh-
hAnswerhWhichhofhthehfollowinghcontrolshwouldhallowhahcompanyhtohreducehthehexposurehof
hsensitive
systemshfromhunmanagedhdeviceshonhinternalhnetworks?
Disablinghunnecessaryhservicesh-
hAnswerhWhichhofhthehfollowinghpreventativehcontrolshwouldhbehappropriatehforhresponding
htohahdirectivehto
reducehthehattackhsurfacehofhahspecifichhost?
Establishinghbaselinehreportingh-
hAnswerhAhsecurityhmanagerhmusthremainhawarehofhthehsecurityhposturehof heachhsystem.h
Whichhofhthe
followinghsupportshthishrequirement?
reducehthehcertificatehmanagementhburdenh-
hAnswerhDeployinghahwildcardhcertificatehishonehstrategyhto:
Accesshcontrolhlistsh-
hAnswerhThehsecurityhadministratorhneedshtohmanagehtraffichonhahlayerh3hdevicehtohsupport
hFTPhfromhahnew
remotehsite.hWhichhofhthehfollowinghwouldhneedhtohbehimplemented?
22h-hAnswerhWhichhofhthehfollowinghportshishusedhforhSSH,hbyhdefault?
WPA2hCCMPh-
hAnswerhAhnetworkhadministratorhhashbeenhtaskedhwithhsecuringhthehWLAN.hWhichhofhthehf
ollowing
cryptographichproductshwouldhbehusedhtohprovidehthehMOSThsecurehenvironmenthforhtheh
WLAN?
USBhTokenhandhPINh-
hAnswerhAhChief hInformationhSecurityhOfficerh(CISO)hwantshtohimplementhtwo-
factorhauthenticationhwithin
thehcompany.hWhichhofhthehfollowinghwouldhfulfillhthehCISO'shrequirements?
ScreenhLockh-
hAnswerhWhichhofhthehfollowinghcanhahsecurityhadministratorhimplementhonhmobilehdevicesh
thathwillhhelp
preventhunwantedhpeoplehfromhviewinghthehdatahifhthehdevicehishlefthunattended?
Protocolhanalyzerh-
hAnswerhWhichhofhthehfollowinghwouldhahsecurityhadministratorhimplementhinhorderhtohidenti
fyhahproblem
betweenhtwohsystemshthatharehnothcommunicatinghproperly?
Falsehpositivesh-
hAnswerhWhichhofhthehfollowinghcanhresulthinhsignificanthadministrativehoverheadhfromhinco
rrecthreporting?
Vulnerabilityhscanh-
hAnswerhAhsecurityhadministratorhwantshtohperformhroutinehtestshonhthehnetworkhduringhwor
kinghhourshwhenhcertainhapplicationsharehbeinghaccessedhbyhthehmosthpeople.hWhichhofhth
ehfollowinghwouldhallowhthehsecurityhadministratorhtohtesththehlackhofhsecurityhcontrolshforhth
osehapplicationshwithhthehleast
impacthtohthehsystem?
ALEh-
hAnswerhWhichhofhthehfollowinghriskhconceptshrequireshanhorganizationhtohdeterminehthehnu
mberhofhfailures
perhyear?
RETURNhTOhEXAMh-
hAnswerhPleasehbehawarehthathifhyouhdohnothaccepththesehtermshyouhwillhnothbehallowedhtoht
akehthis
CompTIAhexamhandhyouhwillhforfeiththehfeehpaid.
operational,htechnical,handhmanagementh-
hAnswerhThreehofhthehprimaryhsecurityhcontrolhtypeshthathcanhbehimplementedhare.
Identificationh-
hAnswerhThehhelpdeskhreportshincreasedhcallshfromhclientshreportinghspikeshinhmalwarehinf
ectionshonhtheir
,systems.hWhichhofhthehfollowinghphaseshofhincidenthresponsehishMOSThappropriatehashahFI
RST
response?
SCPh-
hAnswerhWhichhofhthehfollowinghprotocolshoperateshaththehHIGHESThlevelhof hthehOSIhmode
l?
$5,000h-
hAnswerhJoe,hthehsystemhadministrator,hhashbeenhaskedhtohcalculatehthehAnnualhLosshExp
ectancyh(ALE)hfor
ah$5,000hserver,hwhichhoftenhcrashes.hInhthehpasthyear,hthehserverhhashcrashedh10htimes,hr
equiring
ahsystemhreboothtohrecoverhwithhonlyh10%hlosshofhdatahorhfunction.hWhichhofhthehfollowinghi
shthe
ALEhofhthishserver?
Honeypoth-
hAnswerhWhichhofhthehfollowinghshouldhanhadministratorhimplementhtohresearchhcurrenthatt
ack
methodologies?
WebhApplicationhFirewallh-
hAnswerhWhichhofhthehfollowinghcanhbehimplementedhinhhardwarehorhsoftwarehtohprotecthah
webhserverhfrom
cross-sitehscriptinghattacks?
MAChFilteringh-
hAnswerhWhichhofhthehfollowinghmeanshofhwirelesshauthenticationhisheasilyhvulnerablehtohsp
oofing?
validatehandhfilterhinputhonhthehserverhsidehandhclienthsidehANDhrestricthandhsanitizehusehofh
specialhcharactershinhinputhandhURLsh-
hAnswerhThehBESThmethodshforhahwebhdeveloperhtohprevenththehwebsitehapplicationhcodeh
fromhbeing
vulnerablehtohcross-sitehrequesthforgeryh(XSRF)harehto:h(SelecthTWO).
LEAPh-
hAnswerhJane,hahsecurityhadministrator,hneedshtohimplementhahsecurehwirelesshauthenticat
ionhmethodhthat
useshahremotehRADIUShserverhforhauthentication.h
WhichhofhthehfollowinghishanhauthenticationhmethodhJanehshouldhuse?
Chainhofhcustodyh-
hAnswerhComputerhevidencehathahcrimehscenehishdocumentedhwithhahtaghstatinghwhohhadhp
ossessionhofhthe
,evidencehathahgivenhtime.
Grouphbasedhprivilegesh-
hAnswerhAhnetworkhadministratorhishconfiguringhaccesshcontrolhforhthehsaleshdepartmenthw
hichhhashhigh
employeehturnover.hWhichhofhthehfollowinghishBESThsuitedhwhenhassigninghuserhrightshtohi
ndividuals
inhthehsaleshdepartment?
Continuityhofhoperationshplanh-
hAnswerhWhichhofhthehfollowinghishbeinghtestedhwhenhahcompany'shpayrollhserverhishpower
edhoffhforheight
hours?
Zero-dayh-
hAnswerhAhsecurityhanalyst,hAnn,hishreviewinghanhIRChchannelhandhnoticeshthathahmalicious
hexploithhashbeen
createdhforhahfrequentlyhusedhapplication.hShehnotifieshthehsoftwarehvendorhandhaskshthem
hfor
remediationhsteps,hbuthishalarmedhtohfindhthathnohpatchesharehavailablehtohmitigatehthishvuln
erability.
WhichhofhthehfollowinghBESThdescribeshthishexploit?
Socialhnetworkingh-
hAnswerhAhsecurityhadministratorhhashconcernshabouthnewhtypeshofhmediahwhichhallowhforht
hehmass
distributionhofhpersonalhcommentshtohahselecthgrouphofhpeople.hTohmitigatehthehriskshinvolv
edhwith
thishmedia,hemployeeshshouldhreceivehtraininghonhwhichhofhthehfollowing?
Applicationhpatchhmanagementh-
hAnswerhAhnetworkhadministratorhishresponsiblehforhsecuringhapplicationshagainsthexternalh
attacks.hEvery
month,hthehunderlyinghoperatinghsystemhishupdated.hTherehishnohprocesshinhplacehforhother
hsoftware
updates.h
WhichhofhthehfollowinghprocesseshcouldhMOSTheffectivelyhmitigatehthesehrisks?
Jobhrotationh-
hAnswerhAhsoftwarehdeveloperhishresponsiblehforhwritinghthehcodehonhanhaccountinghapplic
ation.hAnother
softwarehdeveloperhishresponsiblehforhdevelopinghcodehonhahsystemhinhhumanhresources.h
Onceha
yearhtheyhhavehtohswitchhroleshforhseveralhweeks.h
Whichhofhthehfollowinghpracticeshishbeinghimplemented?
, IPsech-
hAnswerhAhnetworkhengineerhishdesigninghahsecurehtunneledhVPN.hWhichhof hthehfollowingh
protocolshwould
behthehMOSThsecure?
Openhsystemhauthenticationh-
hAnswerhWhichhofhthehfollowinghimplementationhstepshwouldhbehappropriatehforhahpublichwi
relesshhot-spot?
Installhahdigitalhcertificatehonhthehauthenticationhserverh-
hAnswerhWhichhofhthehfollowinghishahstephinhdeployinghahWPA2-
Enterprisehwirelesshnetwork?
802.1xh-
hAnswerhWhichhofhthehfollowinghcontrolshwouldhallowhahcompanyhtohreducehthehexposurehof
hsensitive
systemshfromhunmanagedhdeviceshonhinternalhnetworks?
Disablinghunnecessaryhservicesh-
hAnswerhWhichhofhthehfollowinghpreventativehcontrolshwouldhbehappropriatehforhresponding
htohahdirectivehto
reducehthehattackhsurfacehofhahspecifichhost?
Establishinghbaselinehreportingh-
hAnswerhAhsecurityhmanagerhmusthremainhawarehofhthehsecurityhposturehof heachhsystem.h
Whichhofhthe
followinghsupportshthishrequirement?
reducehthehcertificatehmanagementhburdenh-
hAnswerhDeployinghahwildcardhcertificatehishonehstrategyhto:
Accesshcontrolhlistsh-
hAnswerhThehsecurityhadministratorhneedshtohmanagehtraffichonhahlayerh3hdevicehtohsupport
hFTPhfromhahnew
remotehsite.hWhichhofhthehfollowinghwouldhneedhtohbehimplemented?
22h-hAnswerhWhichhofhthehfollowinghportshishusedhforhSSH,hbyhdefault?
WPA2hCCMPh-
hAnswerhAhnetworkhadministratorhhashbeenhtaskedhwithhsecuringhthehWLAN.hWhichhofhthehf
ollowing
cryptographichproductshwouldhbehusedhtohprovidehthehMOSThsecurehenvironmenthforhtheh
WLAN?
