Comptia Security + Practice Assessment

Front 1

When considering security what is the major drawback of implementing physical tokens?

Back 1

Mass distribution of such devices is costly.

Front 2

How would you prevent users from accessing sensitive company data during non-business hours?

Back 2

By setting time of day restrictions.

Front 3

You are the network administrator responsible for selecting the access control method that will be used for a new kiosk system to be used in a local museum. The museum's donors want to have full access to information about all items, but visitors should have access only to those items on current display. Which forms of access control are most appropriate to this requirement? (choose all that apply.)

Back 3

Role-based access control

Mandatory access control

Front 4

What determines what a user can view and alter?

Back 4

Access control

Front 5

Which of the following best describes identity proofing?

Back 5

Organizational process that binds users to authentication methods.

Front 6

When you organize security groups and define rights/privileges, the rules should be defined in which of the following ways?

Back 6

Rules are made by management, configured b the administrators, and enforced by the operating system.

Front 7

You have decided to use the Terminal Access Controller Access Control System (TACACS) standard for dial-up authentication. Which of the following capabilities will be provided by this service?

Back 7

Encrypted forwarding.

Front 8

Which of the following is a type of access control that provides access rights assigned to roles and then accounts assigned to these roles?

Back 8

RBAC

Front 9

At which layer of the OSI model does the Internet Protocol Security protocol function?

Back 9

Network Layer

Front 10

With the Discretionary access control model, the most common implementation is through:

Back 10

Access control lists

Front 11

Sustained high levels of processor usage could mean that:

Back 11

There is a serious application error.

Your CPU needs to be upgraded.

Front 12

Anomaly-based monitoring is useful for detecting which types of attacks? (Choose all that apply)

Back 12

New exploits or buffer overflow attacks.

DoS attacks based on payloads or volume

Normal network failures

Protocol and port exploitation

Front 13

On Linux, BIND based DNS uses which daemon for logging?

Back 13

syslogd

Front 14

Which of the following are examples of suspicious activity? (Choose all that apply.)

Back 14

Multiple connections that are in a half-open state.

A log report that indicates multiple login failures on a single account.

Front 15

You suspect that there are problems with your DNS server. No one seems to be able to contact intranet hosts using DNS names. However, the intranet can be contacted by IP address. You're not exactly sure where the problem lies. You go to a workstation, open a DOS prompt, and enter which of the following commands?

Back 15

Nslookup

Front 16

On Windows, you may restrict disk usage through which of the following facilities?

Back 16

Disk quota

Front 17

You have installed a custom monitoring service on the webserver that reviews web service logs to watch for the URL's used by the Code Red worm to propagate itself. When this custom service detects an attack, it raises an alert via email. Which of the following types of IDS is this solution? (Choose all that apply.)

Back 17

Host-based IDS

Knowledge-based IDS

Front 18

To monitor the health of all systems, agents are installed on the machines, and then the agents are monitored from a central location. This is an implementation of which of the following?

Back 18

SNMP

Front 19

What is the name given to the activity that consists of collecting information that will later be used for monitoring and review purposes?

Back 19

Logging

Front 20

You are tracking SNMP traffic. Which of the following prots would you monitor? (Choose all that apply.)

Back 20

162

161

Front 21

Which of the following kinds of attack aim at exploiting flaws in human logic?

Back 21

Social engineering.

Front 22

In the context of computer forensics, possible dangers to digital evidence may include: (Choose all that apply.)

Back 22

Electromagnetic damage

Booby traps

Viruses

Front 23

Classification of corporate information should be based on: (Choose all that apply.)

Back 23

Business risk

Data value

Front 24

Which of the following is a type of site similar to the original site in that it has all the equipment fully configured, has up-to-date data, and can become operational with minimal delay?

Back 24

Hot site

Front 25

Which of the following is a well-grounded metal structure used to protect a large quantity of equipment from electronic eavesdropping?

Back 25

Faraday cage

Front 26

Redundancy planning includes which of the following? (Choose all that apply.)

Back 26

UPS placement

RAID

Front 27

Phishing often takes place in the form of:

Back 27

Email

Front 28

Which of the following levels of RAID do Windows servers support? (Choose all that apply.)

Back 28

RAID 1

RAID 0

RAID 5

Front 29

Which of the following is a formal set of statements that defines how systems or network resources can be used?

Back 29

Policies

Front 30

Of the following, which are the characteristics of a cold site?

Back 30

Requires setup time and Company needs to bring it's own equipment.

Front 31

On a Windows network, you may use what feature to restrict users and enforce limitations?

Back 31

Group Policy

Front 32

Which one of the following best represents the principle of least privilege?

Back 32

Requiring that a user be given no more privilege than necessary to perform a job

Front 33

Which of the following are commonly deployed fro warning protective services personnel that physical security measures are being violated?

Back 33

Detective physical controls

Front 34

What are the pros and cons of single sign-on (SSO)? (Choose all that apply.)

Back 34

It aims at improving user experience.

It aims at reducing human error.

Front 35

Which standard prot will be used to establish a web connection using the 40-bit RC4 encryption protocol?

Back 35

443

Front 36

Which of the following criteria is not a common criterion to authenticate a valid access request?

Back 36

Where you log on.

Front 37

Which of the following correctly describe the use of CHAP and MS CHAP for authentication? (Choose all that apply.)

Back 37

MS-CHAP is mainly for older MS compatible clients.

CHAP is an old standard no longer commonly in use.

Front 38

With door access systems, what is commonly used for unlocking doors?

Back 38

Magnetic card keys

Front 39

You are having problems with your email server. No one seems to be receiving any email. You're not exactly sure where the problem lies. You go to a workstation, open a DOS prompt, and enter which of the following commands?

Back 39

Tracert

Front 40

Which of the following are advantages of behavior-based monitoring? (Choose all that apply.)

Back 40

Can learn about malware based on previous detection.

Can identify malware before it's added to signature files.

Can monitor for malware activities.

Front 41

A denial-of-service attack is being waged against the company's webserver using a large external botnet. Which of the following IDS solutions could enhance the attack's effect?

Back 41

Host-based

Front 42

When defining storage and retention policies, which of the following guidelines should you follow? (Choose all that apply.)

Back 42

Files no longer in use should be properly archived.

Junk files should be removed from the file systems as early as possible.

Front 43

Which of the following must be performed when reviewing group policies on a regular basis?

Back 43

Privileges granted to groups and their corresponding membership must be carefully reviewed.

Front 44

You suspect one of your servers may have succumbed to a SYN flood attack. Which one of the following tools might you consider using to help confirm your suspicions?

Back 44

Netstat

Front 45

You have configured your web server to use windows partitions and the Microsoft System Update Service (SUS) to regularly apply new hotfixes and patches. Which of the follow forms of hardening is specified in this solution?

Back 45

Operating system.

Front 46

What does SAINT stand for?

Back 46

Security Administrator's Integrated Network Tool.

Front 47

Which of the following security policies would require users to take mandatory vacations?

Back 47

Separation of duties.

Front 48

Which of the following best describes the objective of a service-level agreement (SLA)?

Back 48

Contracts with suppliers that detail levels of support that must be provided.

Front 49

A Physical security plan should include which of the following? (Choose all that apply.)

Back 49

The threats from which you are protecting against and their likelihood.

Description of the physical assets being protected.

Description of the physical areas where assets are located.

Front 50

Which of the following tells how the evidence made it from the crime scene to the courtroom, including documentation of how the evidence was collected, preserved, and analyzed?

Back 50

Chain of custody

Front 51

Your company does not allow users to use the Internet for personal reasons during work hours. Where is this statement most likely documented?

Back 51

Company policies

Front 52

Information Diving is made possible by the people who do not consider the sensitivity of the items they trash.

Back 52

This is true.

Front 53

You want to implement a proxy firewall technology that can distinguish between FTP commands. Which of the following types of firewall should you choose?

Back 53

Application-level gateway

Front 54

A peer-to-peer network or a workgroup where access is granted based on individual needs is an example of which type of access control?

Back 54

User-based access control

Front 55

Which of the following is the process of identifying and reducing risk to a level that is comfortable and then implementing controls to maintain that level?

Back 55

Risk management

Front 56

Which of the following are the advantages of honeypots and honeynets? (Choose all that apply.)

Back 56

Attacker's actions can more easily be monitored and resulting steps taken to improve system security.

Administrators are allotted time to decide how to respond to an attack.

Attackers are diverted to systems that they cannot damage.

Front 57

An attacker trying to exploit a web server will likely want to scan systems running web services. What port will the attacker scan for?

Back 57

80

Front 58

You have recently had some security breaches in the network. You suspect it may be a small group of employees. You want to implement a solution that will monitor the internal network activity and incoming external traffic. Which of the following devices would you use? (Choose all that apply.)

Back 58

A host-based IDS

A network-based IDS

Front 59

What port is used for a DNS zone transfer?

Back 59

53

Front 60

Which of the following best describes the formula for calculating single loss expectancy?

Back 60

The estimated possibility of a specific threat taking place in a one-year time frame.

Front 61

Which of the following groups is the most appropriate for email distribution lists?

Back 61

Only distribution groups.

Front 62

Which of the following are recommended password account policies? (Choose all that apply.)

Back 62

Set the server not to allow users to use the same password over and over again.

Make the password length at least eight characters and require the use of uppercase and lowercase letters, numbers, and special characters.

Require users to change passwords every 60 to 90 days.

Front 63

Which of the following standards ensures privacy between communicating applications and clients on teh web and has been designed to replace SSL?

Back 63

Transport Layer Security

Front 64

For a key escrow arrangement to work, what must be overcome?

Back 64

Technical mistrust on the security of the escrow arrangement.

Front 65

A certificate request should contain what sort of information? (Choose all that aplly.)

Back 65

Contact email address

Corporate information

Web site name

Front 66

Advanced Encryption Standard (AES) as a block cipher has a fixed block size of:

Back 66

128-bit

Front 67

MD5 uses what hash value to create a hash?

Back 67

A 128-bit hash value

Front 68

Which of the following refers to an encryption technology for ensuring that messages transmitted from one VPN node to another are secure?

Back 68

IPsec

Front 69

Which of the following serves as the authoritative source for certificate revocation status?

Back 69

OCSP responder

Front 70

In the context of windows, with NT 4.0 how are trust relationships configured?

Back 70

Through manual configuration

Front 71

Which of the following is not a certificate trust model for the arranging of certificate authorities?

Back 71

SUB-CA architecture

Front 72

A cryptographic hash function is suitable for use as a primitive in various information security applications, such as: (Choose all that apply.)

Back 72

Message integrity

Authentication

Front 73

Which encryption standard is currently considered the best for WI-FI connections?

Back 73

WPA2

Front 74

Why do spammers value unsecured SMTP relay servers?

Back 74

They can be used to hide the origin of a message.

Front 75

Which of the following is a valid reason why JavaScript and ActiveX can pose significant security risks?

Back 75

They could carry malicious code, which could be easily downloaded though a Web browser.

Front 76

Which of the following mail server features allows email messages to pass from server to server until they reach their final destinations?

Back 76

Open Relay

Front 77

A vulnerability in the BIOS can allow local users to cause which of the following? (Choose all that apply.)

Back 77

Denial of service

System not to boot

Front 78

You have created a utility for defragmenting hard drives. You have hidden code inside the utility that will install itself and cause the infected system to earase the hard drive's contents on April 1 2008. Which of the following attacks has been used in your code?

Back 78

Logic bomb

Front 79

Which of the following correctly describes the host based IDS?

Back 79

All anti-threat applications are installed on every network computer that has been given two-way access to the internet.

Front 80

What type of virus does not require programming knowledge and is found in electronic office documents?

Back 80

Macro

Front 81

A situation in which a program or process attempts to store more data in a temprary data storage area than it was intended to hold is known as what?

Back 81

Buffer overflow

Front 82

Code red is considered a ______.

Back 82

Worm

Front 83

Between which two layers of the OSI model does the Secure Sockets Layer (SSL) protocol function? (Choose all that apply.)

Back 83

Transport Layer

Application Layer

Front 84

Of the following, which one transmits log-on credentials as clear text?

Back 84

PAP

Front 85

Within a router, access may be granted or denied based on IP address. What name is given to this method?

Back 85

ACL

Front 86

External motion detectors can use which of the following technologies? (Choose all that apply.)

Back 86

Infrared

Ultrasonic

Sound

Front 87

Which of the following is a NMAP scan mode in which there is no special privileged needed and low-level control would be impossible?

Back 87

Connect scan

Front 88

Which of the following are performance parameters that should be monitored? (Choose all that aplly.)

Back 88

Ram

CPU

Logical disks

Front 89

when reviewing group policies, you want to be sure:

Back 89

The right people are being placed in the right group.

Front 90

Which of the following describes a host configured to expose a specific service to a public network, while hardening all other resource access to restrict access within an organization's secure network?

Back 90

Bastion

Front 91

You have deployed a packet-monitoring system to sniff packets passing through an organization's DMZ. Which of the following types of IDS is this solution?

Back 91

Network-based IDS

Front 92

LDAP is often perceived as a simpler implementation of which standard?

Back 92

The X.500

Front 93

In a RADIUS authentication scenario, which of the following systems would be considered the RADIUS client?

Back 93

The RAS server

Front 94

Which of the following refers to a record of system activities for the reconstruction and examination of the sequence of events of a transaction from its inception to output of final results?

Back 94

audit trail

Front 95

What must be periodically audited to ensure least privilege is being maintained?

Back 95

User access rights

Front 96

In service level management what specifies that the contracting parties agree upon a particular level of service?

Back 96

SLA

Front 97

Which of the following would be defined in an acceptable use policy? (Choose all that apply.)

Back 97

Detailed standards of behavior.

Privacy statement.

Detailed enforcement guidelines and standards.

Front 98

A physical security plan should include which of the following? (Choose all that apply.)

Back 98

Description of the physical areas wheres assets are located

Description of the physical assets being protected.

The threats from which you are protecting against and their likelihood.

Front 99

Which of the following are examples of social engineering? (Choose all that apply.)

Back 99

An attacker unplugs a user's network connection and then offers to help try to correct the problem.

An attacker obtains an IT office T-Shirt from a local thrift store and takes a user's computer for service.

Front 100

Which of the following is a type of uninterruptible power supply where power usually derives directly from the power line, until the power fails?

Back 100

Standby power supply

Front 101

Which of the following should be used to help prevent against the mishandling of media?

Back 101

Labeling

Front 102

Full backups are performed weekly on Sunday at 1:00 a.m., and incremental backups are done on weekdays at 1:00 a.m. If a drive failure causes a total loss of data at 8:00 a.m. on Tuesday morning, what is the minimum number of backup files that must be used to restore the lost data?

Back 102

Three

Front 103

Which of the following is one major function of NIDS/NIPS?

Back 103

It determines if a trend of unauthorized attempts is occurring.

Front 104

What type of backup is normally done once a day and clears the archive bit after the files have been backend up?

Back 104

Incremental

Front 105

Which of the following are the best reasons for the use of virtualized environments? (Choose all that apply)

Back 105

Reduced need for equipment

Capability to isolate applications

Front 106

Your network is under attack. Traffic patterns indicate that an unauthorized service is relaying information to a source outside the network. What type of attack is being executed against you?

Back 106

Man-in-the-middle

Front 107

You are setting up a web server that needs to be accessed by both the employees and by external customers. What type of architecture should you implement?

Back 107

DMZ

Front 108

Which of the following are uses for proxy serves? (Choose all that apply.)

Back 108

Internet connectivity

Load balancing

Web content caching

Front 109

When configuring a broadband router, what action is recommended for security enhancement in a practical way?

Back 109

Change the default account settings.

Front 110

Trusted Platform Module describes the microcontroller affixed to the computing device at which level?

Back 110

motherboard level

Front 111

Which one of the following best identifies the system of digital certificates and certification authorities used in public key technology?

Back 111

Public key infrastructure (PKI)

Front 112

Which of the following is a type of cipher that has earned the distinction of being unbreakable?

Back 112

OTP

Front 113

The sender of data is provided with proof of delivery, and neither the sender nor receiver can deny either having sent or received the data. What is this called?

Back 113

Nonrepudiation

Front 114

Which one of the following is an older, proprietary, two-way reversible encryption protocol?

Back 114

Shiva Password Authentication Protocol (SPAP)

Front 115

Which of the following is the best choice for choice for encrypting large amounts of data?

Back 115

Symmetric encryption

Front 116

Which one of the following defines APIs for devices such as smart cards that will contain cryptographic information?

Back 116

PKCS #11

Front 117

In the world of IKE, what describes how entities will utilize security services for communicationg data flow securely?

Back 117

Security Association

Front 118

Which type of algorithm generates a key pair (a public key and a private key) that is then used to encrypt and decrypt data and messages sent and received?

Back 118

Asymmetric encryption algorithm

Front 119

Which of the following is associated with behaviors such as collecting personal information or changing your computer configuration, without appropriately obtaining prior consent?

Back 119

Spyware

Front 120

Logic bombs may be used for providing which of the following functions?

Back 120

setting off a malicious function

Front 121

Which of the following is a program or piece of code that runs on your computer without your knowledge and is designed to attach itself to other code and replicate?

Back 121

Virus

Front 122

BIOS access control can be bypassed by which of the following methods? (Choose all that apply.)

Back 122

Deleting the contents of the CMOS RAM

Cracking the BIOS password

Overloading the keyboard buffer

Front 123

Which of the following is a correct definition of a Trojan?

Back 123

It buries itself in the operating system software and infects other systems only after a user executes the application that it is buried in.

Front 124

A hacker attempting to break into a server running microsoft windows will most likely attempt to break into which account?

Back 124

Administrator

Front 125

What is the primary purpose of releasing software hotfixes?

Back 125

To address vulnerability issue.

Front 126

an attacker places code within a web page that executes when a client's browser opens the web page, causing the client's browser to attempt to access a secured banking site in another city. This is an example of what type of attack?

Back 126

Cross-site scripting

Front 127

Platform virtualization is typically performed by

Back 127

The host software

Front 128

When using RADIUS to authenticate a dial-in user, which of the following is the RADIUS client?

Back 128

The RAS server

Front 129

At what layer of the OSI model does the Point-to-Point Protocol (PPP) provide services?

Back 129

2

Front 130

What does Implicity deny mean?

Back 130

This means an access would be denied UNLESS it is explicitly allowed.

Front 131

Man-Traps are typically implemented in the form of which of the following?

Back 131

access control security booths

Front 132

Whith role based access control (RBAC), how are access rights grouped?

Back 132

Role name

Front 133

Which of the following components are methods of addressing risk? (Choose all that apply.)

Back 133

Mitigating the risk

accepting the risk

Transfering the risk

Front 134

You are the network administrator responsible for overseeing the help desk. An employee calls to report that she cannot view the security events in event viewer. Which of the following is a reason why the security events cannot be viewed? (choose all that apply.)

Back 134

This is available for view only to administrators.

Auditing must be enabled.

Front 135

A system restoration plan should include which of the following? (Choose all that apply.)

Back 135

Backup generator procedures

Contingency planning to recover systems and data even in the event of administration personnel loss

Front 136

With which of the following can you protect yourself from a totally disconnected situation?

Back 136

redundant ISPs

Front 137

Dumpster diving rrefers to the action of:

Back 137

Rummaging though trash to find useful things

Front 138

Which one of the following is not true about a web server?

Back 138

A web server must always run on port 80.

Front 139

Vampire tap would be a concern primarily for which of network?

Back 139

network running coaxial cable

Front 140

Which of the following represent the pool of well-known ports?

Back 140

0 through 1023

Front 141

You are setting up a switched network and want to group users by department. Which technology would you implement?

Back 141

VLAN

Front 142

When evaluating assets wich of the following factors must be considered? (choose all that apply.)

Back 142

Its worth to the competition

The replacement cost

Its value to the organization

Front 143

In a PKI, you need the help of which of the following to recover lost keys?

Back 143

Recovery agent.

Front 144

Which of the following describes the writing of hidden messages in such a way that a third party would hardly realize there is a hidden message?

Back 144

Steganography

Front 145

When encrypting and decrypting an email using an asymmetric encryption algorithm, you ____________.

Back 145

Use the private key to decrypt data encrypted with the public key.

Front 146

Which of the following is a hybrid cryptosystem?

Back 146

PGP

Front 147

Which of the following is a piece of software that can be installed and hidden on a computer mainly for the purpose of compromising the system?

Back 147

Rootkit

Front 148

Which of the following involves having nearly identical messages sent to multiple recipients via e-mail?

Back 148

E-mail spam

Front 149

What file system is preferred for use on all systems running Microsoft Windows NT, Windows 2000, Windows XP, and Windows vista operating systems?

Back 149

NTFS

Front 150

A collection of compromised computers running software installed by a Trojan horse or a worm is referred to as what?

Back 150

Botnet

Front 151

You are presented with an authentication scheme in which Computer A calculates a code it sends to Computer B, Computer B returns a calculated code based on the one from Computer b and one of its own, and then Computer A returns a calculated code to computer B based on its transmitted code. What type of authentications is this?

Back 151

Mutual authentication

Front 152

What are the pros and cons of Single sing-on (SSO)? (Choose all that apply.)

Back 152

It aims at improving user experience.

It aims at reducing human error.

Front 153

You may use Etherpeek for what purposes?

Back 153

To check and ensure that your firewall is blocking your computers from replying with valuable information to a port scan from someone outside of your network.

Front 154

Shoulder surfing refers to the use of what technique to gain information without the consent of the victim?

Back 154

direct observation

Front 155

Which of the following is a type of site similar to the original site in that it has all the equipment fully configured, has up-to-date data, and can become operational with mainimal delay?

Back 155

Hot site

Front 156

Which of the following refers to an offsite data processing facility that if fully operational?

Back 156

hot site

Front 157

What is the IEEE standard for wireless LAN technology?

Back 157

802.11

Front 158

Your company is in the process of locking down CIFS and SMB file and print sharing. Which of the following ports do you have to secure? (Choose all that apply.)

Back 158

138

139

Front 159

You're the security administrator for a bank. The users are complaining about the network being slow. However, it is not a particularly busy time of the day. you capture network packets and discover that hundreds of ICMP packets have been snet to the host. What type of attack is likely being executed against your network?

Back 159

Denial of service

Front 160

Which of the following is a form of network attack in which an authentic data transmissino is dishonestly or treacherously repeated or postponed?

Back 160

replay attack

Front 161

Which of the following can be deployed to intercept and log network traffic that passes through the network?

Back 161

packet sniffer

Front 162

A cryptografhic hash function is suitable for use as a primitive in various informatin security applications, such as: (Choose all that apply.)

Back 162

message integrity

authentication

Front 163

A conventional secret-key cryptosystem should be retained for use on the bulk of the message when encryption has to be performed.

Back 163

True if performance is a concern

Front 164

Which of the following is the major purpose of deploying digital certificates?

Back 164

Verifying the identity of the user who sent out the message

Front 165

Which of the following is a UNIX-based command interface and protocol for accessing a remote computer securely?

Back 165

Secure Socket Shell (SSH)

Front 166

Which of the following are primary weaknesses of LM hash? (Choose all that apply.)

Back 166

Before being hashed, all lowercase characters in the password are converted to uppercase characters.

Passwords longer than seven characters are broken down into chuncks.

Front 167

Which of the following is a primary method for minimizing threat to a web server?

Back 167

Disable nonessential services.

Front 168

Which one of the following is not a private IP address?

Back 168

165.193.123.44

Front 169

A SYN flood is a form of:

Back 169

Denial-of-service attack

Front 170

Virtualization technologies are made possible through which of the following means?

Back 170

Multiple processor cores in the same processor die?