Comptia Security+ 1-50

Front 1

Which of the following is the BEST approach to perform risk mitigation of user access control
rights?
A. Conduct surveys and rank the results.
B. Perform routine user permission reviews.
C. Implement periodic vulnerability scanning.
D. Disable user accounts that have not been used within the last two weeks.

Back 1

B. Perform routine user permission reviews.

Front 2

Which of the following devices is BEST suited for servers that need to store private keys?
A. Hardware security module
B. Hardened network firewall
C. Solid state disk drive
D. Hardened host firewall

Back 2

A. Hardware security module

Front 3

All of the following are valid cryptographic hash functions EXCEPT:
A. RIPEMD.
B. RC4.
C. SHA-512.
D. MD4.

Back 3

B. RC4.

Front 4

In regards to secure coding practices, why is input validation important?
A. It mitigates buffer overflow attacks.
B. It makes the code more readable.
C. It provides an application configuration baseline.
D. It meets gray box testing standards.

Back 4

A. It mitigates buffer overflow attacks.

Front 5

Which of the following would be used when a higher level of security is desired for encryption key
storage?
A. TACACS+
B. L2TP
C. LDAP
D. TPM

Back 5

D. TPM

Front 6

A security administrator needs to determine which system a particular user is trying to login to at
various times of the day. Which of the following log types would the administrator check?
A. Firewall
B. Application
C. IDS
D. Security

Back 6

D. Security

Front 7

Which of the following MUST be updated immediately when an employee is terminated to prevent
unauthorized access?
A. Registration
B. CA
C. CRL
D. Recovery agent

Back 7

C. CRL

Front 8

Employee badges are encoded with a private encryption key and specific personal information.
The encoding is then used to provide access to the network. Which of the following describes this
access control type?
A. Smartcard
B. Token
C. Discretionary access control
D. Mandatory access control

Back 8

A. Smartcard

Front 9

Which of the following devices would MOST likely have a DMZ interface?
A. Firewall
B. Switch
C. Load balancer
D. Proxy

Back 9

A. Firewall

Front 10

Which of the following application security testing techniques is implemented when an automated
system generates random input data?
A. Fuzzing
B. XSRF
C. Hardening
D. Input validation

Back 10

A. Fuzzing

Front 11

Which of the following can be used by a security administrator to successfully recover a user’s
forgotten password on a password protected file?
A. Cognitive password
B. Password sniffing
C. Brute force
D. Social engineering

Back 11

C. Brute force

Front 12

A security administrator wants to check user password complexity. Which of the following is the
BEST tool to use?
A. Password history
B. Password logging
C. Password cracker
D. Password hashing

Back 12

C. Password cracker

Front 13

Certificates are used for: (Select TWO).
A. Client authentication.
B. WEP encryption.
C. Access control lists.
D. Code signing.
E. Password hashing.

Back 13

A. Client authentication.
D. Code signing.

Front 14

Which of the following is a hardware based encryption device?
A. EFS
B. TrueCrypt
C. TPM
D. SLE

Back 14

C. TPM

Front 15

Which of the following BEST describes a protective countermeasure for SQL injection?
A. Eliminating cross-site scripting vulnerabilities
B. Installing an IDS to monitor network traffic
C. Validating user input in web applications
D. Placing a firewall between the Internet and database servers

Back 15

C. Validating user input in web applications

Front 16

Which of the following MOST interferes with network-based detection techniques?
A. Mime-encoding
B. SSL
C. FTP
D. Anonymous email accounts

Back 16

B. SSL

Front 17

A certificate authority takes which of the following actions in PKI?
A. Signs and verifies all infrastructure messages
B. Issues and signs all private keys
C. Publishes key escrow lists to CRLs
D. Issues and signs all root certificates

Back 17

D. Issues and signs all root certificates

Front 18

Use of a smart card to authenticate remote servers remains MOST susceptible to which of the
following attacks?
A. Malicious code on the local system
B. Shoulder surfing
C. Brute force certificate cracking
D. Distributed dictionary attacks

Back 18

A. Malicious code on the local system

Front 19

Separation of duties is often implemented between developers and administrators in order to separate which of the following?
A. More experienced employees from less experienced employees
B. Changes to program code and the ability to deploy to production
C. Upper level management users from standard development employees
D. The network access layer from the application access layer

Back 19

B. Changes to program code and the ability to deploy to production

Front 20

A security administrator needs to update the OS on all the switches in the company. Which of the
following MUST be done before any actual switch configuration is performed?
A. The request needs to be sent to the incident management team.
B. The request needs to be approved through the incident management process.
C. The request needs to be approved through the change management process.
D. The request needs to be sent to the change management team.

Back 20

C. The request needs to be approved through the change management process.

Front 21

Jane, an individual, has recently been calling various financial offices pretending to be another
person to gain financial information. Which of the following attacks is being described?
A. Phishing
B. Tailgating
C. Pharming
D. Vishing

Back 21

D. Vishing

Front 22

A user in the company is in charge of various financial roles but needs to prepare for an upcoming
audit. They use the same account to access each financial system. Which of the following security
controls will MOST likely be implemented within the company?
A. Account lockout policy
B. Account password enforcement
C. Password complexity enabled
D. Separation of duties

Back 22

D. Separation of duties

Front 23

A CRL is comprised of:
A. Malicious IP addresses.
B. Trusted CA’s.
C. Untrusted private keys.
D. Public keys.

Back 23

D. Public keys.

Front 24

Sara, a user, downloads a keygen to install pirated software. After running the keygen, system
performance is extremely slow and numerous antivirus alerts are displayed. Which of the following
BEST describes this type of malware?
A. Logic bomb
B. Worm
C. Trojan
D. Adware

Back 24

C. Trojan

Front 25

Which of the following may significantly reduce data loss if multiple drives fail at the same time?
A. Virtualization
B. RAID
C. Load balancing
D. Server clustering

Back 25

B. RAID

Front 26

Which of the following should be considered to mitigate data theft when using CAT5 wiring?
A. CCTV
B. Environmental monitoring
C. Multimode fiber
D. EMI shielding

Back 26

D. EMI shielding

Front 27

To help prevent unauthorized access to PCs, a security administrator implements screen savers
that lock the PC after five minutes of inactivity. Which of the following controls is being described
in this situation?
A. Management
B. Administrative
C. Technical
D. Operational

Back 27

C. Technical

Front 28

Pete, a network administrator, is capturing packets on the network and notices that a large amount
of the traffic on the LAN is SIP and RTP protocols. Which of the following should he do to segment
that traffic from the other traffic?
A. Connect the WAP to a different switch.
B. Create a voice VLAN.
C. Create a DMZ.
D. Set the switch ports to 802.1q mode.

Back 28

B. Create a voice VLAN.

Front 29

Which of the following IP addresses would be hosts on the same subnet given the subnet mask
255.255.255.224? (Select TWO).
A. 10.4.4.125
B. 10.4.4.158
C. 10.4.4.165
D. 10.4.4.189
E. 10.4.4.199

Back 29

C. 10.4.4.165
D. 10.4.4.189

Front 30

Which of the following algorithms has well documented collisions? (Select TWO).
A. AES
B. MD5
C. SHA
D. SHA-256
E. RSA

Back 30

B. MD5
C. SHA

Front 31

Which of the following is BEST used as a secure replacement for TELNET?
A. HTTPS
B. HMAC
C. GPG
D. SSH

Back 31

D. SSH

Front 32

An email client says a digital signature is invalid and the sender cannot be verified. The recipient is
concerned with which of the following concepts?
A. Integrity
B. Availability
C. Confidentiality
D. Remediation

Back 32

A. Integrity

Front 33

Which of the following is an effective way to ensure the BEST temperature for all equipment within
a datacenter?
A. Fire suppression
B. Raised floor implementation
C. EMI shielding
D. Hot or cool aisle containment

Back 33

D. Hot or cool aisle containment

Front 34

Which of the following transportation encryption protocols should be used to ensure maximum
security between a web browser and a web server?
A. SSLv2
B. SSHv1
C. RSA
D. TLS

Back 34

D. TLS

Front 35

Developers currently have access to update production servers without going through an approval
process. Which of the following strategies would BEST mitigate this risk?
A. Incident management
B. Clean desk policy
C. Routine audits
D. Change management

Back 35

D. Change management

Front 36

Which of the following is a difference between TFTP and FTP?
A. TFTP is slower than FTP.
B. TFTP is more secure than FTP.
C. TFTP utilizes TCP and FTP uses UDP.
D. TFTP utilizes UDP and FTP uses TCP.

Back 36

D. TFTP utilizes UDP and FTP uses TCP.

Front 37

Matt, an administrator, notices a flood fragmented packet and retransmits from an email server.
After disabling the TCP offload setting on the NIC, Matt sees normal traffic with packets flowing in
sequence again. Which of the following utilities was he MOST likely using to view this issue?
A. Spam filter
B. Protocol analyzer
C. Web application firewall
D. Load balancer

Back 37

B. Protocol analyzer

Front 38

Which of the following is characterized by an attacker attempting to map out an organization’s staff
hierarchy in order to send targeted emails?
A. Whaling
B. Impersonation
C. Privilege escalation
D. Spear phishing

Back 38

A. Whaling

Front 39

Which of the following would a security administrator implement in order to discover
comprehensive security threats on a network?
A. Design reviews
B. Baseline reporting
C. Vulnerability scan
D. Code review

Back 39

C. Vulnerability scan

Front 40

Which of the following is an example of a false positive?
A. Anti-virus identifies a benign application as malware.
B. A biometric iris scanner rejects an authorized user wearing a new contact lens.
C. A user account is locked out after the user mistypes the password too many times.
D. The IDS does not identify a buffer overflow.

Back 40

A. Anti-virus identifies a benign application as malware.

Front 41

Data execution prevention is a feature in most operating systems intended to protect against
which type of attack?
A. Cross-site scripting
B. Buffer overflow
C. Header manipulation
D. SQL injection

Back 41

B. Buffer overflow

Front 42

Use of group accounts should be minimized to ensure which of the following?
A. Password security
B. Regular auditing
C. Baseline management
D. Individual accountability

Back 42

D. Individual accountability

Front 43

Privilege creep among long-term employees can be mitigated by which of the following
procedures?
A. User permission reviews
B. Mandatory vacations
C. Separation of duties
D. Job function rotation

Back 43

A. User permission reviews

Front 44

In which of the following scenarios is PKI LEAST hardened?
A. The CRL is posted to a publicly accessible location.
B. The recorded time offsets are developed with symmetric keys.
C. A malicious CA certificate is loaded on all the clients.
D. All public keys are accessed by an unauthorized user.

Back 44

C. A malicious CA certificate is loaded on all the clients.

Front 45

Configuring the mode, encryption methods, and security associations are part of which of the
following?
A. IPSec
B. Full disk encryption
C. 802.1x
D. PKI

Back 45

A. IPSec

Front 46

Which of the following assessments would Pete, the security administrator, use to actively test that
an application’s security controls are in place?
A. Code review
B. Penetration test
C. Protocol analyzer
D. Vulnerability scan

Back 46

B. Penetration test

Front 47

A security administrator has just finished creating a hot site for the company. This implementation
relates to which of the following concepts?
A. Confidentiality
B. Availability
C. Succession planning
D. Integrity

Back 47

B. Availability

Front 48

In the initial stages of an incident response, Matt, the security administrator, was provided the hard
drives in question from the incident manager. Which of the following incident response procedures
would he need to perform in order to begin the analysis? (Select TWO).
A. Take hashes
B. Begin the chain of custody paperwork
C. Take screen shots
D. Capture the system image

Back 48

A. Take hashes
D. Capture the system image

Front 49

Which of the following is used to certify intermediate authorities in a large PKI deployment?
A. Root CA
B. Recovery agent
C. Root user
D. Key escrow

Back 49

A. Root CA

Front 50

Which of the following components MUST be trusted by all parties in PKI?
A. Key escrow
B. CA
C. Private key
D. Recovery key

Back 50

B. CA