CompTIA Security+ (2020 series)856 questions across 86 pages are complete and free, with no account or card.
856 questions in this bank
Free access · progress saved on this device
A company policy requires third-party suppliers to self-report data breaches within a specific time frame. Which of the following third-party risk management policies is the company complying with?
Answer: B
The company policy requiring third-party suppliers to self-report data breaches within a specific time frame is an example of compliance with an SLA (Service Level Agreement).
Source: Adapted from community discussion — ApplebeesWaiter1122
While troubleshooting service disruption on a mission-critical server, a technician discovered the user account that was configured to run automated processes was disabled because the user s password failed to meet password complexity requirements. Which of the following would be the best solution to securely prevent future issues?
Answer: C
Service accounts are accounts that are used to run processes that do not require human intervention to start, stop, or administer. From running batch jobs in the data center to executing simple tasks that an organization must complete for purposes of regulatory compliance, many reasons exist for running processes with service accounts that don’t require an account holder. From a security perspective, administrators can configure service accounts to minimize risks associate [sic] with them. For example, in Windows systems, administrators can prevent service accounts from logging in to the system. This limits some of the attack vectors that can be applied to these accounts. Another security provision that can be applied to service accounts that run batch jobs at night is to restrict when they can run. Any service account that has to run in an elevated privilege mode can also be designated to receive extra monitoring and scrutiny." -All-in-One Security+ SY0-601 Exam Guide by Conklin and White
Source: Adapted from community discussion — LeonardSnart
A security analyst is assessing a new y developed web application by testing SQL injection, CSRF, and XML injection. Which of the follow ng frameworks should the analyst consider?
Answer: C
The security analyst should consider OWASP (Open Web Application Security Project) framework. OWASP provides a comprehensive set of guidelines, tools, and techniques to help secure web applications. It also includes a top ten list of the most critical web application security risks, which includes SQL injection, CSRF, and XML injection.
Source: Adapted from community discussion — ApplebeesWaiter1122
A user s laptop constantly disconnects from the Wi-Fi network. Once the laptop reconnects, the user can reach the internet but cannot access shared folders or other network resources. Which of the following types of attacks is the user most likely experiencing?
Answer: D
The user is most likely experiencing an Evil Twin attack. In this type of attack, an attacker creates a fake access point with the same name as the legitimate access point to which the user is trying to connect. The attacker can then intercept and eavesdrop on the user's network traffic, potentially stealing sensitive information. The user's laptop may be disconnecting and reconnecting to the fake access point, causing the inability to access shared folders or other network resources.
Source: Adapted from community discussion — ApplebeesWaiter1122
Which of the following procedures would be performed after the root cause of a security incident has been identified to help avoid future incidents from occurring?
Answer: B
For those who are also confused by Comptia's weird phrasing, and also confused by all the copy and paste Chatgpt answers.. this is how a human brain rationalised between B & D. Imo it is not D. Containment as it does not make sense to start containment only after identifying the root cause of an incident. You contain affected network devices as soon as possible/ immediately to prevent further spread in the network REGARDLESS of whether you have identified the root cause. Furthermore, containment does not directly "help to avoid future incidents from occuring" does it? Do B. lessons learned is the answer.
Source: Adapted from community discussion — je123
A security administrator is integrating several segments onto a single network. One of the segments, which includes legacy devices, presents a significant amount of risk to the network. Which of the follow ng would allow users to access to the legacy devices without compromising the security of the entire network?
Answer: C
C. Jump server. A jump server is a secure device that provides access to other devices within a network. By implementing a jump server, users can access the legacy devices without having direct access to the main network. This way, the risk presented by the legacy devices is isolated to a specific segment, and the security of the rest of the network is not compromised. NIDS (Network Intrusion Detection System) and IPSec (Internet Protocol Security) are security technologies that can be used to secure network traffic. MAC filtering and NAT gateway are network access control technologies that can be used to control access to a network. However, they do not provide the level of security required in this scenario.
Source: Adapted from community discussion — ApplebeesWaiter1122
Which of the following would a security analyst use to determine if other companies in the same sector have seen similar malicious activity against their systems?
Answer: D
-D is correct A security analyst would use threat feeds to determine if other companies in the same sector have seen similar malicious activity against their systems. Threat feeds are a source of information about current and emerging threats, including indicators of compromise (IOCs), which can help organizations identify and respond to attacks. By analyzing threat feeds, a security analyst can identify if other organizations in the same sector are experiencing similar attacks or if a particular attack is unique to their organization.
Source: Adapted from community discussion — mouettespaghetti
Which of the following types of disaster recovery plan exercises requires the least interruption to IT operations?
Answer: C
Tabletop exercises are discussion-based exercises that typically involve key personnel discussing their roles and responses to a particular disaster scenario. This type of exercise does not require any interruption to IT operations and is designed to identify areas that need improvement in the disaster recovery plan without actually implementing any changes. Parallel, full-scale, and simulation exercises involve more active testing of the disaster recovery plan and can cause disruptions to IT operations during the exercise.
Source: Adapted from community discussion — ApplebeesWaiter1122
Which of the follow ng disaster recovery sites is the most cost effective to operate?
Answer: B
The most cost-effective disaster recovery site is a cold site. A cold site is a disaster recovery site that provides only the basic facilities, such as power, cooling, and physical space, but does not have any of the hardware or software needed to run the organization's systems. This means that the organization would need to purchase and install the necessary equipment in the event of a disaster, but the cost of maintaining the cold site is significantly lower than that of a warm or hot site, which are pre-configured with the necessary hardware and software. A hot site is the most expensive to operate, as it is a fully functional and redundant facility with all the necessary hardware and software to run the organization's systems. A warm site is a compromise between a hot and cold site and provides some pre-configured hardware and software, but not to the same extent as a hot site. A hybrid site is a combination of different disaster recovery site types and is typically used when an organization has different tiers of systems with different recovery time objectives.
Source: Adapted from community discussion — ApplebeesWaiter1122
A security operations center wants to implement a solution that can execute files to test for malicious activity. The solution should provide a report of the files' activity against known threats. Which of the following should the security operations center implement?
Answer: C
C, Cuckoo, is the best choice because it is an open-source automated malware analysis system designed to test files in a safe environment and provide a detailed report of their behavior and characteristics. It uses various techniques, including static and dynamic analysis, to detect malware and is capable of emulating different operating systems and architectures. Options A, B, and D, on the other hand, are not specifically designed for this purpose. The Harvester is a tool for collecting information and email addresses, Nessus is a vulnerability scanner, and Sn1per is a penetration testing framework.
Source: Adapted from community discussion — ApplebeesWaiter1122
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-601 practice, question 411. 856 questions available.
Version 1.0.0. How we source questions