CompTIA Security+ (2020 series)856 questions across 86 pages are complete and free, with no account or card.
856 questions in this bank
Free access · progress saved on this device
A smart switch has the ability to monitor electrical levels and shut off power to a building in the event of power surge or other fault situation. The switch was installed on a wired network in a hospital and is monitored by the facilities department via a cloud application. The security administrator isolated the switch on a separate VLAN and set up a patching routine. Which of the following steps should also be taken to harden the smart switch?
Answer: B
A company recently set up an e-commerce portal to sell its products online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?
Answer: A
The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard used to handle credit cards from major card brands. So this is correct answer.
Source: Adapted from community discussion — predsednik
A security analyst is investigating an incident that was first reported as an issue connecting to network shares and the Internet. While reviewing logs and tool output, the analyst sees the following:
Which of the following attacks has occurred?
Answer: E
Address Resolution Protocol (ARP) resolves IPv4 addresses to MAC addresses. MAC addresses are the physical addresses or hardware addresses. TCP/IP uses the IP address to get a packet to a destination network. ARP poisoning attacks use ARP packets to give clients false hardware address updates, and attackers use them to redirect or interrupt network traffic
Source: Adapted from community discussion — JT4
Which of the following allows for functional test data to be used in new systems for testing and training purposes to protect the real data?
Answer: B
Another privacy enhancing technology concept is data masking. The goal of data masking is to protect or obfuscate sensitive data. This goal must be achieved while not rendering the data unusable in any way. -Pearson IT Certification Comptia SY0-601 Cert Guide by Santos, Taylor & Mlodzianowski
Source: Adapted from community discussion — LeonardSnart
A company recently moved sensitive videos between on-premises, company-owned websites. The company then learned the videos had been uploaded and shared to the Internet. Which of the following would MOST likely allow the company to find the cause?
Answer: D
Log analysis is the correct answer here. The video was moved in their on premises internal environment. The only way to find out how/when the video was leaked is to review log entries. It could not possible be right to audit here because there is no 3rd party or any contract in the scenario.
Source: Adapted from community discussion — JT4
A public relations team will be taking a group of guests on a tour through the facility of a large e- commerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboards are cleaned and all desks are cleared. The company is MOST likely trying to protect against:
Answer: A
The company is likely taking precautions to avoid the accidental disclosure of sensitive or proprietary information. Whiteboards and desks can often contain information regarding internal processes, projects, or data that the company would not want to be disclosed to the public or competitors. By cleaning whiteboards and clearing desks, the company is reducing the risk of unintentional exposure of proprietary information during the facility tour.
Source: Adapted from community discussion — DarexTech100
Which of the following actions would be recommended to improve an incident response process?
Answer: A
A is correct. this training can help CSIRT to know whether to trigger IR mechanisms and reduce instances of false alert. With B - I don't really see why giving the IT team access can be beneficial, as this could very likely violate least privilege principle.
Source: Adapted from community discussion — hazeleyes
Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?
Answer: A
A honeyfile is a file used to attract an attacker. The primary way a file can attract an attacker is by the name. An example of a file named pssword.txt is a clear example of a honeyfile.
Source: Adapted from community discussion — JT4
A security analyst needs to generate a server certificate to be used for 802.1X and secure RDP connections. The analyst is unsure what is required to perform the task and solicits help from a senior colleague. Which of the following is the FIRST step the senior colleague will most likely tell the analyst to perform to accomplish this task?
Answer: B
The answer is correct. Generate a Certificate Signing Request (CSR): The senior colleague will instruct the analyst to generate a Certificate Signing Request (CSR) from the server where the certificate will be installed. The CSR is a formal request to a Certificate Authority (CA) to issue a digital certificate. It contains information about the entity requesting the certificate and the public key that will be included in the certificate. This step is essential to initiate the process of obtaining a valid server certificate. Generating a CSR involves providing various details about the organization, the server's domain name, and the desired key length. The CSR is then submitted to a trusted CA, which will issue a digital certificate after validating the information provided. After generating the CSR, the analyst will then proceed to submit it to a Certificate Authority to obtain the server certificate that will be used for 802.1X and secure RDP connections.
Source: Adapted from community discussion — Kriss76
When selecting a technical solution for identity management, an architect chooses to go from an in-house solution to a third-party SaaS provider. Which of the following risk management strategies is this an example of?
Answer: D
D. Transference In this scenario, the organization is transferring the responsibility for identity management to a third-party SaaS provider. By doing so, the organization is shifting some of the risks and responsibilities associated with identity management to the service provider. This can include risks related to system uptime, security, maintenance, and scalability. The other risk management strategies are as follows: A. Acceptance: Accepting the risks without taking specific actions to mitigate or transfer them. B. Mitigation: Taking actions to reduce or mitigate the impact or likelihood of identified risks. C. Avoidance: Taking actions to avoid or eliminate specific risks altogether. In this case, the organization is not avoiding the use of identity management or mitigating the risks themselves but rather transferring some of the risks to the SaaS provider.
Source: Adapted from community discussion — touisuzuki
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-601 practice, question 591. 856 questions available.
Version 1.0.0. How we source questions