CompTIA Security+ (2020 series)856 questions across 86 pages are complete and free, with no account or card.
856 questions in this bank
Free access · progress saved on this device
In the middle of a cyberattack, a security engineer removes the infected devices from the network and locks down all compromised accounts. In which of the following incident response phases is the security engineer currently operating?
Answer: F
A network administrator would like to configure a site-to-site VPN utilizing IPSec. The administrator wants the tunnel to be established with data integrity, encryption, authentication, and anti-replay functions. Which of the following should the administrator use when configuring the VPN?
Answer: C
A. AH (Authentication Header) provides authentication and data integrity but does not offer encryption or anti-replay protection. It does not encrypt the payload. B. EDR (Endpoint Detection and Response) is a security technology used for detecting and responding to advanced threats and breaches on endpoints (computers and servers). It's not related to configuring VPNs. C. ESP (Encapsulating Security Payload) is the correct choice for a site-to-site VPN when you need encryption, authentication, data integrity, and anti-replay protection. D. DNSSEC (Domain Name System Security Extensions) is used to add security to the DNS by providing authentication and data integrity for DNS data. It's not directly related to configuring VPNs with the specified requirements.
Source: Adapted from community discussion — touisuzuki
A security incident may have occurred on the desktop PC of an organization's Chief Executive Officer (CEO). A duplicate copy of the CEO's hard drive must be stored securely to ensure appropriate forensic processes and the chain of custody are followed. Which of the following should be performed to accomplish this task?
Answer: B
B. Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy. This option reflects the correct approach to creating a forensic copy of a hard drive. By using a write blocker, you ensure that no data is written to the original drive during the copying process, which might change the drive's state and potentially destroy evidence, contradicting the main principle of digital forensic analysis—to cause as little change as possible to the original data. Answer A could change data on the disk while changing the hard drive, compromising the integrity of the data. Answer C is not a valid process since the hard drive needs to be connected to a forensic workstation with a write blocker, not merely copying the files. Finally, Answer D is incorrect because creating a forensic copy as early as possible helps to preserve the evidence; the copy can be used for detailed analysis, not the original drive.
Source: Adapted from community discussion — mpengly88
A security engineer at an offline government facility is concerned about the validity of an SSL certificate. The engineer wants to perform the fastest check with the least delay to determine if the certificate has been revoked. Which of the following would BEST meet these requirements?
Answer: C
Yes, the question says it's an offline government facility so it automatically eliminates OCSP which makes CRL the only viable choice. CRL is the correct answer.
Source: Adapted from community discussion — Soleandheel
A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use?
Answer: D
I would go with option D: RAID 10. RAID 10 generally has better performance than RAID 5 and it also provides fault tolerance.
Source: Adapted from community discussion — NetTech
Which of the following algorithms has the SMALLEST key size?
Answer: A
A key length of 512 bits is no longer considered secure Therefore, 1024 bits is the lowest key length that is generally recommended for RSA encryption. Thanks
Source: Adapted from community discussion — sujon_london
During an incident response, a security analyst observes the following log entry on the web server:
Which of the following BEST describes the type of attack the analyst is experiencing?
Answer: D
the attacker manipulates the URL parameters by using "../" sequences or absolute file paths to navigate to parent directories and access arbitrary files and directories on the URL parameter "show" contains multiple "../" sequences, indicating an attempt to navigate to parent directories. The attacker is trying to access the "/etc/passwd" file, which is a commonly targeted file that stores user account information on Unix-based systems.
Source: Adapted from community discussion — sujon_london
A security audit has revealed that a process control terminal is vulnerable to malicious users installing and executing software on the system. The terminal is beyond end-of-life support and cannot be upgraded, so it is placed on a protected network segment. Which of the following would be MOST effective to implement to further mitigate the reported vulnerability?
Answer: D
Application whitelisting. Application whitelisting is a security measure that allows only approved and trusted applications to run on a system, while blocking all other applications. By implementing application whitelisting on the vulnerable process control terminal, any attempt to install and execute unauthorized software would be blocked, effectively mitigating the reported vulnerability..
Source: Adapted from community discussion — sujon_london
A document that appears to be malicious has been discovered in an email that was sent to a company's Chief Financial Officer (CFO). Which of the following would be BEST to allow a security analyst to gather information and confirm it is a malicious document without executing any code it may contain?
Answer: C
"without executing any code it may contain" which means A and D is automatically wrong. B wouldn't tell you directly anything about the document C if you compare the document with hashes and it matches with a known malware, then you know if it is a malware
Source: Adapted from community discussion — sirpetey
An organization has activated an incident response plan due to a malware outbreak on its network. The organization has brought in a forensics team that has identified an internet-facing Windows server as the likely point of initial compromise. The malware family that was detected is known to be distributed by manually logging on to servers and running the malicious code. Which of the following actions would be BEST to prevent reinfection from the infection vector?
Answer: D
The SMB Protocol (in all its version) doesn't provide functionality to execute files at the remote systems. Its main objective is to support the sharing of file and print resource between machines. The only feasible option left is loggin through RDP and manually executing the file. Correct me if I am wrong
Source: Adapted from community discussion — stoneface
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-601 practice, question 621. 856 questions available.
Version 1.0.0. How we source questions