CompTIA Security+ (2020 series)856 questions across 86 pages are complete and free, with no account or card.
856 questions in this bank
Free access · progress saved on this device
Which of the following can work as an authentication method and as an alerting mechanism for unauthorized access attempts?
Answer: B
It's like the google notification, is a MFA -give you push notifications to authenticate and alert you on someone is trying to log in your acount.
Source: Adapted from community discussion — Ribeiro19
A company has a flat network in the cloud. The company needs to implement a solution to segment its production and non-production servers without migrating servers to a new network. Which of the following solutions should the company implement?
Answer: C
Just for someone (like me) that didnt know what a flat network is a flat network is a computer network design approach that aims to reduce cost, maintenance and administration. Flat networks are designed to reduce the number of routers and switches on a computer network by connecting the devices to a single switch instead of separate switches.
Source: Adapted from community discussion — banditring
The president of a regional bank likes to frequently provide SOC tours to potential investors. Which of the following policies BEST reduces the risk of malicious activity occurring after a tour?
Answer: D
A malicious investor would not be able to take advantage of anything gained until after the tour if the swiped a USB, looked at or stole documents. If their was a clean desk policy then that would prevent issues after a tour.
Source: Adapted from community discussion — Boats
A Chief Information Security Officer has defined resiliency requirements for a new data center architecture. The requirements are as follows: * Critical fileshares will remain accessible during and after a natural disaster. * Five percent of hard disks can fail at any given time without impacting the data. * Systems will be forced to shut down gracefully when battery levels are below 20%. Which of the following are required to BEST meet these objectives? (Choose three.)
Answer: DEG
same. RAID covers the 5% disk failure UPS covers the graceful shutdown Geo Disp covers the critical file shares remain available during disaster
Source: Adapted from community discussion — k9_462
Which of the following is a security best practice that ensures the integrity of aggregated log files within a SIEM?
Answer: A
Re-read the question. The question asks about integrity of the AGGREGATE logs. Answer choice A only mentions hashing the source logs. Either way, hashing does not *provide* integrity. Rather, hashing will detect whether or not the integrity of a particular piece of data is maintained, but hashing on it's own will not ENSURE the integrity. You need a preventative control, which would be storing on a write-protected server.
Source: Adapted from community discussion — daddylonglegs
A security analyst is evaluating the risks of authorizing multiple security solutions to collect data from the company's cloud environment. Which of the following is an immediate consequence of these integrations?
Answer: D
Choosing D: While Non-compliance with data sovereignty rules is an implication of having multiple cloud providers at DIFFERENT countries, this is not specified in the question, besides, they are security solutions, which typically means they will not collect any kind of PII, PHI, SPI
Source: Adapted from community discussion — stoneface
Which of the following explains why RTO is included in a BIA?
Answer: A
RTO = Recovery time objective. "The maximum tolerable length of time that a computer, system, network or application can be down after a failure or disaster occurs." The answer is A.
Source: Adapted from community discussion — Jakalan7
A company recently experienced an inside attack using a corporate machine that resulted in data compromise. Analysis indicated an unauthorized change to the software circumvented technological protection measures. The analyst was tasked with determining the best method to ensure the integrity of the systems remains intact and local and remote boot attestation can take place. Which of the following would provide the BEST solution?
Answer: C
In this question, an attack has already occurred so preventative measures such as HIPS, FIM, or DLP would not be helpful. Also, the analyst wants to check the integrity of the system, and boot attestation can take place. TPM chips have mechanisms to prevent system tampering and boot attestation can be done with TPM based hardware to verify the state of the firmware, bootloader, etc. TPM is the best option here. ===================== Other Choices HIPS (Host Intrustion Prevention System) - An installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host. This aims to stop malware by monitoring the behavior of code. FIM (File Integrity Monitoring) - Technology that monitors and detects file changes that could be indicative of a cyberattack. FIM specifically involves examining files to see if and when they change, how they change, who changed them, and what can be done to restore those files if those modifications are unauthorized. DLP (Data Loss Prevention) - A set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users.
Source: Adapted from community discussion — rodwave
A security analyst is reviewing web-application logs and finds the following log:
Which of the following attacks is being observed?
Answer: A
https://www.w3schools.com/tags/ref_urlencode.ASP / is %2F = is %3D ? is %3F .. The double dot is an indicator that you can move back from this location. That is, you're in a folder inside of another folder. Once you start moving around within your computer, you can use that information for reference. https://www.redhat.com/sysadmin/navigating-filesystem-linux-terminal#:~:text=The%20single%20dot%20is%20a,use%20that%20information%20for%20reference.
Source: Adapted from community discussion — RevolutionaryAct
A security analyst is reviewing the vulnerability scan report for a web server following an incident. The vulnerability that was used to exploit the server is present in historical vulnerability scan reports, and a patch is available for the vulnerability. Which of the following is the MOST likely cause?
Answer: A
Is it just me or do none of these answers make sense to the question? A. Security patches were uninstalled due to user impact. - The question has no indication of user impact which would indicate this as the answer B. An adversary altered the vulnerability scan reports - It's not realistic for an adversary to go through multiple vulnerability scans and alter the report to include a vulnerability and a patch C. A zero-day vulnerability was used to exploit the web server - It can't be a zero day because the question states it has shown up in multiple vulnerability scans and a patch is available. A zero day is unknown D. The scan reported a false negative for the vulnerability - As the vulnerability scan has reported results of a patch and a vulnerability that was used then it cannot be a false negative. I went with A because it's the one that makes the most sense out of the answers that make no sense to me. This question just forces you to assume in the scenario which I'm not a fan of.
Source: Adapted from community discussion — CastratedMonk
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-601 practice, question 81. 856 questions available.
Version 1.0.0. How we source questions