CompTIA Security+607 questions across 61 pages are complete and free, with no account or card.
607 questions in this bank
Free access · progress saved on this device
Which of the following alert types is the most likely to be ignored over time?
Answer: C
C. False Positive - triggered when an event is NOT actually a threat. True Positive - an actual threat True Negative - no threat False Negative - an actual threat isn't detected, dangerous type since threats go unnoticed.
Source: Adapted from community discussion — jafyyy
A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch jobs locally and does not generate traffic, but the process is now generating outbound traffic over random high ports. Which of the following vulnerabilities has likely been exploited in this software?
Answer: A
A is correct. Memory injection allows the attackers to inject malicious code directly into the memory of a running process which can then be used to execute arbitrary commands or generate unauthorized network traffic. Race Condition refers to two processes competing to modify the same resource which can lead to unpredictable behavior but is less likely to cause abnormal outbound traffic. Side Loading refers to loading a malicious DLL into a legitimate process. SQL injection involves injecting malicious SQL code into a database and is primarily concerned with database manipulation rather than generating outbound network traffic.
Source: Adapted from community discussion — a4e15bd
An important patch for a critical application has just been released, and a systems administrator is identifying all of the systems requiring the patch. Which of the following must be maintained in order to ensure that all systems requiring the patch are updated?
Answer: A
The best answer is: A. Asset inventory An asset inventory is essential for ensuring that all systems requiring the patch are updated. By maintaining a comprehensive inventory of all systems, the administrator can identify which devices have the critical application installed and require the patch. An accurate asset inventory helps ensure that no systems are overlooked during the patching process. - Network enumeration focuses on identifying devices on the network but does not necessarily provide information about the applications running on those devices. - Data certification relates to validating the integrity and accuracy of data, which is unrelated to identifying systems needing patches. - Procurement process involves acquiring hardware or software but does not help track existing systems for patching needs. Therefore, an asset inventory is the best choice for maintaining awareness of all systems that require patching.
Source: Adapted from community discussion — Luswepo
During a security incident, the security operations team identified sustained network traffic from a malicious IP address: 10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization’s network. Which of the following fulfills this request?
Answer: B
Source: 10.1.4.9/32 specifies the exact malicious IP address to block. Destination: 0.0.0.0/0 indicates all possible destinations within the network. Action: deny specifies that traffic from this source IP should be blocked. • Scenario Application: Blocking Malicious IP: This rule effectively blocks any incoming traffic from the IP address 10.1.4.9 from accessing any part of the network. Inbound Rule: As an inbound rule, it prevents traffic from the specified IP from entering the network, which aligns with the requirement to block the malicious IP. This rule directly addresses the need to block the specified IP address, fulfilling the requirement by denying access to all destinations, effectively preventing any communication from the malicious IP.
Source: Adapted from community discussion — dbrowndiver
Which of the following should a security operations center use to improve its incident response procedure?
Answer: A
Which of the following describes an executive team that is meeting in a board room and testing the company's incident response plan?
Answer: C
A healthcare organization wants to provide a web application that allows individuals to digitally report health emergencies. Which of the following is the most important consideration during development?
Answer: B
I get what you’re saying but for test purposes the keywords were “healthcare emergencies” which would indicate an importance of availability. Answer B
Source: Adapted from community discussion — fc040c7
Which of the following agreement types defines the time frame in which a vendor needs to respond?
Answer: B
A Service Level Agreement (SLA) defines the specific levels of service that a vendor is expected to provide, including: Response time frames: The time within which the vendor must respond to issues, requests, or incidents. Uptime guarantees: Commitments to service availability. Performance metrics: Quantifiable goals for the service. An SLA ensures accountability and sets clear expectations for the relationship between the organization and the vendor. Why not the other options? A. SOW (Statement of Work): A Statement of Work outlines the deliverables, project scope, and timelines but does not define service levels or response times. C. MOA (Memorandum of Agreement): An MOA is a formal agreement between parties, often used for partnerships or collaborations, but it lacks the detailed operational metrics found in an SLA. D. MOU (Memorandum of Understanding): An MOU is an informal document that expresses intent between parties but does not contain enforceable terms like response times.
Source: Adapted from community discussion — AndyK2
Which of the following is a feature of a next-generation SIEM system?
Answer: B
next-gen SIEM platforms can dynamically analyze vast datasets in real time, enabling the identification of subtle, evolving threats that traditional systems might overlook.
Source: Adapted from community discussion — FrozenCarrot
To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed. Which of the following best describe these types of controls? (Choose two.)
Answer: BF
I believe it is B and F because the CCTV will give you the ability to monitor the data center and its presence and signs are a deterrent.
Source: Adapted from community discussion — internslayer
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-701 practice, question 121. 607 questions available.
Version 1.0.0. How we source questions