CompTIA Security+607 questions across 61 pages are complete and free, with no account or card.
607 questions in this bank
Free access · progress saved on this device
Which of the following agreement types is used to limit external discussions?
Answer: B
A Non-Disclosure Agreement is a legal document prohibiting the disclosure of details that are agreed upon under the NDA. This will include limiting external discussions.
Source: Adapted from community discussion — TrebleSmith
A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the SaaS vendor. Which of the following processes is the analyst most likely conducting?
Answer: D
D. Due diligence In this context, due diligence refers to the process of evaluating the security, compliance, and risk associated with a third-party vendor or service, such as a SaaS application. Requesting a SOC 2 report is a common part of the due diligence process to assess the vendor's controls related to security, availability, processing integrity, confidentiality, and privacy. Internal audit (A) refers to an organization's internal review of its own processes, not an external vendor. Penetration testing (B) involves actively testing for vulnerabilities by simulating attacks, which is not applicable here. Attestation (C) refers to a third-party audit or certification, such as the SOC 2 report itself, but the analyst is conducting due diligence by requesting the report.
Source: Adapted from community discussion — cri88
Which of the following is used to conceal credit card information in a database log file?
Answer: B
B. Masking Masking is used to conceal sensitive information, such as credit card numbers, by replacing or hiding parts of the data. In the context of database log files, masking ensures that sensitive information is not exposed while maintaining the usability of the data for other purposes. Tokenization (A) replaces sensitive data with a token that can only be mapped back to the original data using a secure system, but it is not typically used for log file entries. Hashing (C) converts data into a fixed-length hash, but it's a one-way function, making it unsuitable if the original data needs to be retrieved. Obfuscation (D) refers to making data less understandable but is less structured and secure than masking for specific data like credit card numbers.
Source: Adapted from community discussion — cri88
A company is expanding its threat surface program and allowing individuals to security test the company’s internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?
Answer: B
B. Bug bounty A bug bounty program incentivizes external security researchers to find and report vulnerabilities in a company's applications or systems. Researchers are compensated based on the severity and impact of the vulnerabilities they uncover, helping the company to improve its security posture by leveraging a wide range of expertise.
Source: Adapted from community discussion — Etc_Shadow28000
SIMULATION - A systems administrator is configuring a site-to-site VPN between two branch offices. Some of the settings have already been configured correctly. The systems administrator has been provided the following requirements as part of completing the configuration: • Most secure algorithms should be selected • All traffic should be encrypted over the VPN • A secret password will be used to authenticate the two VPN concentrators INSTRUCTIONS - Click on the two VPN Concentrators to configure the appropriate settings. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
VPN Concentrator 1 (Branch Office 1) Configuration: Phase 1: Peer IP address: 5.5.5.20 (IP of VPN Concentrator 2) Auth method: PSK (Pre-Shared Key) Negotiation mode: MAIN Encryption algorithm: AES256 Hash algorithm: SHA256 DH key group: 14 Phase 2: Mode: Tunnel Protocol: ESP (Encapsulating Security Payload) Encryption algorithm: AES256 Hash algorithm: SHA256 Local network/mask: 192.168.1.0/24 Remote network/mask: 192.168.2.0/24 VPN Concentrator 2 (Branch Office 2) Configuration: Phase 1: Peer IP address: 5.5.5.10 (IP of VPN Concentrator 1) Auth method: PSK (Pre-Shared Key) Negotiation mode: MAIN Encryption algorithm: AES256 Hash algorithm: SHA256 DH key group: 14 Phase 2: Mode: Tunnel Protocol: ESP (Encapsulating Security Payload) Encryption algorithm: AES256 Hash algorithm: SHA256 Local network/mask: 192.168.2.0/24 Remote network/mask: 192.168.1.0/24
Source: Adapted from community discussion — TrebleSmith
An organization recently started hosting a new service that customers access through a web portal. A security engineer needs to add to the existing security devices a new solution to protect this new service. Which of the following is the engineer most likely to deploy?
Answer: C
C. WAF (Web Application Firewall) A Web Application Firewall (WAF) is specifically designed to protect web applications by filtering, monitoring, and blocking HTTP/S traffic to and from a web service. Since the organization is hosting a new service through a web portal, a WAF would be the most appropriate solution to protect against common web-based attacks like SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. Layer 4 firewall (A) provides protection at the transport layer, which is too low-level to specifically protect web applications. NGFW (Next-Generation Firewall) (B) adds application-level filtering and protection, but is generally broader in scope, not specifically tailored to web applications. UTM (Unified Threat Management) (D) is a multi-functional security device but doesn't provide the specialized web application protection that a WAF offers. Thus, WAF is the most suitable solution for protecting a web service accessed via a portal.
Source: Adapted from community discussion — cri88
Which of the following topics would most likely be included within an organization's SDLC?
Answer: D
D. Branch protection requirements Branch protection requirements are related to the version control and development process within the SDLC, ensuring that code changes are reviewed, tested, and approved before being merged into main branches. This helps maintain code quality and security throughout the development process. Penetration testing is usually conducted as part of the testing phase or after deployment to identify vulnerabilities and security weaknesses. It is a separate process from the core stages of the SDLC but is an important aspect of ensuring the security and robustness of the application once development is completed.
Source: Adapted from community discussion — Cee007
Which of the following control types is AUP an example of?
Answer: B
Direct from Dion Training's Udemy course: Managerial Controls - Aka administrative controls. Involve the strategic planning and governance side of security. Ensures that the org’s security strategies align with its business goals and its risk tolerance. Risk assessments Security policies Training programs Incident response strategies Operational Controls - Procedures and measures designed to protect data on a day-to-day basis and are mainly governed by internal processes and human actions. Backup procedures Account reviews User awareness training programs AUP = Acceptable Use Policy. Security policies = Managerial Controls.
Source: Adapted from community discussion — Examplary
An organization is adopting cloud services at a rapid pace and now has multiple SaaS applications in use. Each application has a separate log-in, so the security team wants to reduce the number of credentials each employee must maintain. Which of the following is the first step the security team should take?
Answer: D
Chat GPT: The correct answer is D. Select an IdP (Identity Provider). The first step in reducing the number of credentials employees must maintain is to select an Identity Provider (IdP). An IdP centralizes authentication and allows users to log in once and gain access to multiple applications, usually through a single sign-on (SSO) mechanism. Once an IdP is in place, other technologies like SAML (Security Assertion Markup Language) or OAuth can be configured to manage authentication with the SaaS applications. A. Enable SAML is a protocol used for authentication, but it requires an IdP to manage authentication. B. Create OAuth tokens is a way to grant limited access to resources but also requires an IdP or similar system to manage identities. C. Use password vaulting is a temporary solution that stores passwords, but it doesn't reduce the need for multiple log-ins, nor does it provide the benefits of centralized identity management.
Source: Adapted from community discussion — 850bc48
A company's online shopping website became unusable shortly after midnight on January 30, 2023. When a security analyst reviewed the database server, the analyst noticed the following code used for backing up data:
Which of the following should the analyst do next?
Answer: A
A. Check for recently terminated DBAs. The code indicates that the database was intentionally dropped based on a specific date, which suggests that someone with access and knowledge of the database setup (such as a database administrator) may have executed or scheduled this command. Checking for recently terminated DBAs could help identify if an insider threat or an ex-employee had a role in this incident.
Source: Adapted from community discussion — Cee007
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-701 practice, question 231. 607 questions available.
Version 1.0.0. How we source questions