CompTIA Security+607 questions across 61 pages are complete and free, with no account or card.
607 questions in this bank
Free access · progress saved on this device
A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attacks. Which of the following analysis elements did the company most likely use in making this decision?
Answer: C
MTTR= mean time to repair RTO=recovery time objective ARO= annualized rate of occurance MTBF= mean time between failures. ARO is it
Source: Adapted from community discussion — e5c1bb5
Which of the following is the most likely to be included as an element of communication in a security awareness program?
Answer: A
Easiest way to think of this question is this security awareness program is likely to be made company wide for the avg employee with no computer skills. B C D are all for the cybersecurity team specifically
Source: Adapted from community discussion — c80f5c5
HOTSPOT - Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation. INSTRUCTIONS - Not all attacks and remediation actions will be used. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
I think the 3rd line is wrong. It should be: Database server / Worm / Change the default application password The prompt talks about compromising an SQL database with well known credentials. So you need to change the app default password to fix this. It also talks about the attack being self propagating which would make it a worm. I believe the rest of the answers are correct.
Source: Adapted from community discussion — Th3irdEye
HOTSPOT - You are a security administrator investigating a potential infection on a network. INSTRUCTIONS - Click on each host and firewall. Review all logs to determine which host originated the infection and then identify if each remaining host is clean or infected. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Why Are you choosing random answers. Here is real answers => { 22 is Origin. It has started infection first. 37 is Clean, because it is able to get new updates and quarantine malicious file. 41 is Infected, because it was not able to quarantine infected file. 12 is Clean, because it is able to get new updates and quarantine malicious file. 18 is Infected, because it was not able get new update and qurantine file. These are real answers.
Source: Adapted from community discussion — Fazliddin4515
Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?
Answer: A
A. Preparation The preparation phase in the incident response process is when a security analyst reviews roles and responsibilities. This phase involves planning and setting up the necessary tools, processes, and team structures to effectively respond to potential security incidents. Therefore, the correct answer is: A. Preparation
Source: Adapted from community discussion — Etc_Shadow28000
After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?
Answer: D
The most appropriate option to disable to harden the routers would be: D. Web-based administration Web-based administration, also known as remote management or HTTP/HTTPS access, is a common feature in routers that allows administrators to manage the device remotely using a web browser. However, this feature also introduces a potential vulnerability, as it opens up the router to potential web-based attacks. Disabling web-based administration would reduce the attack surface and prevent potential exploits, making the router more secure. Console access (A) is necessary for local management, routing protocols (B) are essential for network operation, and VLANs (C) are used for network segmentation and security. Disabling web-based administration (D) is the most appropriate option to harden the router.
Source: Adapted from community discussion — 499c5c4
An organization’s internet-facing website was compromised when an attacker exploited a buffer overflow. Which of the following should the organization deploy to best protect against similar attacks in the future?
Answer: B
B is the correct one B. WAF (Web Application Firewall) A. NGFW (Next-Generation Firewall) C. TLS (Transport Layer Security) D. SD-WAN (Software-Defined Wide Area Network)
Source: Adapted from community discussion — CookieChip
A security administrator needs a method to secure data in an environment that includes some form of checks so track any changes. Which of the following should the administrator set up to achieve this goal?
Answer: D
D. FIM (File Integrity Monitoring) File Integrity Monitoring (FIM) is a security technology that monitors and detects changes in files. FIM solutions can track modifications, access, or deletions of files and notify administrators of any changes, thus ensuring data integrity and security. Therefore, the correct answer is: D. FIM
Source: Adapted from community discussion — Etc_Shadow28000
An administrator is reviewing a single server's security logs and discovers the following:
Which of the following best describes the action captured in this log file?
Answer: A
A. Brute-force attack The log shows multiple failed login attempts within a very short time frame, which is characteristic of a brute-force attack. In a brute-force attack, an attacker attempts many different passwords or passphrases with the hope of eventually guessing correctly. The pattern of frequent and continuous login failures seen in the log entries aligns with this type of attack. Therefore, the correct answer is: A. Brute-force attack
Source: Adapted from community discussion — Etc_Shadow28000
A security engineer is implementing FDE for all laptops in an organization. Which of the following are the most important for the engineer to consider as part of the planning process? (Choose two.)
Answer: AB
A. Key escrow B. TPM presence - **Key escrow:** This is important to ensure that encryption keys can be recovered in case they are lost or forgotten. It is a crucial consideration for Full Disk Encryption (FDE) to maintain access to data even if issues arise with the primary encryption keys. - **TPM presence:** Trusted Platform Module (TPM) is a hardware-based security feature that can store encryption keys securely. Ensuring the presence of TPM on laptops enhances the security of FDE by protecting the encryption keys from being accessed or tampered with. Therefore, the most important considerations for the security engineer are: A. Key escrow B. TPM presence
Source: Adapted from community discussion — Etc_Shadow28000
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-701 practice, question 551. 607 questions available.
Version 1.0.0. How we source questions