CompTIA Security Plus Practice Exam
Comptia Security+ Practice Exam- 1
Full length Comptia Security+ Practice Exam. Take this exam like thereal exam to see if you are completely prepared for the real exam. Time yourself to 90 minutes to get a feel of thepressures of the real exam. The practice test is designed to reflectthe final exam.
Questions and Answers
- 1.
Which of the Following is an item most likely to be addressed in an Acceptable Use Policy
- A.
Acceptable password length
- B.
Security Measures users are expected to Follow
- C.
Schedule of testing
- D.
Authority and conditions for monitoring user activities
- E.
All of the Above
Correct Answer
B. Security Measures users are expected to FollowExplanation
An Acceptable Use Policy (AUP) is a set of rules and guidelines that outline the proper and acceptable use of a company's computer systems and network. It typically includes provisions regarding security measures that users are expected to follow. These measures may include instructions on password complexity, data encryption, use of antivirus software, and other security-related practices. By addressing security measures in an AUP, organizations ensure that users are aware of their responsibilities in maintaining the security and integrity of the network and its resources.Rate this question:
-
- 2.
Covert channel is a communication channel that can be used for:
- A.
Violating the security
- B.
Strengthening the security policy
- C.
Hardening the system
- D.
Protecting the DMZ
Correct Answer
A. Violating the securityExplanation
Covert channels: indirect ways for transmitting information with no explicit reading of confidential information. In other words, the communication is out in plain view, but "invisible" to those who don't know how to look for it. This kind of difficulty has induced some researchers to rethink from scratch the whole problem of guaranteeing security in computer systems. Some obscure techniques which can be utilized to create covert channels include hiding messages using the first letters of each word in a longer communication, blinking eyes in "Morse code" during a conversation, etc. Even something as mundane as some of the "signals" used by a baseball team, if non-obvious enough, could be considered a covert channel.
Covert channels are not a way to strengthen the security policy of an organization, hardening the system or protecting the DMZ -- they are a security risk, not a security-enhancing technique.Rate this question:
-
- 3.
Enforcing minimum privileges for general system users can be easily achieved through the use of:
- A.
IPSEC
- B.
TSTEC
- C.
PRVMIN
- D.
RBAC
Correct Answer
D. RBACExplanation
Explanation: Ensuring least privilege requires identifying what the user's job is, determining the minimum set of privileges required to perform that job, and restricting the user to a domain with those privileges and nothing more. By denying to subjects transactions that are not necessary for the performance of their duties, those denied privileges couldn't be used to circumvent the organizational security policy. Although the concept of least privilege currently exists within the context of the TCSEC, requirements restrict those privileges of the system administrator. Through the use of RBAC (role based access control), enforced minimum privileges for general system users can be easily achieved.Rate this question:
-
- 4.
Which of the following services should be logged for security purpose?
- A.
Bootp
- B.
Tftp
- C.
Sunrpc
- D.
All of the Above
- E.
No Answer is Correct
Correct Answer
D. All of the AboveExplanation
Requests for the following services should be logged on all systems: systat, bootp, tftp, sunrpc, snmp, snmp-trap, nfs. This list is rather UNIX-centric, nevertheless, it's possible for many of those services to be running on Windows as well (if you're running them, log them!).Rate this question:
-
- 5.
All logs are kept on archive for a period of time. What determines this period of time?
- A.
Retention policies
- B.
Administrator preferences
- C.
MTTF
- D.
MTTR
- E.
All of the Above
Correct Answer
A. Retention policiesExplanation
All logs collected are used in the active and passive monitoring process. All logs are kept on archive for a period of time, called a retention period. This period of time will be determined by your company policies. This allows the use of logs for regular audits, and annual audits if retention is longer then a year. Logs must be secured to prevent modification, deletion, and destruction.
Administrator preference is often used to determine certain things like how long logs are retained ... but since these decisions can affect the ability of the company to go back and research potential security issues, it is a corporate issue that should be governed by a deliberate policy statement.
MTTF and MTTR are not relevant to setting the time for which logs will be retained. MTTF (Mean Time To Failure, sometimes called MTBF, Mean Time Before Failure) is related to the average amount of time a piece of equipment will be in service before it fails. MTTR (Mean Time To Repair) is a measure of how long it will take to repair the equipment when it fails.Rate this question:
-
- 6.
With RBAC, roles are:
- A.
Based on labels
- B.
Based on flows
- C.
Hierarchical
- D.
All of the Above
- E.
All equal
Correct Answer
C. HierarchicalExplanation
With RBAC (role-based access control), security is managed at a level that corresponds closely to the organization's structure. Each user is assigned one or more roles, and each role is assigned one or more privileges that are permitted to users in that role. Roles can be hierarchical.
Roles are not all equal. The point of RBAC is that different rules can be assigned different security privileges. Labels (such as secret, top secret, etc.) are more usually associated with MAC (Mandatory Access Control). RBAC roles are not typically determined by information flows.Rate this question:
-
- 7.
With _______________, access decisions are based on the roles that individual users have as part of an organization.
- A.
Server based access control
- B.
Rule based access control
- C.
Token based access control
- D.
Role based access control
- E.
All of the Above
Correct Answer
D. Role based access controlExplanation
With role-based access control, access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles (such as doctor, nurse, teller, manager). The process of defining roles should be based on a thorough analysis of how an organization operates and should include input from a wide spectrum of users in an organization.
Most access control systems are rule-based -- that is, they use a preset list of rules when deciding whether or not a user should have access to a resource; this is not specific to access control systems based on user role. Most networks use server-based access control to control access to network resources, however, local resources are typically under the control of the local machine. Neither is particularly unique to role-based access control. Some networks may use token-based access control, but that is not a requirement for role-based access control, either.Rate this question:
-
- 8.
Which of the following is a feature of the Rule based access control?
- A.
The use of tokens
- B.
The use of profiles
- C.
The use of information flow labels
- D.
The use of data flow diagrams
Correct Answer
B. The use of profilesExplanation
Rule based access control is based on a specific profile for each user. Information can be easily changed for only one user but this scheme may become a burden in a very large environment. A rule-based access control unit will intercept every request to the server and compare the source specific access conditions with the rights of the user in order to make an access decision. A good example could be a firewall. Here a set of rules defined by the network administrator is recorded in a file. Every time a connection is attempted (incoming or outgoing), the firewall software checks the rules file to see if the connection is allowed. If it is not, the firewall closes the connection.
Information flow labels are usually associated with Mandatory Access Control (MAC). Data flow diagrams are most commonly used in software development, not in rule-based access control. Tokens are usually used for authentication, a function which is important for any type of access control.Rate this question:
-
- 9.
A firewall can be classified as a:
- A.
Rule based access control
- B.
Lattice based access control
- C.
Directory based access control
- D.
ID based access control
- E.
All of the Above
Correct Answer
A. Rule based access controlExplanation
Rule based access control is based on a specific profile for each user. Information can be easily changed for only one user but this scheme may become a burden in a very large environment. A rule-based access control unit will intercept every request to the server and compare the source specific access conditions with the rights of the user in order to make an access decision. A good example could be a firewall. Here a set of rules defined by the network administrator is recorded in a file. Every time a connection is attempted (incoming or outgoing), the firewall software checks the rules file to see if the connection is allowed. If it is not, the firewall closes the connection.
Lattice-based access control is associated with Mandatory Access Control (MAC). Directory based and ID based access controls are not relevant.Rate this question:
-
- 10.
In the Lattice Based Access Control model, controls are applied to:
- A.
Objects
- B.
Scripts
- C.
Factors
- D.
Models
- E.
Both A and B
Correct Answer
A. ObjectsExplanation
Information flow is clearly central to confidentiality but to some extent it also applies to integrity. The basic work in this area was done around 1970 and was driven mostly by the defense sector. Information flow in computer systems is concerned with flow from one security class (also called security label) to another. These controls are applied to objects. An object is a container of information; an object can be a directory or file.
Controls are part of the Lattice Based Access Control (Mandatory Access Control) model, not applied to the model. Factors and scripts are not involved in the model.Rate this question:
-
- 11.
With Discretionary access controls, who determines who has access and what privilege they have?
- A.
Only the administrators
- B.
Resource owners
- C.
End users
- D.
All of the Above
- E.
None of the Above
Correct Answer
B. Resource ownersExplanation
Discretionary access controls can extend beyond limiting which subjects can gain what type of access to which objects. Administrators can limit access to certain times of day or days of the week. Typically, the period during which access would be permitted is 9 a.m. to 5 p.m. Monday through Friday. Such a limitation is designed to ensure that access takes place only when supervisory personnel are present, to discourage unauthorized use of data. Further, subjects' rights to access might be suspended when they are on vacation or leave of absence. When subjects leave an organization altogether, their rights must be terminated rather than merely suspended. Under this type of control, the owner determines who has access and what privilege they have.
If the end users of resources had control of who had access and what privileges they have, they would be able to access any resource, because they'd have the ability to change access controls at will. If only the administrators controlled access to resources, it would be a major job duty (as well as a bureaucratic bottleneck for users) that would take time away from other administrative activities.Rate this question:
-
- 12.
Under MAC, which of the following is true?
- A.
All that is expressly permitted is forbidden
- B.
All that is not expressly permitted is not forbidden
- C.
All that is not expressly permitted is forbidden
- D.
Both A and B
- E.
No Answer is Correct
Correct Answer
C. All that is not expressly permitted is forbiddenExplanation
MAC is the acronym for Mandatory Access Control. It is important to note that mandatory controls are prohibitive (i.e., all that is not expressly permitted is forbidden), not permissive. Only within that context do discretionary controls operate, prohibiting still more access with the same exclusionary principle. In this type of control system decisions are based on privilege (clearance) of subject (user) and sensitivity (classification) of object (file). It requires labeling.
Under MAC, you define who is allowed to access objects, and if you haven't defined an access right, access is not permitted. So, it is not the case that All that is expressly permitted is forbidden, or that All that is not expressly permitted is not forbiddenRate this question:
-
- 13.
Under MAC, a clearance is a
- A.
Privilege
- B.
Subject
- C.
Sensitivity
- D.
Object
Correct Answer
A. PrivilegeExplanation
MAC is the acronym for Mandatory Access Control. It is important to note that mandatory controls are prohibitive (i.e., all that is not expressly permitted is forbidden), not permissive. Only within that context do discretionary controls operate, prohibiting still more access with the same exclusionary principle. In this type of control system decisions are based on privilege (clearance) of subject (user) and sensitivity (classification) of object (file). It requires labeling.
In MAC, subjects (such as users) are each assigned a clearance (such as "secret" or "top secret"). Objects (containers for information, such as files) are assigned a sensitivity (classification, similar to clearance). When determining whether or not to grant a subject access to an object, the requesting subject's clearance is compared with the sensitivity of the object, and if the clearance is at or higher than the object's sensitivity level, access is granted. Therefore, a clearance functions as a privilege.Rate this question:
-
- 14.
Access controls that are not based on the policy are characterized as:
- A.
Mandatory controls
- B.
Discretionary controls
- C.
Secret controls
- D.
Corrective controls
- E.
Non of the Above
Correct Answer
B. Discretionary controlsExplanation
Access controls that are not based on the policy are characterized as discretionary controls by the U.S. government and as need-to-know controls by other organizations. The latter term connotes least privilege - those who may read an item of data are precisely those whose tasks entail the need.
Mandatory controls are based on policy. Secret controls and corrective controls are not related to access control.Rate this question:
-
- 15.
DAC are characterized by many organizations as:
- A.
Preventive controls
- B.
Need-to-know controls
- C.
Mandatory adjustable controls
- D.
All of the Above
- E.
None of the Above
Correct Answer
B. Need-to-know controlsExplanation
DAC is the acronym for Discretionary Access Controls. Access controls that are not based on the policy are characterized as discretionary controls by the U.S. government and as need-to-know controls by other organizations. The latter term connotes least privilege - those who may read an item of data are precisely those whose tasks entail the need.
Preventive controls and mandatory adjustable controls do not characterize DAC.Rate this question:
-
- 16.
A password represents:
- A.
Something you have
- B.
Something you know
- C.
Something you are
- D.
All of the Above
- E.
None of the Above
Correct Answer
B. Something you knowExplanation
Authentication is accomplished through something you know, something you have and/or something you are. The canonical example of something you know is a password or pass phrase. You might type or speak the value. A number of schemes are possible for obtaining what you know. It might be assigned to you, or you may have picked the value yourself. Constraints may exist regarding the form the value can take, or the alphabet from which you are allowed to construct the value might be limited to letters only. If you forget the value, you may not be able to authenticate yourself to the system.
Something you have, would be a physical item you possess, such as a smartcard. Something you are, would be a personal characteristic of you, not a piece of information you know.Rate this question:
-
- 17.
A smartcard represents:
- A.
Something you are
- B.
Something you know
- C.
Something you have
- D.
All of the Above
- E.
None of the Above
Correct Answer
C. Something you haveExplanation
Authentication is accomplished through something you know, something you have and/or something you are. One form of authentication requires possession of something ("something you have") such as a key, a smart card, a disk, or some other device. Whatever form it takes, the authenticating item should be difficult to duplicate and may require synchronization with systems other than the one to which you are requesting access. Highly secure environments may require you to satisfy multiple authentication criteria to guarantee authenticity.
Something you know, would be a piece of data known only to you, such as a password. Something you are, would be a physical characteristic of you, like your fingerprint.Rate this question:
-
- 18.
Which of the following is NOT a good password deployment guideline?
- A.
Passwords must be changed at least once every 60 days, depending on your environment.
- B.
Passwords must not be the same as user id or login id.
- C.
Password aging must be enforced on all systems.
- D.
Password must be easy to memorize.
- E.
All of the Above
Correct Answer
D. Password must be easy to memorize.Explanation
Passwords should be easy to memorize, because that minimizes the chance that users will write the password down somewhere that others could see it.
Passwords should not be the same as the user ID, because that is one of the common passwords that common "password cracker" programs try, when attempting to discover passwords for accounts. Passwords must be changed at least once every 60 days (depending on your environment). Password aging or expiration must be enforced on all systems. Upon password expiration, if the password is not changed, only three grace logins must be allowed then the account must be disable until reset by an administrator or the help desk. Password reuse is not allowed (rotating passwords).Rate this question:
-
- 19.
Which of the following is an effective measure against a certain type of brute force password attack?
- A.
Password history is used.
- B.
Password reuse is not allowed.
- C.
Any password used must not be word found in a dictionary.
- D.
All of the Above
- E.
None of the Above
Correct Answer
C. Any password used must not be word found in a dictionary.Explanation
A brute force password attack involves trying many possible password values, to see if any result in access to an account. In order to help prevent dictionary-based attacks, in which the list of password values to try comes from a dictionary, it is useful to have a policy that any password used must not be a word found in a dictionary.
"Password reuse is not allowed" (i.e., rotating passwords), is a good policy, but not the one most closely related to helping prevent brute force password attacks. Password history must be used to prevent users from reusing passwords. For example, on many systems with such a facility the last 12 passwords used will be kept in the history. But as with policies against password re-use, password history is not as relevant to preventing brute force password attacks as is the policy against dictionary words.Rate this question:
-
- 20.
What type of attacks occurs when a rogue application has been planted on an unsuspecting user's workstation?
- A.
Social Engineering attacks
- B.
Logical attacks
- C.
Physical attacks
- D.
Trojan Horse attacks
- E.
None of the Above
Correct Answer
D. Trojan Horse attacksExplanation
Trojan Horse attacks - This attack involves a rogue, Trojan horse application that has been planted on an unsuspecting user's workstation. The Trojan horse waits until the user submits a valid PIN from a trusted application, thus enabling usage of the private key, and then asks the smartcard to digitally sign some rogue data. The operation completes but the user never knows that their private key was just used against their will.
Physical attacks involve physical access to hardware such as a network cable or keyboard. Social engineering attacks are based on taking advantage of human interaction rather than technology itself. (Frequently, social engineering attacks don't even require access to a computer.) There is no such thing as a "logical" attack, although many attacks do involve the use of logic to figure out how an application works and where its security vulnerabilities may be.Rate this question:
-
- 21.
Which of the following attacks could be the most successful when the security technology is properly implemented and configured?
- A.
Logical attacks
- B.
Physical attacks
- C.
Trojan Horse attacks
- D.
Social Engineering attacks
- E.
None of the Above
Correct Answer
D. Social Engineering attacksExplanation
Social Engineering attacks: in computer security systems, this type of attack is usually the most successful, especially when the security technology is properly implemented and configured. Usually, these attacks rely on the faults in human beings. An example of a social engineering attack has a hacker impersonating a network service technician. The serviceman approaches a low-level employee and requests their password for network servicing purposes. When using smartcards instead of passwords, this type of attack is a bit more difficult. Most people would not trust an impersonator wishing to have their smartcard and PIN for service purposes.
Logical, physical and Trojan horse attacks are often much less successful when security is properly implemented on a network.Rate this question:
-
- 22.
What is a protocol used for carrying authentication, authorization, and configuration information between a Network Access Server and a shared Authentication Server?
- A.
RADIUS
- B.
PPTP
- C.
L2TP
- D.
IPSec
- E.
None of the Above
Correct Answer
A. RADIUSExplanation
RADIUS is a protocol for carrying authentication, authorization, and configuration information between a Network Access Server, which desires to authenticate its links and a shared Authentication Server. RADIUS uses a centralized database for simplified management. RADIUS is a standard published in RFC2138 as mentioned above.
The other protocols listed are network communication protocols, not authentication protocols responsible for carrying traffic between a NAS and an Authentication Server.Rate this question:
-
- 23.
In a RADIUS architecture, which of the following acts as a client?
- A.
A Network Access Server
- B.
The end user
- C.
The authentication server
- D.
All of the Above
- E.
None of the Above
Correct Answer
A. A Network Access ServerExplanation
A Network Access Server (NAS) operates as a client of RADIUS. The client is responsible for passing user information to a designated RADIUS server, and then acting on the response, which is returned. Radius uses a centralized database, simplifying password management. The end user's computer does not make the RADIUS request. The NAS makes the request after receiving the network connection request from the end user.Rate this question:
-
- 24.
The majority of commercial intrusion detection systems are:
- A.
Host-based
- B.
Identity-based
- C.
Signature-based
- D.
Network-based
Correct Answer
D. Network-basedExplanation
The majority of commercial intrusion detection systems are network-based. These IDSs detect attacks by capturing and analyzing network packets. Listening on a network segment or switch, one network-based IDS can monitor the network traffic affecting multiple hosts that are connected to the network segment, thereby protecting those hosts.
Historically, IDS started out as host-based, which is the other major type of IDS. Identity-based and signature-based are not types of IDS.Rate this question:
-
- 25.
Which of the following is a drawback of Network-based IDSs?
- A.
It is very costly to set up.
- B.
It is not effective.
- C.
It cannot analyze encrypted information.
- D.
It is very costly to manage.
- E.
All of the Above
Correct Answer
C. It cannot analyze encrypted information.Explanation
Network-based IDSs cannot analyze encrypted information. This problem is increasing as more organizations (and attackers) use virtual private networks. Most network-based IDSs cannot tell whether or not an attack was successful; they can only discern that an attack was initiated. This means that after a network-based IDS detects an attack, administrators must manually investigate each attacked host to determine whether it was indeed penetrated.Rate this question:
-
- 26.
Which of the following will you consider as clear-text protocols?
- A.
Telnet
- B.
POP
- C.
FTP
- D.
SSH
- E.
All of the Above
Correct Answer(s)
A. Telnet
B. POP
C. FTPExplanation
There are many clear-text protocols still in use today. Telnet is still alive and well. FTP and POP email both use clear-text protocols. Creating a server to emulate any of these services is trivial. Combining that and some DNS spoofing can cause "normal" traffic to come to your fake servers where the usernames and passwords can be obtained.Rate this question:
-
- 27.
Microsoft supports the _______________ and ______standards for use in extranet.
- A.
CORBA
- B.
IPSec
- C.
PPTP
- D.
DCOM
- E.
Both A & D
Correct Answer(s)
B. IPSec
C. PPTPExplanation
Netscape, Oracle, and Sun Microsystems have announced an alliance to ensure that their extranet products can work together by standardizing on JavaScript and the Common Object Request Broker Architecture (CORBA). Microsoft supports the Point-to-Point Tunneling Protocol (PPTP) and IPSec.
CORBA and DCOM are programming technologies.Rate this question:
-
- 28.
Which of the following protocols did Microsoft develop for use in VPNs?
- A.
PPTP
- B.
IPSEC
- C.
OSPF
- D.
L2TP
- E.
None of the Above
Correct Answer(s)
A. PPTP
B. IPSECExplanation
A protocol or set of communication rules called Point-to-Point Tunneling Protocol (PPTP) has been proposed that would make it possible to create a virtual private network (VPN) through "tunnels" over the Internet. This would mean that companies would no longer need their own leased lines for wide-area communication but could securely use the public networks. IPSec is more resource intensive, and provides higher security. IPSec is available in Windows 2000 and XP/.Net Operating Systems.
L2TP is a successor to PPTP. Its development was done by an industry coalition, and it includes the best features of PPTP and L2F. OSPF is a routing protocol.Rate this question:
-
- 29.
To allow your Windows clients to connect to your Windows NT Server using the public network as a medium, what technology might you find useful?
- A.
PPTP
- B.
L2TP
- C.
OSPF
- D.
IPSEC
- E.
All of the Above
Correct Answer(s)
A. PPTP
D. IPSECExplanation
A protocol or set of communication rules called Point-to-Point Tunneling Protocol (PPTP) has been proposed that would make it possible to create a virtual private network (VPN) through "tunnels" over the Internet. This would mean that companies would no longer need their own leased lines for wide-area communication but could securely use the public networks. IPSec is more resource intensive, and provides higher security. IPSec is available in Windows 2000 and XP/.Net Operating Systems.
L2TP is a successor to PPTP. Its development was done by an industry coalition, and it includes the best features of PPTP and L2F. OSPF is a routing protocol.Rate this question:
-
- 30.
What technology involves the use of electronic wallet?
- A.
TLS
- B.
SSH
- C.
SHTTP
- D.
SET
- E.
All of the Above
Correct Answer
D. SETExplanation
SET (Secure Electronic Transaction) is a system for ensuring the security of financial transactions on the Internet. It was supported initially by MasterCard, Visa, Microsoft, Netscape, and others. With SET, a user is given an electronic wallet (digital certificate) and a transaction is conducted and verified using a combination of digital certificates and digital signatures among the purchaser, a merchant, and the purchaser's bank in a way that ensures privacy and confidentiality. SET makes use of Netscape's Secure Sockets Layer (SSL (Secure Sockets Layer)), Microsoft's Secure Transaction Technology (STT), and Terisa System's Secure Hypertext Transfer Protocol (S-HTTP). SET uses some but not all aspects of a public key infrastructure (public key infrastructure).
TLS, SSL and SHTTP could all be used for this, but SET is specific to the financial services industry.Rate this question:
-
- 31.
With Java, what can be embedded in a web browser, allowing programs to be executed as they are downloaded from the World Wide Web?
- A.
JVM
- B.
Bytecode
- C.
Interpreter
- D.
Just-in-time compiler
- E.
All of the Above
Correct Answer
B. BytecodeExplanation
Java is a modern, object-oriented language that has a syntax similar to C++. It also has dynamic binding, garbage collection, and a simple inheritance model. Java is a general-purpose computer language and is not limited to writing web applications. References to java bytecode can be embedded in a web browser, allowing programs to be executed as they are downloaded from the World Wide Web. The JVM on the user's machine can execute the Java bytecode using an interpreter, or use a just-in-time compiler to convert the bytecode into native machine code.Rate this question:
-
- 32.
ActiveX controls can be digitally signed using a technology called:
- A.
Java Applet
- B.
CGI
- C.
Sandbox
- D.
Authenticode
- E.
All of the Above
Correct Answer
D. AuthenticodeExplanation
The ActiveX code is bundled into a single file called an ActiveX control. ActiveX controls can be digitally signed using Microsoft's Authenticode technology. Internet Explorer can be configured to disregard any ActiveX control that isn't signed, to run only ActiveX controls that have been signed by specific publishers, or to accept ActiveX controls signed by any registered software publisher. ActiveX controls do not run in a sandbox. The burden is on the user to determine which ActiveX controls s/he feels are "safe" to run.
Applets and CGI are alternate types of content, and a sandbox refers to a protected area of the system in which web content runs.Rate this question:
-
- 33.
A centralized database of remote users for a multi-site network typically uses
- A.
RADIUS
- B.
PAP
- C.
MS-CHAP
- D.
CHAP
Correct Answer
A. RADIUSExplanation
RADIUS (Remote Authentication Dial-In User Service) lowers administration costs and increases security by having a centralized database for authenticating remote users. PAP is the simplest of authentication protocols, which uses clear text.Rate this question:
-
- 34.
Which of the following is more of an irritation than a security threat?
- A.
Rootkit
- B.
Conficker
- C.
Trojan
- D.
Adware
Correct Answer
D. AdwareExplanation
Adware is more of an irritation than a security threat. Unlike rootkits and Trojans, which are malicious programs designed to gain unauthorized access or control over a computer system, adware is primarily focused on displaying unwanted advertisements. While adware can be annoying and disrupt the user experience, it does not typically pose a direct security risk or attempt to steal sensitive information. Therefore, adware is considered to be more of an irritation rather than a significant security threat.Rate this question:
-
- 35.
Creating a basic standard for application settings, security settings, and active services on every company laptop would be considered
- A.
Group policy
- B.
Baseline configuration
- C.
Patch management
- D.
A security template
Correct Answer
D. A security templateExplanation
A security template is a pre-defined configuration that sets the standard for application settings, security settings, and active services on company laptops. It provides a baseline configuration that ensures consistency and helps enforce security policies. By applying a security template, companies can easily manage and control the security settings across their laptop fleet, reducing the risk of vulnerabilities and unauthorized access. Therefore, creating a basic standard for these settings would be considered a security template.Rate this question:
-
- 36.
All of the following are correct about LDAP EXCEPT:
- A.
Most of the implementations use the x.500 directory model
- B.
Some of the implementations use default TCP ports 389 and 636
- C.
Some implementations use x.509 certificates for securing communications
- D.
All attributes will be encrypted
Correct Answer
D. All attributes will be encryptedExplanation
The correct answer is "all attributes will be encrypted." While LDAP can support encryption, it does not guarantee that all attributes will be encrypted by default. Encryption of attributes is an optional feature that can be implemented depending on the specific LDAP implementation and configuration.Rate this question:
-
- 37.
Least privilege is defined as giving access to information:
- A.
Based on sense of urgency from management
- B.
Based on tenure at the company
- C.
Needed to complete the task
- D.
That may be revealed to the public
- E.
All of the Above
Correct Answer
C. Needed to complete the taskExplanation
The concept of least privilege is about providing access to information that is necessary to complete a specific task. It is not based on the sense of urgency from management or the tenure at the company. Additionally, it does not involve giving access to information that may be revealed to the public. Therefore, the correct answer is that access should be given based on what is needed to complete the task.Rate this question:
-
- 38.
An administrator wishes to enable network auditing policies. Which of the following should the security administrator log?
- A.
Both logon successes and logon failures
- B.
Only logon failures for non-existent users
- C.
Only logon success
- D.
Only logon failures
Correct Answer
A. Both logon successes and logon failuresExplanation
The administrator should log both logon successes and logon failures in order to effectively monitor and track any unauthorized access attempts or suspicious activity on the network. By logging both types of events, the administrator can identify potential security breaches and take appropriate actions to mitigate them. Logging only logon failures for non-existent users or only logon successes or only logon failures may not provide a comprehensive view of the network's security posture and may result in missed or delayed detection of security incidents.Rate this question:
-
- 39.
From a security perspective a performance baseline is MOST useful for:
- A.
Detecting performance anomalies that may be due to security breaches
- B.
Assuring that systems are working to their optimal capacity
- C.
Knowing when security scans are going to finish
- D.
Predicting the end of useful life for the firewall
- E.
All of the Above
Correct Answer
A. Detecting performance anomalies that may be due to security breachesExplanation
A performance baseline is a benchmark or standard that represents normal or optimal performance for a system. By establishing a baseline, any deviations from this normal performance can be identified and investigated. In the context of security, performance anomalies could indicate potential security breaches or attacks. Therefore, a performance baseline is most useful for detecting performance anomalies that may be due to security breaches. This allows organizations to identify and respond to potential security incidents in a timely manner.Rate this question:
-
- 40.
A company creates its own application that accesses the company databases and requires a unique login, based on the user’s domain account. The developer has an undocumented login for testing that does not need to be authenticated against the domain. Which of the following is a security issue regarding this scenario?
- A.
The login should be the same as the domain account for authentication purposes
- B.
The application should not be deployed if it is not fully tested
- C.
It is not considered best practice to have a user remember multiple logins
- D.
It can be used as a backdoor into the company’s databases
Correct Answer
D. It can be used as a backdoor into the company’s databasesExplanation
The presence of an undocumented login that does not require authentication against the domain poses a security issue because it can be used as a backdoor into the company's databases. This means that unauthorized individuals could potentially gain access to sensitive information or manipulate the data without proper authentication or authorization.Rate this question:
-
- 41.
In order to perform a TCP hijacking attack, an attacker would be required to:
- A.
Have a protocol analyzer intercept traffic between two hosts
- B.
Know the IP addresses of both hosts and sequence numbers of the TCP/IP packets
- C.
Perform a man-in-the-middle attack and communicate directly with two hosts
- D.
Obtain the MAC address of the both hosts
Correct Answer
B. Know the IP addresses of both hosts and sequence numbers of the TCP/IP packetsExplanation
To perform a TCP hijacking attack, the attacker needs to know the IP addresses of both hosts and the sequence numbers of the TCP/IP packets. This information is crucial for the attacker to successfully intercept and manipulate the TCP connections between the hosts. With the IP addresses, the attacker can identify the source and destination of the packets, while the sequence numbers allow them to identify and modify specific packets within the TCP stream. This knowledge enables the attacker to insert malicious data or take control of the communication between the two hosts.Rate this question:
-
- 42.
A passive response is the most common type of response to a number of intrusions. Which of the following is not a passive response strategy ?
- A.
Shunning
- B.
Deception
- C.
Notification
- D.
Logging
- E.
All of the Above
Correct Answer
B. DeceptionExplanation
Deception is not a passive response strategy. Passive response strategies typically involve actions such as shunning, notification, and logging, which focus on monitoring and recording intrusions rather than actively engaging with them. Deception, on the other hand, involves intentionally misleading or tricking intruders to protect the system. While it may be an effective strategy, it is not considered a passive response as it requires active engagement and manipulation of the intruder.Rate this question:
-
- 43.
When using network monitoring systems to monitor workstations, which of the following elements should be reviewed because their information could indicate a possible attack ?
- A.
Audit log and system log
- B.
Hard disk space
- C.
Network counters and access denied errors
- D.
Network counters
Correct Answer
C. Network counters and access denied errorsExplanation
The correct answer is "Network counters and access denied errors." When using network monitoring systems to monitor workstations, reviewing network counters and access denied errors can provide valuable information that could indicate a possible attack. Network counters can reveal abnormal network traffic patterns or unexpected spikes in activity, which may suggest unauthorized access or malicious activity. Access denied errors can also indicate attempted unauthorized access or suspicious activity on the network. Therefore, monitoring and reviewing these elements can help identify and respond to potential security threats.Rate this question:
-
- 44.
Which if the following technologies would you use if you need to implement a system that simulates a network of vulnerable devices, so that this network can be targeted by attackers ?
- A.
A circuit-level firewall
- B.
A honeypot
- C.
A IDS
- D.
A system integrity verifier
Correct Answer
B. A honeypotExplanation
A honeypot is the correct answer because it is a technology used to simulate a network of vulnerable devices. It is designed to attract attackers and gather information about their techniques and tactics. By setting up a honeypot, organizations can study and analyze the behavior of attackers, identify vulnerabilities in their systems, and develop appropriate countermeasures to enhance their overall security.Rate this question:
-
- 45.
Which of the following intrusion detection technologies work by monitoring the file structure of a system to determine whether any system files were deleted or modified by an attacker ?
- A.
Log file monitor (LFM)
- B.
System integrity verifier (SIV)
- C.
Host-based IDS
- D.
Network IDS
Correct Answer
B. System integrity verifier (SIV)Explanation
System integrity verifier (SIV) is an intrusion detection technology that works by monitoring the file structure of a system. It checks whether any system files have been deleted or modified by an attacker. This technology helps to ensure the integrity of the system by detecting unauthorized changes to critical files. It is a proactive approach to detect and prevent potential intrusions by monitoring the system's file structure for any suspicious activity.Rate this question:
-
- 46.
Which of the following is NOT a valid access control mechanism?
- A.
DAC (Discretionary Access Control) list.
- B.
SAC (Subjective Access Control) list.
- C.
MAC (Mandatory Access Control) list.
- D.
RBAC (Role Based Access Control) list.
Correct Answer
B. SAC (Subjective Access Control) list.Explanation
There is no such thing as a SAC (Subjective Access Control) list.Rate this question:
-
- 47.
Which of the following best describes an access control mechanism in which access control decisions are based on the responsibilities that an individual user or process has in an organization?
- A.
RBAC (Role Based Access Control)
- B.
DAC (Discretionary Access Control)
- C.
MAC (Mandatory Access Control)
- D.
All of the Above
- E.
None of the above.
Correct Answer
A. RBAC (Role Based Access Control)Explanation
The RBAC model allows a user to act in a certain predetermined manner based on the role the user holds in the organization. Users can be assigned certain roles system wide.
Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 12Rate this question:
-
- 48.
Which of the following best describes an access control mechanism that allows the data owner to create and administer access control?
- A.
DACs (Discretionary Access Control)
- B.
LBACs (List Based Access Control)
- C.
RBACs (Role Based Access Control)
- D.
MACs (Mandatory Access Control)
Correct Answer
A. DACs (Discretionary Access Control)Explanation
The DAC model allows the owner of a resource to establish privileges to the information they own. The DAC model would allow a user to share a file or use a file that someone else has shared. The DAC model establishes an ACL that identifies the users who have authorization to that information. This allows the owner to grant or revoke access to individuals or groups of individuals based on the situation. This model is dynamic in nature and allows information to be shared easily between users.
Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 12Rate this question:
-
- 49.
Which of the following is an inherent flaw of DAC (Discretionary Access Control)?
- A.
DAC (Discretionary Access Control) relies only on the identity of the user or process, leaving room for a Trojan horse.
- B.
DAC (Discretionary Access Control) relies on certificates, allowing attackers to use those certificates.
- C.
DAC (Discretionary Access Control) does not rely on the identity of a user, allowing anyone to use an account.
- D.
DAC (Discretionary Access Control) has no known security flaws.
Correct Answer
A. DAC (Discretionary Access Control) relies only on the identity of the user or process, leaving room for a Trojan horse.Explanation
In a DAC model, network users have some flexibility regarding how information is accessed. This model allows users to dynamically share information with other users. The process allows a more flexible environment, but it increases the risk of unauthorized disclosure of information. Administrators will have a more difficult time ensuring that information access is controlled and that only appropriate access is given.
Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 440Rate this question:
-
- 50.
Which of the following access control methods provides the most granular access to protected objects?
- A.
Capabilities
- B.
Access control lists
- C.
Permission bits
- D.
Profiles
Correct Answer
B. Access control listsExplanation
Access control lists enable devices in your network to ignore requests from specified users or systems, or grant certain network capabilities to them. ACLs allow a stronger set of access controls to be established in your network. The basic process of ACL control allows the administrator to design and adapt the network to deal with specific security threats.
Reference: Mike Pastore and Emmett Dulaney, Security+ Study Guide, 2nd Edition, Alameda, Sybex, 2004, p 235Rate this question:
-
Quiz Review Timeline +
Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.
-
Current Version
-
Dec 05, 2023Quiz Edited by
ProProfs Editorial Team -
Apr 27, 2013Quiz Created by
Pinguisweb
Back to top