CompTIA Security+ (SY0-601) Practice Exam #1

You have been hired by a company to identify and document all aspects of an asset’s configurations in order to create a secure template against which all subsequent configurations will be measured. What type of configuration management will you implement?

Your organization is working with a contractor to build a database. You need to find a way to hide the actual data from being exposed to the contractor. Which of the following technique will you use in order to allow the contractor to test the database environment without having access to actual sensitive customer information?

The software that monitors user activity and automatically prevents malware between cloud service users and cloud applications is known as:

Which of the following types of disaster recovery sites allows a company to continue normal business operations, within a very short period of time after a disaster?

A company hired you as a security expert. You have been tasked to implement a solution to deceive and attract hackers who attempt to gain unauthorized access to their network in order to gain information about how they operate.

Which of the following technique will you implement to meet this requirement as cost-effective as possible?

The developers of your company thinking to switch the development process to the cloud, so they don’t need to start from scratch when creating applications with the purpose of saving a lot of time and money on writing code.

Which of the following cloud service models the developers of your company will use to create unique, customizable software on the Cloud?

Your company is migrating to the cloud due to a strict budget. The primary reason is to avoid spending money on purchasing hardware and time on maintaining it. The company needs to pay only for the cloud computing resources it uses.

Which of the following cloud computing architecture should your company use to deploy the cloud services?

Which of the following companies is not a cloud service provider?

A Managed Service Provider (MSP) is a company that remotely manages a customer’s IT infrastructure and/or end-user systems, typically on a proactive basis and under a subscription model. (True/False)

Answer the fill-in-the-blank by typing one of the following type of attacks:

Fog    Edge    Distributed    Cloud

You are working for a startup and recently the application you are developing experienced a large amount of traffic. As a result, the performance of the application was decreased. You have been instructed to implement a solution to efficiently distributing incoming network traffic across a group of backend servers to increase the performance of the APP.

Which of the following solutions will you implement to meet the requirement?

Recently the physical network adapter card from your company’s server broke. As a result, your co-workers couldn’t access important resources for hours. You have been instructed to implement a solution to eliminate this from happening again in the event of a network adapter failure.

Which of the following solutions will you implement to meet the requirement?

Which of the following backup types only back up the data that has changed since the previous backup?

Cloud backup is a strategy for sending a copy of files or database to a secondary server, which is usually hosted by a third-party service provider for preservation, in case of equipment failure or catastrophe. (True/False)

You have been instructed to connect a storage device that allows storage and retrieval of data from a central location for authorized network users and varied clients.

Which of the following storage type will you use to meet the requirement?

Match the following social engineering techniques with their meaning.

Which of the following types of social engineering techniques is the use of messaging systems to send an unsolicited message to large numbers of recipients for the purpose of commercial advertising, or for the purpose of non-commercial proselytizing?

Which of the following types of social engineering is a method in which the attacker seeks to compromise a specific group of end-users by infecting websites that members of that group are known to visit?

Answer the fill-in-the-blank by typing one of the following type of attacks:

Trojan    Ransomware    Worm    Spyware

Which of the following attacks isn’t intended to steal data but to remain in place for as long as possible, quietly mining in the background?

A method by which authorized and unauthorized users are able to get around normal security measures and gain high-level user access (root access) on a computer system, network, or software application is known as:

Match the following password attack techniques with their meaning.

Which of the following attacks occurs when someone infiltrates a system through an outside partner or provider with access to the systems and data?

Adversarial machine learning is a machine learning technique that attempts to fool models by supplying deceptive input. (True/False)

Which of the following cryptographic attacks force victims to use older, more vulnerable versions of software in order to exploit known vulnerabilities against them?

A hacker introduced corrupt Domain Name System (DNS) data into a DNS resolver’s cache with the aim of redirecting users either to the wrong websites or to his own computer. What type of DNS attack did the hacker implement in this scenario?

Which of the following attacks is a Network Layer DDoS attack?

The type of hackers that violates computer security systems without permission, stealing the data inside for their own personal gain or vandalizing the system is commonly known as:

A hacker wants to attack a network with the aim of maintaining ongoing access to the targeted network rather than to get in and out as quickly as possible with the ultimate goal of stealing information over a long period of time. What type of attacking technique will the hacker use in this case?

Which of the following terms refers to Information Technology (IT) applications and infrastructure that are managed and utilized without the knowledge of the enterprise’s IT department?

______________ is a set of rules designed to give EU citizens more control over their personal data.

A _______________ is an agreement between two or more parties outlined in a formal document. It is not legally binding but signals the willingness of the parties to move forward with a contract.

The ____________ is the duration of time and a service level within which a business process must be restored after a disaster in order to avoid unacceptable consequences associated with a break in continuity.

_________________ is a strategy that ensures continuity of operations with minimal service outage or downtime. It is designed to protect personnel or assets and make sure they can function quickly when a disaster strikes such as natural disasters or cyber-attacks.

The _________________ is described as an estimated frequency of the threat occurring in one year.

You have been tasked to access a remote computer for handling some administrative tasks over an unsecured network in a secure way.

Which of the following protocols will you use to access the remote computer to handle the administrative tasks?

Your manager is trying to understand the difference between SFTP and FTPS. So, he asked you to explain the difference between them.

Which of the following statements are correct? (Choose all that apply.)

One of the features of SNMPv3 is called message integrity.

You have been hired as a security expert to implement a security solution to protect an organization from external threats. The solution should provide the organization with a superior ability to identify attacks, malware, and other threats and also provide packet filtering capabilities, VPN support, and network monitoring.

Which of the following security solutions will you implement to meet the requirement?

Application whitelisting prevents undesirable programs from executing, while application blacklisting is more restrictive and allows only programs that have been explicitly permitted to run. (True/False)

You have been tasked to implement a solution to encrypt data as it is written to the disk and decrypt data as it is read off the disk.

Which of the following solution will you implement to meet the requirement?

In which of the following load balancer modes does two or more servers aggregate the network traffic load and work as a team to distribute the workload across all servers in order to prevent any single node from getting overloaded?

You have been tasked to implement a solution to increase the security of your company’s local area network (LAN). All of the company’s external-facing servers (Web server, Mail server, FTP server) should be placed in a separate area in order to be accessible from the internet, but the rest of the internal LAN to be unreachable.

Which of the following techniques will you implement to meet the requirement?

Which of the following VPN solutions is used to connect two local area networks utilized by businesses that want to provide their employees with secure access to network resources?

The network administrator from your company notices that the network performance has been degraded due to a broadcast storm.

Which of the following techniques will you recommend to the network administrator in order to reduce broadcast storms? (Choose all that apply)

Which of the following Public key infrastructure (PKI) terms is known as an organization that acts to validate the identities of entities (such as websites, email addresses, companies, or individual persons) and bind them to cryptographic keys through the issuance of electronic documents known as digital certificates?

Assuming you have the domain yourcompany.com with the following sub-domains:

www.yourcompany.com
mail.yourcompany.com
intranet.yourcompany.com
secure.yourcompany.com
me.yourcompany.com

Which of the following types of certificates will you choose to secure all the first-level sub-domains on a single domain name?

In the form of Role-Based Access Control, data are accessible or not accessible based on the user’s IP address.

In the form of Rule-Based Access Control, data are accessible or not accessible based on the user’s IP address.

Which of the following types of certificates will you use to digitally sign your apps as a way for end-users to verify that the code they receive has not been altered or compromised by a third party?

Assuming you are working on a Windows environment. For troubleshooting reasons, you need to discover your IP information, including DHCP and DNS server addresses from your current workstation.

Which of the following commands will help you to troubleshoot the network?

Assuming you are working on a Windows environment, what command will you type to identify the number of hops and the time it takes for a packet to travel between your local computer and your web server?

You have noticed that the email server doesn’t work. Your manager said that someone from the company changed the DNS records (MX) of the email server.

Which of the following commands will you type to find the new MX records of the server?

PC1 can ping the printer on the Marketing team network but can’t ping the printer on the Sales team network. Assuming you are working on a Windows environment, type the command to get details about the route that packets go through from PC1 to the printer on the Sales team network?

Which of the following tools can you use to perform manual DNS lookups? Assuming you are working on a Linux environment. (Choose all that apply)

Which of the following options is a network architecture approach that enables the network to be intelligently and centrally controlled using software applications, and helps operators manage the network consistently, regardless of the underlying network technology?

Which of the following types of disaster recovery sites doesn’t have any pre-installed equipment and it takes a lot of time to properly set it up so as to fully resume business operations?

The security process that relies on unique traits such as retinas, irises, voices, facial characteristics, and fingerprints of an individual to verify that he is who he says he is, is called:

Authentication, ______________, and Accounting is the term for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to bill for services.

You are developing a new system that requires users to be authenticated using temporary passcode which is generated by an algorithm that uses the current time of the day.

Which of the following authentication methods will you use to authenticate the users?

Answer the fill-in-the-blank by typing one of the following type of attacks:

Control    Elasticity    Scalability    Compiler

Which of the following process is designed to trigger automatic code integration in the main code base instead of developing in isolation and then integrating them at the end of the development cycle?

You are working for a client as a web developer and your client asked you to check the new update of the app without making the updates live for the users. In which environment will you push the update so your client can look it over in a stable format before it gets pushed to the users?

What type of architecture developers use to build and run applications and services without having to manage infrastructure?

The solution to the problem of how to get a software to run reliably when moved from one computing environment to another is known as:

Which of the following actions should be taken to increase the security of SCADA networks? (Choose all that apply)

Which of the following cryptographic technique will you use to validate the authenticity and integrity of a message or digital document?

Asymmetrical encryption uses a single key that needs to be shared among the people who need to receive the message while symmetric encryption uses a pair of a public key and a private key to encrypt and decrypt messages when communicating. (True/False)

Which of the following options allows your application to interact with an external service using a simple set of commands rather than having to create complex processes yourself?

Which of the following technique will you use to hide secret data within a non-secret file or message with the purpose of avoiding data detection?

You are developing a new web application using Python for the back-end and ReactJs for the front-end. After launching the app, your co-worker Eliot discovered that the app does not always handle multithreading properly, particularly when multiple threads access the same variable, allowing an attacker to exploit it and crash the server.

What sort of error you have just discovered?

You have just downloaded a video from a file-sharing website. When you open the video using media player software which is installed on your workstation, you hear ONLY sound but get no picture.

What’s the most likely problem and solution?

A malicious user is trying to get access to your company’s network. He is sending users on your network a link to an executable file. However, the executable file also includes software that will allow the attacker to get access to any workstation that it is installed on.

Based on the scenario, what type of attack is this?

You discover that the Wi-Fi of your company has been compromised. The malicious user used the username and password that came with the Wi-Fi device. Then the attacker logged in to the device through his browser and started making changes to the DHCP and DNS configuration.

What caused this vulnerability to exist and the attacker got access to the wireless access point (WAP)?

Which of the following is a self-spreading malware that often exploits vulnerabilities to spread via a network?

Which of the following is a type of malicious code or software that looks legitimate but can take control of your computer?

Which of the following is a type of malware that prevents users from accessing their system or personal files and demands a ransom payment in order to regain access?

Spyware is an example of what type of malicious software?

What best describes an attack that attaches some malware to a legitimate program so that when the user installs the legitimate program, they inadvertently install the malware?

What type of attack forces a user to take undesired actions on their online account by spoofing requests from the trusted user?

You have been asked to include IP schema management as part of your configuration management efforts. Which of the following is considered a security advantage of IP schema configuration management?

You scan a web server that hosts two web applications. You believe that the server is fully patched and not vulnerable to exploits. Later, you discover that the Nginx version on the server is reported as vulnerable to an exploit. When you check to see if you are missing patches, Nginx is fully patched.

What has occurred?

You have been asked to identify the difference between an intrusive and a nonintrusive vulnerability scan.

Which of the following statements is true? (Select TWO.)

Your company hired a full-stack developer to develop a new e-learning application for a school. After testing the application, you discover that the developer has an open way to log in and bypass all the security measurements of the app. What best describes this?

Your website uses Cloudflare to resolve the DNS. Upon checking the records, you have discovered that there are A and MX record entries that point to unknown and potentially harmful IP addresses.

What sort of attack you have just discovered?

You have been tasked to create a new Access Control List on the company’s firewall to prevent any HTTP traffic from/to the network. Type the port number that needs to be added to the ACL rule.

Given the following firewall configuration requirements, type the correct port number to complete the access control rules.

Given the following firewall configuration requirements, type the correct port number to complete the access control rules.

Drag and drop the TCP/UDP port numbers into their respective protocol name.

You have been tasked to create a new Access Control List on the company’s firewall to prevent any FTP access to the webserver and permit any SSH access to the webserver.

Type the port numbers that need to be added to the ACL rule to complete the task.