251-275 Flashcards
Which of the following environments utilizes dummy data and is MOST likely to be installed locally on a system that allows code to be assessed directly and modified easily with each build?
A. Production
B. Test
C. Staging
D. Development
D. Development
An analyst receives multiple alerts for beaconing activity for a host on the network. After analyzing the activity, the analyst observes the following activity:
- A user enters comptia.org into a web browser.
- The website that appears is not the comptia.org site.
- The website is a malicious site from the attacker.
- Users in a different office are not having this issue.
Which of the following types of attacks was observed?
A. On-path attack
B. DNS poisoning
C. Locator (URL) redirection
D. Domain hijacking
B. DNS poisoning
Which of the following in the incident response process is the BEST approach to improve the speed of the identification phase?
A. Activate verbose logging in all critical assets.
B. Tune monitoring in order to reduce false positive rates.
C. Redirect all events to multiple syslog servers.
D. Increase the number of sensors present on the environment.
B. Tune monitoring in order to reduce false positive rates.
A security administrator is analyzing the corporate wireless network. The network only has two access points running on channels 1 and 11. While using airodump-ng, the administrator notices other access points are running with the same corporate ESSID on all available channels and with the same BSSID of one of the legitimate access points. Which of the following attacks is happening on the corporate network?
A. On-path
B. Evil twin
C. Jamming
D. Rogue access point
E. Disassociation
B. Evil twin
When implementing automation with IoT devices, which of the following should be considered FIRST to keep the network secure?
A. Z-Wave compatibility
B. Network range
C. Zigbee configuration
D. Communication protocols
D. Communication protocols
An organization is concerned that its hosted web servers are not running the most updated version of the software. Which of the following would work BEST to help identify potential vulnerabilities?
A. hping3 -S comptia-org -p 80
B. nc -l -v comptia.org -p 80
C. nmap comptia.org -p 80 -sV
D. nslookup –port=80 comptia.org
C. nmap comptia.org -p 80 -sV
A news article states hackers have been selling access to IoT camera feeds. Which of the following is the MOST likely reason for this issue?
A. Outdated software
B. Weak credentials
C. Lack of encryption
D. Backdoors
B. Weak credentials
A company wants to build a new website to sell products online. The website will host a storefront application that will allow visitors to add products to a shopping cart and pay for the products using a credit card. Which of the following protocols would be the MOST secure to implement?
A. SSL
B. SFTP
C. SNMP
D. TLS
D. TLS
An IT manager is estimating the mobile device budget for the upcoming year. Over the last five years, the number of devices that were replaced due to loss, damage, or theft steadily increased by 10%. Which of the following would BEST describe the estimated number of devices to be replaced next year?
A. ALE
B. ARO
C. RPO
D. SLE
B. ARO
An organization is repairing the damage after an incident. Which of the following controls is being implemented?
A. Detective
B. Preventive
C. Corrective
D. Compensating
C. Corrective
A Chief Executive Officer’s (CEO) personal information was stolen in a social-engineering attack. Which of the following sources would reveal if the CEO’s personal information is for sale?
A. Automated information sharing
B. Open-source intelligence
C. The dark web
D. Vulnerability databases
C. The dark web
Which of the following typically uses a combination of human and artificial intelligence to analyze event data and take action without intervention?
A. TTP
B. OSINT
C. SOAR
D. SIEM
C. SOAR
A security analyst has been tasked with creating a new WiFi network for the company. The requirements received by the analyst are as follows:
- Must be able to differentiate between users connected to WiFi
- The encryption keys need to change routinely without interrupting the users or forcing reauthentication
- Must be able to integrate with RADIUS
- Must not have any open SSIDs
Which of the following options BEST accommodates these requirements?
A. WPA2-Enterprise
B. WPA3-PSK
C. 802.11n
D. WPS
A. WPA2-Enterprise
A security administrator is trying to determine whether a server is vulnerable to a range of attacks. After using a tool, the administrator obtains the following output:
HTTP/1.0 200 OK
Content-type: text/html
Server: Apache
root:s9fyf983#:0:1:System Operator:/:/bin/bash
daemon:*1:1::/tmp:
userl:fi@su3FF:183:100:user:/home/users/userl:/bin/bash
Which of the following attacks was successfully implemented based on the output?
A. Memory leak
B. Race conditions
C. SQL injection
D. Directory traversal
D. Directory traversal
A Chief Security Officer is looking for a solution that can reduce the occurrence of customers receiving errors from back-end infrastructure when systems go offline unexpectedly. The security architect would like the solution to help maintain session persistence. Which of the following would BEST meet the requirements?
A. Reverse proxy
B. NIC teaming
C. Load balancer
D. Forward proxy
C. Load balancer
