CompTIA Flashcards
A security administrator receives alerts from the perimeter UTM. Upon checking the logs, the administrator
finds the following output:
Time: 12/25 0300
From Zone: Untrusted
To Zone: DMZ
Attacker: externalip.com
Victim: 172.16.0.20
To Port: 80
Action: Alert
Severity: Critical
Upon examining the PCAP associated with the event, the security administrator finds the following
information:
alert (" Click here for important information regarding your account : http://externalip.com/account
.php");
Which of the following actions should the security administrator take?
A. Upload the PCAP to the IDS in order to generate a blocking signature to block the traffic
B. Manually copy the
data from the PCAP file and generate a blocking signature in the HIDS to block
the traffic for future events
C. Implement a host-based firewall rule to block future events of this type from occurring
D. Submit a change request to modify the XSS vulnerability signature to TCP reset on future attempts
D. Submit a change request to modify the XSS vulnerability signature to TCP reset on future attempts
An employee opens a web browser and types a URL into the address bar. Instead of reaching the requested
site, the browser opens a completely different site. Which of the following types of attacks have MOST likely
occurred? (Select TWO)
A. DNS hijacking
B. Cross-site scripting
C. Domain hijacking
D. Man-in-the-browser
E. Session hijacking
A. DNS hijacking
D. Man-in-the-browser
After discovering a security incident and removing the affected files, an administrator disabled an unneeded
service that led to the breach. Which of the following steps in the incident response process has the
administrator just completed?
A. Containment
B. Eradication
C. Recovery
D. Identification
B. Eradication
The president of a company that specializes in military contracts receives a request for an interview. During
the interview, the reporter seems more interested in discussing the president’s family life and personal history
than the details of a recent company success. Of which of the following security concerns is this MOST likely
an example?
A. Insider threat
B. Social engineering
C. Passive reconnaissance
D. Phishing
B. Social engineering
A company is deploying MFDs in its office to improve employee productivity when dealing with paperwork.
Which of the following concerns is MOST likely to be raised as a possible security issue in relation to these
devices?
A. Sensitive scanned materials being saved on the local hard drive
B. Faulty printer drivers causing PC performance degradation
C. Improperly configured NIC settings interfering with network security
D. Excessive disk space consumption due to storing large documents
A. Sensitive scanned materials being saved on the local hard drive
A coding error has been discovered on a customer-facing website. The error causes each request to return
confidential PHI data for the incorrect organization. The IT department is unable to identify the specific
customers who are affected. As a result, all customers must be notified of the potential breach. Which of the
following would allow the team to determine the scope of future incidents?
A. Intrusion detection system
B. Database access monitoring
C. Application fuzzing
D. Monthly vulnerability scans
B. Database access monitoring
A systems developer needs to provide machine-to-machine interface between an application and a database
server in the production environment. This interface will exchange data once per day. Which of the following
access control account practices would BEST be used in this situation?
A. Establish a privileged interface group and apply read-write permission to the members of the group.
B. Submit a request for account privilege escalation when the data needs to be transferred.
C. Install the application and database on the same server and add the interface to the local administrator
group
D. Use a service account and prohibit users from accessing this account for development work.
D. Use a service account and prohibit users from accessing this account for development work.
An authorized user is conducting a penetration scan of a system for an organization. The tester has a set of
network diagrams, source code, version number of applications, and other information about the system,
including hostnames and network addresses. Which of the following BEST describes this type of penetration
test?
A. Gray-box testing
B. Black-box testing
C. White-box testing
D. Blue team exercise
E. Red team exercise
C. White-box testing
Which of the following should a technician use to protect a cellular phone that is needed for an investigation,
to ensure the data will not be removed remotely?
A. Air gap
B. Secure cabinet
C. Faraday cage
D. Safe
C. Faraday cage
A government organization recently contacted three different vendors to obtain cost quotes for a desktop PC
refresh. The quote from one of the vendors was significantly lower than the other two and was selected for the
purchase. When the PCs arrived, a technician determined some NICs had been tampered with. Which of the
following MOST accurately describes the security risk presented in this situation?
A. Hardware root of trust
B. UEFI
C. Supply chain
D. TPM
E. Crypto-malware
F. ARP poisoning
C. Supply chain
A company wants to provide centralized authentication for its wireless system. The wireless authentication
system must integrate with the directory back end. Which of the following is a AAA solution that will provide
the required wireless authentication?
A. TACACS+
B. MSCHAPv2
C. RADIUS
D. LDAP
C. RADIUS
In a lessons learned report, it is suspected that a well-organized, well-funded, and extremely sophisticated
group of attackers may have been responsible for a breach at a nuclear facility. Which of the following
describes the type of actors that may have been implicated?
A. Nation-state
B. Hacktivist
C. Insider
D. Competitor
A. Nation-state
A contracting company recently completed its period of performance on a government contract and would like
to destroy all information associated with contract performance. Which of the following is the best NEXT step
for the company to take?
A. Consult data disposition policies in the contract
B. Use a pulper or pulverizer for data destruction
C. Retain the data for a period no more that one year
D. Burn hard copies containing PII or PHI
A. Consult data disposition policies in the contract
When accessing a popular website, a user receives a warning that the certificate for the website is not valid.
Upon investigation, it was noted that the certificate is not revoked and the website is working fine for other
users. Which of the following is the MOST likely cause for this?
A. The certificate is corrupted on the server
B. The certificate was deleted from the local cache
C. The user needs to restart the machine
D. The system date on the user’s device is out of sync
D. The system date on the user’s device is out of sync
A user is unable to obtain an IP address from the corporate DHCP server. Which of the following is MOST
likely the cause?
A. Default configuration
B. Resource exhaustion
C. Memory overflow
D. Improper input handling
B. Resource exhaustion
