CompTIA SEC+ SY0-701 Exam V3 Flashcards
Recent changes to a company’s BYOD policy require all personal mobile devices to use a two-factor authentication method that is not something you know or have. Which of the following will meet this requirement?
A. Facial recognition
B. Six-digit PIN
C. PKI certificate
D. Smart card
Public key infrastructure (PKI)
Facial recognition
A type of bio-metric authentication that uses the unique features of a person’s face to verify their identity. Facial recognition is not something you know or have, but something you are, which is one of the three factors of authentication. Facial recognition can provide a convenient and secure way to authenticate users on personal mobile devices, as it does not require any additional hardware or input from the user. Facial recognition can also be used in conjunction with other factors, such as passwords or tokens, to provide multi-factor authentication.
A dynamic application vulnerability scan identified that code injection could be performed using a web form. Which of the following will be the best remediation to prevent this vulnerability?
A. Implement input validations
B. Deploy UFA
C. Utilize a WAF
D. Conjure HIPS
Host Intrusion Prevention System (HIPS)
Web Application Firewall (WAF)
Utilize a WAF
A web application firewall (WAF) is a security solution that monitors and filters the traffic between a web application and the internet. It can prevent code injection attacks by blocking malicious requests that contain code snippets or commands that could compromise the web application. A WAF can also enforce input validation rules and sanitize user inputs to prevent code injection.
A security analyst has been tasked with ensuring all programs that are deployed into the enterprise have been assessed in a runtime environment. Any critical issues found in the program must be sent back to the developer for verification and remediation. Which of the following most describes the type of assessment taking place?
A. Input validation
B. Dynamic code analysis
C. Fuzzing
D. Manual code review
Dynamic code analysis
A technique that tests and analyzes an application during runtime to identify potential vulnerabilities, errors, or performance issues. Dynamic code analysis can detect problems that may not be visible in the source code or during static analysis, such as memory leaks, buffer overflows, or input validation errors. Dynamic code analysis can also simulate real-world scenarios and user inputs to evaluate the behavior and functionality of the application.
Which of the following best describes the risk that is present once mitigations are applied?
A. Control risk
B. Residual risk
C. Inherent risk
D. Risk awareness
Residual risk
The risk that remains after applying risk mitigation measures, such as controls, policies, or procedures. It reflects the level of uncertainty and potential impact that cannot be completely eliminated by risk management efforts. Residual risk is calculated by subtracting the risk reduction from the inherent risk, or by multiplying the inherent risk by the risk control effectiveness. Residual risk should be compared to the acceptable level of risk to determine if further action is needed or if the risk can be accepted by the management.
Which of the following is a reason why a forensic specialist would create a plan to preserve data after an incident and prioritize the sequence for performing forensic analysis?
A. Order of volatility
B. Preservation of event logs
C. Chain of custody
D. Compliance with legal hold
Order of volatility
The order in which a forensic specialist should collect evidence based on how quickly the data can be lost or altered. The most volatile data, such as CPU registers and cache, should be collected first, followed by less volatile data, such as disk drives and archival media.
In which of the following scenarios is tokenization the best privacy technique to use?
A. Providing pseudo-anonymization for social media user accounts
B. Serving as a second factor for authentication requests
C. Enabling established customers to safely store credit card information
D. Masking personal information inside databases by segmenting data
Enabling established customers to safely store credit card information
Tokenization is a privacy technique that replaces sensitive data elements, such as credit card numbers, with non-sensitive equivalents, called tokens, that have no intrinsic or exploitable value.
Tokenization can be used to enable established customers to safely store credit card information without exposing their actual card numbers to potential theft or misuse.
An organization is concerned about intellectual property theft by employees who leave the organization. Which of the following should the organization most likely implement?
A. CBT
B. NDA
C. MOU
D. AUP
Non-Disclosure Agreement (NDA)
Memorandum of Understanding (MOU)
Acceptable Use Policy (AUP)
NDA
A legally binding contract that establishes a confidential relationship between two or more parties. An NDA can be used to prevent intellectual property theft by employees who leave the organization by prohibiting them from disclosing or using any sensitive information they may have obtained during their employment.
Local guidelines require that all information systems meet a minimum security baseline to be compliant. Which of the following can security administrators use to assess their system
configurations against the baseline?
A. SOAR playbook
B. Security control matrix
C. Risk management framework
D. Benchmarks
Security Orchestration, Automation and Response (SOAR)
Benchmarks
Predefined sets of configuration standards or best practices for securing information systems and networks. Benchmarks can be used to assess system configurations against the minimum security baseline required by local guidelines or industry regulations.
A Chief Security Officer (CSO) is concerned that cloud-based services are not adequately protected from advanced threats and malware. The CSO believes there is a high risk that a data breach could occur in the near future due to the lack of detective and preventive controls. Which of the following should be implemented to best address the CSO’s concerns? (Select two).
A. AWAF
B. CASB
C. NG-SWG
D. Segmentation
E. Encryption
F. Containerization
Advanced Web Application Firewall (AWAF)
Cloud Access Security Broker (CASB)
Next Generation Secure Web Gateway
A CASB & Encryption
A CASB (Cloud Access Security Broker) and encryption are two solutions that can address the CSO’s concerns about cloud-based services security. A CASB is a software tool or service that acts as an intermediary between users and cloud service providers, enforcing security policies and providing visibility and control over cloud activities. A CASB can help detect and prevent advanced threats and malware by applying data loss prevention, threat protection, anomaly detection, and encryption capabilities to cloud data and traffic.
Encryption is a process of transforming data into an
unreadable format using a secret key or algorithm, making it inaccessible to unauthorized parties. Encryption can help protect cloud data from breaches by ensuring that only authorized users with the correct key can decrypt and access the data. Encryption can be applied to data at rest (stored in the cloud) or data in transit (moving between the cloud and users).
A new vulnerability enables a type of malware that allows the unauthorized movement of data from a system. Which of the following would detect this behavior?
A. Implementing encryption
B. Monitoring outbound traffic
C. Using default settings
D. Closing all open ports
Monitoring outbound traffic
A technique that can detect the behavior of malware that allows the unauthorized movement of data from a system. Outbound traffic refers to the data that leaves a system or network and goes to an external destination, such as another network, server, or website.
Monitoring outbound traffic can help identify any suspicious or anomalous patterns, such as large volumes of data being sent to unknown or malicious destinations, which could indicate a malware infection or a data exfiltration attempt.
A systems administrator is auditing all company servers to ensure they meet the minimum security baseline. While auditing a Linux server the systems administrator observes the /etc/shadow file has permissions beyond the baseline recommendation. Which of the following commands should the systems administrator use to resolve this issue?
A. chmod
B. grep
C. dd
D. passwd
chmod
chmod is a Linux command that can be used to change or modify the permissions of files and directories. The /etc/shadow file is a system file that stores the encrypted passwords of user accounts in Linux. The /etc/shadow file should have restricted permissions to prevent unauthorized access or modification of the passwords.
The recommended permissions for the /etc/shadow file are
read/write for root user only (600). If the systems administrator observes that the /etc/shadow file has permissions beyond the baseline recommendation, they can use the chmod command to resolve this issue by setting the appropriate permissions for the file. For example, chmod 600 /etc/shadow would set the permissions of the /etc/shadow file to read/write for root user only.
A security analyst is investigating a malware incident at a company, the malware is accessing a command-and-control website at www.comptia.com. All outbound internet traffic is logged to a syslog server and stored in /logfiles/messages. Which of the following commands would be best for the analyst to use on the syslog server to search for recent traffic to the command-and-control website?
A. head -500 www.comptia.com | grep /logfiles/messages
B. cat /logfiles/messages I tail -500 www.comptia.com
C. tail -500 /logfiles/messages I grep www.comptia.com
D. grep -500 /logfiles/messages I cat www.comptia.com
tail -500 /logfiles/messages I grep www.comptia.com
tail is a Linux command that can be used to display the last part of a file. grep is a Linux command that can be used to search for a pattern in a file or input.
The pipe symbol (|) is used to connect two
commands and pass the output of one command as the input of another command.
The best command for the analyst to use on the syslog server to search for recent traffic to the command-and-control website is “tail -500 /logfiles/messages | grep www.comptia.com”
This command would display the last 500 lines of the /logfiles/messages file and filter them by the pattern www.comptia.com, which is the domain name of the command-and-control website. This way, the analyst can see any syslog messages that contain the domain name of the malicious website and investigate them further.
Which of the following environments can be stood up in a short period of time, utilizes either dummy data or actual data, and is used to demonstrate and model system capabilities and functionality for a fixed, agreed-upon duration of time?
A. PoC
B. Production
C. Test
D. Development
Proof of Concept (PoC)
PoC
A proof of concept (PoC) environment can be stood up quickly and is used to demonstrate and model system capabilities and functionality for a fixed, agreed-upon duration of time. This environment can utilize either dummy data or actual data.
After segmenting the network, the network manager wants to control the traffic between the segments. Which of the following should the manager use to control the network traffic?
A. A DMZ
B. A VPN
C. A VLAN
D. An ACL
De-Militarized Zone (DMZ)
Virtual Private Network (VPN)
Virtual Local Area Network (VLAN)
Access Control List (ACL)
An ACL
After segmenting the network, a network manager can use an access control list (ACL) to control the traffic between the segments. An ACL is a set of rules that permit or deny traffic based on it’s characteristics, such as the source and destination IP addresses, protocol type, and port number.
A security engineer needs to create a network segment that can be used for servers that require connections from untrusted networks. Which of the following should the engineer implement?
A. An air gap
B. A hot site
C. A VLAN
D. A screened subnet
Virtual Local Area Network (VLAN)
A screened subnet
A screened subnet is a network segment that can be used for servers that require connections from untrusted networks. It is placed between two firewalls, with one firewall facing the untrusted network and the other facing the trusted network. This setup provides an additional layer of security by screening the traffic that flows between the two networks.
Which of the following should be addressed first on security devices before connecting to the network?
A. Open permissions
B. Default settings
C. API integration configuration
D. Weak encryption
Application Programming Interface (API)
Default settings
Before connecting security devices to the network, it is crucial to address default settings first. Manufacturers often ship devices with default settings that include default usernames, passwords, and configurations. These settings are widely known and can be easily exploited by attackers. Changing default settings helps to secure the device and prevent unauthorized access.
Which of the following is required in order for an IDS and a WAF to be effective on HTTPS traffic?
A. Hashing
B. DNS sinkhole
C. TLS inspection
D. Data masking
Intrusion Detection System (IDS)
Web Application Firewall (WAF)
Domain Name System (DNS)
Transport Layer Security (TLS)
TLS inspection
TLS (Transport Layer Security) is a protocol that is used to encrypt data sent over HTTPS (Hypertext Transfer Protocol Secure). In order for an intrusion detection system (IDS) and a web application firewall (WAF) to be effective on HTTPS traffic, they must be able to inspect the encrypted traffic. TLS inspection allows the IDS and WAF to decrypt and inspect the traffic, allowing them to detect any malicious activity.
During a recent security assessment, a vulnerability was found in a common OS. The OS vendor was unaware of the issue and promised to release a patch within the next quarter. Which of the following best describes this type of vulnerability?
A. Legacy operating system
B. Weak configuration
C. Zero day
D. Supply chain
Zero day
A zero-day vulnerability is a security flaw that is unknown to the vendor and the public, and therefore has no patch or fix available. A zero-day attack is an exploit that takes advantage of a zero-day vulnerability before the vendor or the security community becomes aware of it. A zero-day attack can cause serious damage to a system or network, as there is no defense against it until a patch is released.
Which of the following would most likely include language prohibiting end users from accessing personal email from a company device?
A. SLA
B. BPA
C. NDA
D. AUP
Service-level Agreement (SLA)
Business Partnership Agreement (BPA)
Non-Disclosure Agreement (NDA)
Acceptable Use Policy (AUP)
AUP
AUP or Acceptable Use Policy is a document that defines the rules and guidelines for using a company’s IT resources, such as devices, networks, internet, email, etc. It usually includes language prohibiting end users from accessing personal email from a company device, as well as other activities that may compromise security or productivity.
Which of the following can be used to calculate the total loss expected per year due to a threat targeting an asset?
A. EF x asset value
B. ALE / SLE
C. MTBF x impact
D. SLE x ARO
Exposure Factor (EF)
Annualized Loss Expectancy (ALE)
Single Loss Expectancy (SLE)
Mean Time Between Failures (MTBF)
Annualized Rate of Occurrence (ARO)
SLE x ARO
The total loss expected per year due to a threat targeting an asset can be calculated using the Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO). SLE is the monetary loss expected from a single event, while ARO is the estimated frequency of that event occurring in a year.
An organization is repairing the damage after an incident. Which of the following controls is being implemented?
A. Detective
B. Preventive
C. Corrective
D. Compensating
Corrective
A corrective control is a type of security control that is designed to mitigate the damage caused by a security incident or to restore the normal operations after an incident. A corrective control can include actions such as restoring from backups, applying patches, isolating infected systems, or implementing new policies and procedures. A corrective control is different from a preventive control, which aims to stop an incident from happening, or a detective control, which aims to identify and record an incident.
A security professional wants to enhance the protection of a critical environment that is used to store and manage a company’s encryption keys. The selected technology should be tamper resistant. Which of the following should the security professional implement to achieve the goal?
A. DLP
B. HSM
C. CA
D. FIM
Data Loss Prevention (DLP)
hardware security module (HSM)
Certificate Authenticity (CA)
File Integrity Monitoring (FIM)
HSM
HSM stands for hardware security module, which is a physical device that is used to store and manage cryptographic keys in a secure and tamper-resistant manner. HSMs can provide high-performance encryption and decryption operations, as well as key generation, backup, and recovery.
HSMs can also prevent unauthorized access or extraction of the keys, even by the cloud service provider or the HSM vendor. HSMs can enhance the protection of a critical environment that is used to store and manage encryption keys for a financial institution or any other organization that deals with sensitive data.
Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s Pll?
A. SCAP
B. NetFlow
C. Antivirus
D. DLP
Personally Identifiable Information (PII)
Security Content Automation Protocol
Data Loss Prevention (DLP)
DLP
DLP stands for Data Loss Prevention, which is a technology that can monitor, detect and prevent the unauthorized transmission of sensitive data, such as PII (Personally Identifiable Information). DLP can be implemented on endpoints, networks, servers or cloud services to protect data in motion, in use or at rest. DLP can also block or alert on data transfers that violate predefined policies or rules. DLP is the best tool to assist with detecting an employee who has accidentally emailed a file containing a customer’s PII, as it can scan the email content and attachments for any data that matches the criteria of PII and prevent the email from being sent or notify the administrator of the incident
Which of the following best reduces the security risks introduced when running systems that have expired vendor support and lack an immediate replacement?
A. Implement proper network access restrictions.
B. Initiate a bug bounty program.
C. Classify the system as shadow IT.
D. Increase the frequency of vulnerability scans.
Implement proper network access restrictions.
Network access restrictions can limit the exposure of systems that have expired vendor support and lack an immediate replacement, as they can prevent unauthorized or unnecessary access to those systems from other devices or networks. Network access restrictions can include firewalls, network segmentation, VPNs, access control lists, and other methods that can filter or block traffic based on predefined rules or policies. Network access restrictions can reduce the security risks introduced by running systems that have expired vendor support, as they can mitigate the impact of potential vulnerabilities or exploits that may affect those systems.
A company recently suffered a breach in which an attacker was able to access the internal mail servers and directly access several user inboxes. A large number of email messages were later posted online. Which of the following would best prevent email contents from being released should another breach occur?
A. Implement S/MIME to encrypt the emails at rest.
B. Enable full disk encryption on the mail servers.
C. Use digital certificates when accessing email via the web.
D. Configure web traffic to only use TLS-enabled channels.
Secure/Multipurpose Internet Mail Extensions (S/MIME)
Transport Layer Security (TLS)
Implement S/MIME to encrypt the emails at rest.
S/MIME stands for Secure/Multipurpose Internet Mail Extensions, which is a standard for encrypting and digitally signing email messages. S/MIME can provide confidentiality, integrity, authentication and non-repudiation for email communications. S/MIME can encrypt the emails at rest, which means that the email contents are protected even if they are stored on the mail servers or the user inboxes. S/MIME can prevent email contents from being released should another breach occur, as the attacker would not be able to decrypt or read the encrypted emails without the proper keys or certificates.
Recent changes to a company’s BYOD policy require all personal mobile devices to use a two-factor authentication method that is not something you know or have. Which of the following will meet this requirement?
A. Facial recognition
B. Six-digit PIN
C. PKI certificate
D. Smart card
Bring Your Own Device (BYOD)
Public Key Infrastructure (PKI)
Facial recognition
Facial recognition is a type of biometric authentication that uses the unique features of a person’s face to verify their identity. Facial recognition is not something you know or have, but something you are, which is one of the three factors of authentication. Facial recognition can use various methods and technologies, such as 2D or 3D images, infrared sensors, machine learning and more, to capture, analyze and compare facial data. Facial recognition can provide a convenient and secure way to authenticate users on personal mobile devices, as it does not require any additional hardware or
input from the user. Facial recognition can also be used in conjunction with other factors, such as passwords or tokens, to provide multi-factor authentication.
After a phishing scam for a user’s credentials, the red team was able to craft payload to deploy on a server. The attack allowed the installation of malicious software that initiates a new remote session. Which of the following types of attacks has occurred?
A. Privilege escalation
B. Session replay
C. Application programming interface
D. Directory traversal
Privilege escalation
Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. In this scenario, the red team was able to install malicious software, which would require elevated privileges to access and install. Therefore, the type of attack that occurred is privilege escalation.
A cybersecurity administrator needs to implement a Layer 7 security control on a network and block potential attacks. Which of the following can block an attack at Layer 7? (Select TWO).
A. HIDS
B. NIPS
C. HSM
D. WAF
E. NAC
F. NIDS
G. Stateless firewall
Host-Based Instrusion Detection System (HIDS)
Network Intrusion Prevention System (NIPS)
Hardware Security Module (HSM)
Web Application Firewall (WAF)
Network Access Control (NAC)
Network Intrusion Detection System (NIDS)
WAF & NIDS
A WAF (Web Application Firewall) and NIDS (Network Intrusion Detection System) are both examples of Layer 7 security controls. A WAF can block attacks at the application layer (Layer 7) of the OSI model by filtering traffic to and from a web server. NIDS can also detect attacks at Layer 7 by monitoring network traffic for suspicious patterns and behaviors.
During an incident, a company’s CIRT determines it is necessary to observe the continued network-based transactions between a callback domain and the malware running on an enterprise PC. Which of the following techniques would be BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any changes?
A. Physically move the PC to a separate Internet point of presence.
B. Create and apply microsegmentation rules,
C. Emulate the malware in a heavily monitored DMZ segment
D. Apply network blacklisting rules for the adversary domain
Computer Incident Response Team (CIRT)
De-Militarized Zone (DMZ)
Emulate the malware in a heavily monitored DMZ segment
Emulating the malware in a heavily monitored DMZ segment is the best option for observing network-based transactions between a callback domain and the malware running on an enterprise PC. This approach provides an isolated environment for the malware to run, reducing the risk of lateral spread and detection by the adversary. Additionally, the DMZ can be monitored closely to gather intelligence on the adversary’s tactics and techniques.
A business is looking for a cloud service provider that offers a la carte services, including cloud backups, VM elasticity, and secure networking. Which of the following cloud service provider types should business engage?
A. laaS
B. PaaS
C. XaaS
D. SaaS
Infrastructure as a Software (IaaS)
Platform as a Software (PaaS)
Anything as a Software (XaaS)
Services as a Software (SaaS)
laaS
Infrastructure as a Service (IaaS) providers offer a la carte services, including cloud backups, VM elasticity, and secure networking. With IaaS, businesses can rent infrastructure components such as virtual machines, storage, and networking from a cloud service provider.
A security analyst is responding to an alert from the SIEM. The alert states that malware was discovered on a host and was not automatically deleted. Which of the following would be BEST for the analyst to perform?
A. Add a deny-all rule to that host in the network ACL.
B. Implement a network-wide scan for other instances of the malware.
C. Quarantine the host from other parts of the network.
D. Revoke the client’s network access certificates.
Security Information and Event Management (SIEM)
Access Control List (ACL)
Quarantine the host from other parts of the network
When malware is discovered on a host, the best course of action is to quarantine the host from other parts of the network. This prevents the malware from spreading and potentially infecting other hosts. Adding a deny-all rule to the host in the network ACL may prevent legitimate traffic from being processed, implementing a network-wide scan is time-consuming and may not be necessary, and revoking the client’s network access certificates is an extreme measure that may not be warranted.
