CompTIA Security (Plus) Flashcards
90
The first and most critical step of auditing is:
A. to audit all user activity
B. to ensure the correct things are being audited
C. to review audit data on a periodic basis
D. to back up audit logs to remote systems in case of system compromise
B.
the first and most critical step of auditing is to ensure the correct things are being audited.
47 The term "Open Relay" refers to what? A. HTTP Servers B. FTP Servers C. Email Servers D. Application Servers
C: Open Relay, also known as Open Mail Relay, refers to allowing to send mail through a mail server. This is the source of much of the spam people receive.
HTTP, is incorrect HTTP servers simply process requests.
20 Twofish was designed to replace what algorithm? A. Blowfish B. DES C. MD5 D. AES
B. Twofish was a candidate to replace DES as part of the AES competition.
79 Which port should be opened on a firewall to permit e-mail traffic to pass? A. TCP 21 B. UDP 88 C. TCP 25 D. TCP 139
C. is correct; TCP Port 25 is used by SMTP (Simple Mail Transport Protocal)
TCP 21 is used for what?
FTP
Define (SMTP)
Simple Mail Transport Protocal
UDP 88 is used with what?
Kerberos
What is TCP 139 used for?
NetBIOS
86
Privilege auditing is not useful for what?
A. following the “trust but verify” philosophy.
B. help[ing to ensure that users have been granted the correct privileges and rights required to perform their assigned duties.
C. Large corporations or positions with a high rate of turnover or employee movement.
D. identifying users with evil intentions
D. audits cannot determine users intentions, only what permissions the user should have based on logical factors.
A,B,C, are incorrect; these are all advantages of privilege auditing.
48 An Accounting Lockout Policy is an excellent countermeasure against which type of attack? A. Virus B. DoS C. Smurf Attack D. Brute-Force Attack
D. an account lockout policy will typically require an account be disabled for a period of time before the user can try their password again, making a brute force attack time-consuming and more easily detectable.
64 A web application firewall is designed to detect and stop which of the following? A. SQL injection attacks B. Port Scan C. Infected email traffic D. Worms
A. web security gateways are intended to address the security threats and pitfalls unique to web-based traffic such as SQL injection attacks.
B,C,D, are incorrect; although these are potential attacks, they are not against web applications.
78
When a certificate authority signs a certificate, it uses what to do so?
A. nothing, CAs do not sign certificates
B. the CA’s public key
C. the CA’s private key
D. the requestor’s public key
C. the CA uses its private key, allowing users to use the public key to authenticate the origin of the signature.
A. is incorrect, CA’s “do” download certificates
97 Which of the following documents is used to determine your most critical business functions and is used to help build your DRP? A. Business Continuity Plan B. Backup Recovery Plan C. Business Function Assessment D. Business Impact Analysis
D. the BIA outlines what the loss of any of your critical functions will mean to the organization and is used in the development of the Disaster Recovery plan (DRP) .
94
Which of the following models of computer security implements the principle,
Protection = Prevention + (Detection + Response) ?
A. Bell-LaPadula
B. Operational Security
C. Biba
D. Chinese Wall
B. the Operational Security model is defined as:
Protection = Prevention + (Detection + Response)
A,C,D, are incorrect, they are “access” control models of differing types.
55
An Access Control List (ACL) is?
A. the list of authorized users on the system or network
B. the list of all authorized users that are currently on the system or network
C. a list that contains the subjects that have accfess rights to a particular object
D. A list of subjects not allowed access to a particular object
C. an “Access Control List” (ACL) is used to define which subjects have which access rights to a particular object. The list identifies not only the subject but the specific access granted to the subject for the object.
99 Which of the following is an example of a MAC address? A. 127.0.0.1 B. 255.255.255.0 C. 2001:db8:85a3::8a2e:370:733 D. 00:07:e9:7c:c8:aa
D is correct, it is a MAC address and is a hexadecimal representation of 48 bitsw
A. is an IP address
B. is a common subnet mask for IPv4
C. is an IPv6 address
33 Which device does not segregate data-link traffic? A. Switch B. Hub C. Bridatege D. VLAN
B. is correct as hubs do not segregate ant type of network traffice.
A. switches seperate traffic based on layer 2 addresses.
C. bridges split traffic based on layer 2 adddresses
D. is incorrect, VLANs are implemented using switches and layer 2 addresses.
31 Which of the following is not a method to implement 802.1X? A. EAP-RC2 B. EAP-MD5 C. EAP-TTLS D. EAP-TLS
A. is correct, RC2 is not a valid crypto scheme for 802.1X B,C, and D, are incorrect. B uses MD5 for encryption C. is tunneling TLS D. is TLS
98
Which of hte following measrues will NOT improve the pgysical security of a computer?
A. Insuring the server
B. Restricting physical access to the server
C. Use of locking rack mounts
D. High-Security locks
A. is the correct answer, insuring the server only provides a financial method of recovering from some aspect of lkoss; it does not improve the level of physical security.
41 Which widely used protocol is available to vendors to establish their own customized authentication system? A. ICMP B. EAP C. PPP D. PPTP
B is correct, Extensible Authentication Protocal (EAP) allows vendors to cusomize their own authentication system.
ICMP is not used in authentication
17 What kind of algorithim uses the same key to encrypt and decrypt a message? A. Alphanumeric Algorithm B. Asymmetric Algorithm C. Symmetric Algorithm D. Hash Algorithm
C is correct, Symmetric Algorithms use the same key to encrypt and decrypt.
15 The attribute that prevents someone from later denying their actions is called what? A. Nonrepudiation B. Key Escrow C. Crytical Redundancy Check D. Two-Factor Authentification
A is correct, nonrepudiation prohibits people from denying their actions.
B,C,D, are incorrect. These are all terms used in cryptography but do not relate to the concept of repudiation and nonrepudiation.
60
Which of hte following is a reason given for limiting an object’s privileges as part of the principle of least priviledge?
A. It makes it easier to assign blame if a problem occurs.
B. It limits the amount of harm that can be caused, thus limiting an organization’s exposure to damage.
C. it simplifies the job of security administrators
D. It consolodates responsibility
with a few key individuals, thus making security decisions easier to make.
B. is correct, this is the primary reason given for implementing the concept of least privilege.
88
Acceptable use policies are used to define
A. Data retention
B. Server consolidation planning
C. Security personnel responsibilities for network protection
D. All user responsibilities
D is correct, an acceptable use policy defines all user responsibilities with respect to using IT resources.
21 When comparing two different implentations of the same algorithims for cryptographic strength, what is the best plan? A. Government recommendation B. Algorithm manufacturer's website C. Age of algorithm D. Key length in bits
D. is correct, the strength of an implementation is directly related to keyspace (number of potential keys)
3 The program TFTP uses waht port data transfer A. TCP 422 B. TCP 443 C. UDP 80 D. UDP 69
D. is correct, Tivial File Transfer Program (TFTP) operated over a UDP port69.
68 You have created a file on a remote server that is confidential. You wish to assign permission to access the file to selected members of your team. You will be choosing which of the following type pf access control systems? A. Mandatory Access Control B. Team-based Access Control C. Discretionary Access Control D. Group-based Control
C. Discretionary Access Control gives the user the option of setting controls.
A. is inccorect, as Mandatory Access Control does not provide for user control.
95 Which of hte following documnets are mandatory elements regarding the implementaion od a policy? A. Guidlines B. Standards C. Procedures D. Audit Findings
B is correct; standards are externally defined expectations with regard to a specific condition, hence they act to guide policy.
A, C, and D are incorrect; they are elements of a security process, just not mandatory elements, or elements with mandatory content.
59
What is described as the chief drawback to the securcity principle of seperation of duties?
A. It is often not well accepted by users
B. It disperses responsibilities, thus making it easier for the insiders to take advantage of security holes.
C. The cost required in terms of both time and money.
D. It is a difficult concept to understand and implement.
C is correct; the chief drawback with the principle of separation of duties is the perceived cost involved.
A is incorrect; while it may not be popular among users, this is not a chief drawback. B and D are incorrect, as the principle is not hard to understand, and it doesn’t make it easier for insiders to take advantage of security holes.
62 Which of the following is a toll designed to identifiy what devices are connected to a given network and, where possible, the operating system in use on that device? A. Firewall B. Web Security Gateway C. All-in-one security appliance D. network mapper
D is correct; a network mapper is a tool designed to identify what devices are connected to a given network and, where possible, the operating system in use on that device.
A, B, and C are tools for operational security, not for network discovery.
8 Which of hte following sends unguarenteed or best-effort data transfers? A. DNS B. TCP C. FTP D. UDP
D is correct. User Datagram Protocol (UDP) sends data without guaranteeing delivery.
A is incorrect. DNS is not a data transfer protocol. B and C are both guaranteed delivery protocols.
91 Which of the following security terms ensures that only authorized individuals are able to create or change information? A. Confidentiality B. Integrity C. Authentication D. Non-repudiation
B is correct; integrity refers to the protection of information from unauthorized alteration.
A is incorrect; confidentiality refers to the protection of information disclosure to unauthorized parties. C and D are incorrect; they are not related to changing of information.
80 For security policy to be effective, it must be understood by: A. All employees B. Senior management C. System administrators D. Security personnel
A. is correct because security is an all-hands effort; all employees must understand the effects of a security breach and the company policy associated with security.
B, C, and D are incorrect; as they are subsets of “All employees,” which is a better answer.
28 What type of firewall works primarily on port and IP addresses? A. Stateful Firewall B. Web application firewall C. Socket layer firewall D. Packet filtering firewall
D is correct. A packet-filtering firewall works primarily on ports and IP addresses.
A and B are incorrect. They are different types of firewalls that require additional packet inspection. C is incorrect. This is a simple distractor.
11 What six-byte number is used to identify a Network Interface Card? A. Interface label B. Media Access Control address C. Internal protocal number D. Fully Qualified Domain Name
B is correct. The Media Access Control (MAC) address uniquely identifies Network Interface Cards. The MAC address consists of a vendor number and serial number.
A is incorrect. It is a nonsensical distractor. C and D are incorrect. They are technical terms not related to layer 2 addressing.
54 The activity of searching for unsecured wireless networks is know as what? A. War-mapping B. Wa-chalking C. War-driving D. War-monitoring
C is correct; the activity of searching for unsecured wireless networks is known as war-driving.
A, B, and D are incorrect; they are distractors using wireless terms and the “war-“ prefix.
34 An evil twin attack is performed utilizing: A. Fire sheep plug-in for Firefox B. Stolen credentials C. A rogue access point D. Spoofed packets
C is correct. An evil twin is a rogue access point set up by an attacker that produces a stronger signal than the legitimate access point, pulling in users by virtue of the stronger signal.
A is incorrect; the Fire sheep plug-in targets a different vulnerability. B is incorrect; credentials do not play a role in the evil twin attack. D is incorrect; spoofed packets are not involved in the evil twin attack.
53
To sniff all network traffic connected to your computer, what is necessary?
A. You must have a public IP number
B. Your NIC card muist be in promiscuous mode
C. You must be in single-user mode
D. you must have an automatic IP address.
B is correct; your NIC card must be able to examine all traffic on your network media, which means it must be set to promiscuous mode.
A is incorrect; it is always true, and not discriminatory. C is incorrect; it is not relevant. D is incorrect; it is a nonsensical distractor.
ECC is particularly suited to A. Mainframes B. Signing digital contracts C. Storing passwords securley D. Mobile devices
D is correct. ECC requires very little power, making it ideal for low-power devices, such as mobile devices.
A, B, and C are incorrect. Although used on mainframes, ECC is primarily designed and used in low-power situations where transmission errors may occur, as in mobile devices.
73 Which of the following services allows a client to retrieve email from a server? A. SNMP B. POP3 C. FTP D. HTTP
B is correct; POP3 (Post Office Protocol) is the only correct answer.
A is incorrect; SNMP is Simple Network Management Protocol. C is incorrect; FTP is for file transfers. D is incorrect; HTTP is used to communicate to a web server, not the e-mail server.
46 Loop protection involves which of the following? A. Switches B. VPNs C. Physical security D. Remote Access
A is correct; loops can be formed at layer 2, and the Spanning Tree Protocol is typically used to prevent loops.
B, C, and D are incorrect; they are distractors built using relevant terms.
44 Which of the following describes an attack in which an attacker tries to write more data than allowed to a memory of a victim's computer? A. Buffer overflow B. Cross-site script C. Command injection attack D. Cross-site request forgery
A is correct; a buffer overflow results when data is written beyond the allocated memory. The data may overwrite other data space, code space, registers, or stack space, resulting in unexpected behavior.
B, C, and D are all attacks, but not ones that are the result of overwriting memory buffers.
89
Which of the following steps will an attacker often take to attack a computer system?
A. Determine little information on the computer resource
B. Install patches for all known vulnerabilities
C. Limit the number of servics running on a system
D. Perform a port scan to identify al open ports.
D is correct; attackers will often perform a port scan to identify all open ports on a system to determine which potential vulnerabilities may be exploited.
A is incorrect; this is a nonsensical answer. B is incorrect; attackers will not install all patches. C is incorrect; this is a mitigation effort, not an attacker effort.
