CompTIA Security+ (SY0-701) Exam 6

Question 1

A company is reviewing their cloud service provider’s responsibility matrix before migrating their applications. Which of the following is typically the customer’s responsibility in both IaaS and SaaS models?

Network controls
Physical security
Hardware maintenance
Application layer security

Answer 1

In both Infrastructure as a Service (IaaS) and Software as a Service (SaaS) models, the customer is usually responsible for application layer security. This includes ensuring that applications are developed securely and are free from vulnerabilities. Physical security, network controls, and hardware maintenance are typically the responsibility of the cloud service provider, especially in a SaaS model.

Question 2

A company’s proprietary software code is secretly copied and sold to a competing firm. This scenario is most indicative of:

Organized crime
Insider threat
Shadow IT
Nation-state

Answer 2

The unauthorized copying and selling of proprietary software code to a competitor is a clear example of an insider threat. This action likely involves someone within the company who has access to sensitive information and chooses to exploit it for personal gain or to benefit another entity. Unlike organized crime or nation-states, which might target a company for financial or strategic reasons but from an external position, or shadow IT, which involves unauthorized technology use within an organization, this scenario specifically points to the risks posed by those within the organization.

Question 3

A company conducts regular security awareness training for its employees to inform them about potential security threats and the importance of following company security policies. This initiative is an example of which type of control?

Preventive
Compensating
Deterrent
Directive

Answer 3

Security awareness training is a directive control. Directive controls aim to guide individuals’ actions toward compliance with the organization’s policies and procedures through instructions or guidelines. By educating employees about security threats and the necessity of adhering to company policies, the organization directs behavior to reduce the risk of security incidents. This form of control is distinct from preventive or deterrent controls, which either stop incidents before they happen or dissuade attackers, and from detective or compensating controls, which identify incidents after they occur or provide alternative measures to deal with security vulnerabilities.

Question 4

An organization implements a firewall to monitor and control incoming and outgoing network traffic based on predetermined security rules. Under which control type does this action fall?

Corrective
Deterrent
Detective
Preventive

Answer 4

The implementation of a firewall is a preventive control measure. Preventive controls are designed to stop unauthorized actions or events from occurring by setting up barriers or safeguards. A firewall actively prevents unauthorized access to a network by filtering traffic based on established security rules, thereby blocking potentially harmful traffic before it can penetrate the network. This approach is proactive, aiming to mitigate risks by preventing security breaches ahead of time, distinguishing it from other controls that may detect, deter, correct, or compensate for security incidents after they occur.

Question 5

To protect data on USB drives used by employees for transferring work-related documents, a company implements encryption. What level of encryption ensures that the entire contents of the USB drive are protected?

Partition
File
Full-disk
Volume

Answer 5

Full-disk encryption is the level of encryption that ensures the entire contents of USB drives are protected. This type of encryption secures all data on the drive, including files, folders, and system files, making it inaccessible without the correct decryption key. This approach is ideal for removable media like USB drives, as it provides comprehensive protection against unauthorized access, regardless of the device the drive is connected to. Partition, file, and volume encryption offer varying levels of granularity and might not secure the entire drive as effectively as full-disk encryption.

Question 6

In the context of data disposal and decommissioning, why is data sanitization considered more secure than simply deleting files?

It removes the data in a way that makes recovery impossible.

It encrypts data so that it cannot be accessed without a key.

It ensures data is backed up before deletion.

It involves physically destroying the storage media

Answer 6

Data sanitization is considered more secure than merely deleting files because it removes the data in such a manner that it cannot be recovered, even with advanced data recovery tools. This method is essential for protecting sensitive information from unauthorized access after the disposal of storage media. While physical destruction and encryption are methods of securing data, sanitization specifically refers to the process of making data irrecoverable, offering a distinct advantage over simple deletion or backup strategies.

Question 7

Which site consideration option involves having infrastructure ready to use with power and cooling but no operational servers?

Cold
Hot
Warm
Geographic dispersion

Answer 7

A cold site is a location with infrastructure like power and cooling in place but no operational servers. It’s a cost-effective option for organizations needing quick recovery without continuous operation. Hot and warm sites both involve operational servers, with hot sites being fully equipped for immediate use and warm sites requiring some setup time. Geographic dispersion refers to spreading resources across different locations for redundancy.

Question 8

A company wants to ensure the authenticity and integrity of emails sent from its domain. Which combination of email security mechanisms should be implemented?

DMARC and DKIM
DMARC and TLS
SPF, DKIM, and DMARC
SPF and DKIM

Answer 8

Implementing SPF, DKIM, and DMARC together provides a robust solution for ensuring the authenticity and integrity of emails. SPF allows the receiver to check that incoming mail from a domain comes from a host authorized by that domain’s administrators. DKIM provides an encryption key and digital signature that verifies that an email message was not tampered with in transit. DMARC ties SPF and DKIM together with a set of policies, providing instructions to the receiving mail server on how to deal with emails that fail the SPF and DKIM checks, thereby improving the security of email communications.

Question 9

A company is reviewing their cloud service provider’s responsibility matrix before migrating their applications. Which of the following is typically the customer’s responsibility in both IaaS and SaaS models?

Physical security
Network controls
Hardware maintenance
Application layer security

Answer 9

In both Infrastructure as a Service (IaaS) and Software as a Service (SaaS) models, the customer is usually responsible for application layer security. This includes ensuring that applications are developed securely and are free from vulnerabilities. Physical security, network controls, and hardware maintenance are typically the responsibility of the cloud service provider, especially in a SaaS model.

Question 10

An organization wants to encrypt sensitive files stored on its internal network to protect them from unauthorized access. Which encryption type is most efficient for encrypting large volumes of data at rest?

Asymmetric
Algorithms
Key exchange
Symmetric

Answer 10

Symmetric encryption is the most efficient type for encrypting large volumes of data at rest. It uses the same key for both encryption and decryption, which makes the process faster and less resource-intensive compared to asymmetric encryption. This efficiency is particularly important for encrypting large files or datasets, where performance and speed are critical. Symmetric encryption ensures a high level of security while maintaining performance, making it ideal for protecting data stored within an organization’s network.

Question 11

An organization is considering updates to its legacy systems. Which of the following solutions provides the best balance between modernization and security for its aging infrastructure?
On-premises hardware upgrades

Containerization
Real-time operating system updates
Decentralized systems

Answer 11

Containerization provides the best balance between modernization and security for aging infrastructure as it allows legacy applications to be encapsulated in containers, making them portable, more secure, and easier to manage without the need for immediate, extensive hardware upgrades or the complexities of decentralized systems.

Question 12

A company is evaluating protocols for secure remote access. Which protocol provides strong encryption and is widely regarded as the most secure option for establishing a VPN?

PPTP
SSH
L2TP
IPSec

Answer 12

IPSec (Internet Protocol Security) is widely regarded as the most secure option for establishing a VPN, providing robust encryption for securing internet protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. While SSH (Secure Shell) also provides strong encryption, it is typically used for secure command execution and file transfers rather than VPN connections. PPTP (Point-to-Point Tunneling Protocol) and L2TP (Layer 2 Tunneling Protocol) are older and less secure compared to IPSec, making IPSec the preferred choice for secure remote access.

Question 13

Your company plans to migrate its on-premises data center to a cloud service. As a security professional, you must advise on the security implications. Which of the following models would likely require your company to retain the most control over security?

PaaS
IaaS
SaaS
Hybrid cloud

Answer 13

In an Infrastructure as a Service (IaaS) model, the cloud provider offers basic infrastructure services such as physical or virtual servers and storage. The customer is responsible for managing aspects including the operating systems, applications, and data. This model requires the company to retain the most control over security compared to PaaS or SaaS, where the provider assumes more responsibility for managing the infrastructure.

Question 14

To access their online banking services, a bank’s customers must enter a password and authenticate through a one-time code sent to their mobile phones. This practice exemplifies which security strategy?

Enhanced password policy

Biometric security

Your answer is incorrect
Two-factor authentication

Dual verification process

Answer 14

This security strategy, requiring both a password and a one-time code sent to a mobile phone, exemplifies two-factor authentication. It incorporates two distinct forms of verification: something the user knows (the password) and something the user possesses (the mobile phone to receive the code). This dual-layer security significantly strengthens defenses against unauthorized access, as it complicates potential breaches by requiring attackers to compromise more than just a single piece of user information.

Question 15

A technology firm is exploring options to enhance their data center’s resilience to failures. Which of the following would best ensure high availability of their services?

Decentralized architecture
Real-time operating system
Your answer is incorrect
SDN-enabled infrastructure
Embedded systems

Answer 15

A decentralized architecture best ensures high availability of services as it distributes resources and services across multiple locations, reducing the impact of a single point of failure, unlike embedded systems or real-time operating systems, which may not directly contribute to the high availability of services across a network.

Question 16

A network administrator is configuring an IDS to enhance network security. For known malware and attack vectors, which detection method should be prioritized?

Behavioral analysis.
Heuristic analysis.
Signature-based detection.
Anomaly-based detection.

Answer 16

Signature-based detection is ideal for identifying and mitigating known malware and attack vectors because it relies on a database of known threat signatures for detection. This method offers high accuracy for known threats, unlike anomaly-based, heuristic, or behavioral analysis, which are better suited for detecting unknown or emerging threats but may result in higher false positives when dealing with known issues.

Question 17

An organization is looking to reduce the risk of privilege escalation due to compromised administrator credentials. Which solution should they implement?

Encouraging the use of easy-to-remember passwords

Password vaulting combined with multi-factor authentication

The use of a single administrator account for ease of tracking

Mandatory password changes every 30 days

Answer 17

Combining password vaulting with multi-factor authentication (MFA) provides a robust security solution by securely storing privileged credentials and requiring multiple forms of verification before access is granted. This significantly reduces the risk of unauthorized access through compromised credentials, as attackers would need to bypass multiple security measures. Mandatory password changes, using a single administrator account, and encouraging easy-to-remember passwords do not address the multifaceted threats associated with privilege escalation and may, in some cases, weaken security by simplifying credential theft or mismanagement.

Question 18

Your company plans to migrate its on-premises data center to a cloud service. As a security professional, you must advise on the security implications. Which of the following models would likely require your company to retain the most control over security?

SaaS
Hybrid cloud
PaaS
IaaS

Answer 18

In an Infrastructure as a Service (IaaS) model, the cloud provider offers basic infrastructure services such as physical or virtual servers and storage. The customer is responsible for managing aspects including the operating systems, applications, and data. This model requires the company to retain the most control over security compared to PaaS or SaaS, where the provider assumes more responsibility for managing the infrastructure.

Question 19

When configuring a network to restrict access to only authorized devices, which NAC implementation approach is most effective for ensuring devices comply with security policies before accessing network resources?

Post-admission network behavior analysis

MAC address filtering
Your answer is incorrect
Port-based authentication

Pre-admission endpoint security scanning

Answer 19

Pre-admission endpoint security scanning is most effective because it ensures devices comply with the organization’s security policies before they are allowed to access network resources. This method evaluates the security posture of a device, including software updates, system configurations, and the presence of security software, ensuring that only compliant devices can connect. MAC address filtering and port-based authentication do not evaluate the security posture of devices, and post-admission network behavior analysis only monitors devices after they have accessed the network, which could be too late to prevent access by non-compliant devices.

Question 20

An organization implements access control policies to restrict user access to information and systems based on their role and necessity. Which category of control does this action fall under?

Physical

Technical

Managerial

Operational

Answer 20

Implementing access control policies is a managerial control. Managerial controls involve the establishment of policies, standards, procedures, and guidelines that direct the organization’s overall approach to security. Access control policies are part of the strategic framework that defines how access to information and systems is managed and controlled, specifying who can access what information and under what circumstances. Unlike technical controls, which would be the actual systems and technologies enforcing these policies, or operational controls, which are the day-to-day actions taken to adhere to these policies, managerial controls are about the overarching strategy and policy setting.

Question 21

A company is revising its data retention policy to better align with global privacy regulations. Which of the following would be the most effective strategy to include in this revision?

Increasing data storage capacity

Reducing the frequency of data backup

Limiting employee access to sensitive data

Regular audits of data usage and storage

Answer 21

Regular audits of data usage and storage are essential when revising a data retention policy to ensure compliance with global privacy regulations. These audits help identify and rectify any practices that may not align with legal requirements, ensuring that data is only kept as long as necessary and used appropriately. This approach not only supports compliance but also enhances data governance and security by providing ongoing oversight of how data is managed within the company.

Question 22

A technology firm discovers several of its devices are being used without its knowledge to mine cryptocurrency. This activity is likely an example of:

Shadow IT
Organized crime
Hacktivist
Insider threat

Answer 22

The unauthorized use of company devices to mine cryptocurrency often indicates an insider threat, where an employee or someone with internal access exploits company resources for personal gain. This scenario does not fit the typical motivations of hacktivists, who are driven by political or social causes, nor does it align with the characteristics of shadow IT, which involves using unauthorized software or services rather than exploiting existing resources for malicious purposes. Organized crime typically targets financial gain through more direct means, such as data breaches or fraud, making an insider threat the most likely source in this scenario.

Question 23

What is the primary advantage of using package monitoring in application security?

It identifies vulnerabilities within third-party dependencies.

It simplifies the process of code obfuscation.

It enables real-time detection of network intrusions.

It automates the generation of compliance reports.

Answer 23

Package monitoring is crucial for identifying vulnerabilities within third-party dependencies and libraries that an application uses. These external components can introduce security risks if they contain vulnerabilities that are not known or addressed. By monitoring these packages, organizations can be alerted to newly discovered vulnerabilities in their dependencies, enabling them to take timely action to mitigate potential security risks.

Question 24

Your organization requires a solution that not only filters out malicious internet traffic but also provides detailed reporting and analysis for compliance purposes. Which type of firewall should be implemented?

WAF

Layer 4 Firewall

NGFW

UTM

Answer 24

A Next-Generation Firewall (NGFW) is the best solution for an organization that needs to filter out malicious internet traffic while also providing detailed reporting and analysis for compliance purposes. NGFWs go beyond traditional firewalls by incorporating advanced features such as application awareness, integrated intrusion prevention, and enhanced threat intelligence. They offer more in-depth inspection of traffic and better control over data, which helps in compliance reporting and threat analysis. While UTM devices offer similar features, NGFWs are typically more focused on advanced security and reporting capabilities.

Question 25

In the context of enhancing enterprise security through DNS filtering, which type of attack is most effectively mitigated?

Phishing attacks
Your answer is incorrect
SQL injection attacks
Buffer overflow attacks
DDoS attacks