SEC+ D

Question 1

Penetration testing is distinct from vulnerability scanning primarily because penetration test:
leverages credentialed scanning to obtain persistence
involves multiple active exploitation techniques
relies exclusively on passive exploitation attempts for pivoting
relies on misconfiguration of security controls

Answer 1

Involves multiple active exploitation techniques

Question 2

Which of the following types of vulnerability scans typically return more detailed and thorough insights into actual system vulnerabilities?
Non-credentialed
Intrusive
Credentialed
Non-intrusive

Answer 2

Credentials

Question 3

The following ports are open for a production internet web server: 22, 23, 80, 443, 3389, and 8080. Which of the following mitigation strategies should a penetration tester recommend?
System hardening
Secure developer training
User input sanitization
Multifactor authentication

Answer 3

System Hardening

Question 4

Which of the following is considered passive reconnaissance?
Utilizing WHOIS
Running a port scan
Performing enumeration of services
Using OS fingerprinting
Employing social engineering

Answer 4

Utilizing WHOIS

Question 5

Which of the following has the potential to create a DoS attack on a system?
A server room WiFi thermostat with default credentials
A surveillance camera that has been replaced and is not plugged in
A disabled user account that has not been deleted
A wireless access point with WPA2 connected to the network

Answer 5

A server room WIFI thermostat with default credentials

Question 6

Which of the following generates reports that show the number of systems that are associated with POODLES, 3DES, and SMBv1 listings?
A protocol analyzer
A UTM appliance
A vulnerability scanner
A honeypot

Answer 6

A Vulnerability scanner

Question 7

Which of the following impacts MOST likely results from poor exception handling?
Widespread loss of confidential data
Network-wide resource exhaustion
Privilege escalation
Local disruption of services

Answer 7

Privilege Escalation

Question 8

A critical enterprise component whose loss or destruction would significantly impede business operations or have an outsized impact on corporate revenue is known as:
a single point of failure
critical system infrastructure
proprietary information
a mission-essential function

Answer 8

A Mission-Essential function

Question 9

Exercising various programming responses for the purpose of gaining insight into a system’s security posture without exploiting the system is BEST described as:
passive security control testing
control gap analysis
peer-conducted code review
non-intrusive scanning

Answer 9

Passive Security Control Testing

Question 10

A Chief Information Officer (CIO) wants to eliminate the number of calls the help desk is receiving for password resets when users log on to internal portals. Which of the following is the BEST solution?
Increase password length
Implement a self-service portal
Decrease lockout threshold
Deploy mandatory access control

Answer 10

Implement a Self-Service Portal

Question 11

After a breach, a company has decided to implement a solution to better understand the technique used by the attackers. Which of the following is the BEST solution to be deployed?
Network analyzer
Protocol analyzer
Honeypot network
Configuration compliance scanner

Answer 11

Honeypot Network

Question 12

A technique wants to implement PKI-based authentication on an enterprise wireless network. Which of the following should the technician configure to enforce the use of client-side certificates?
802.1X with PEAP
WPA2-PSK
EAP-TLS
RADIUS Federation

Answer 12

EAP-TLS

Question 13

A user visited a banking website from a saved bookmark and logged in with his credentials. Discovered that he could not access any resources, and none of his account information would display. The bank called to report his account had been compromised. Which of the following MOST likely would have prevented this from occurring? 
SSH
TLS
DNSSEC
LDAPS

Answer 13

DNSSES

Question 14

An audit revealed that a privileged account accessed a large number of systems multiple times in a short period. Account-deactivated. The unexpected changes stopped happening, but some systems ceased to perform their scheduled tasks. Which of the following was incorrectly performed?
Use and documentation of service accounts
Restriction of shared privileged accounts
Proper training prior to granting privileged accounts

Answer 14

Use and Documentation of Service Accounts

Question 15

An analyst is trying to obtain a signed certificate from a CA by pasting a public key into the CA’s web request form; however, it does not work, and an error is generated. Which of the following does the analyst need to paste into the web request form?
A private key
A CSR
The OID
A certificate chain

Answer 15

The OID

Question 16

A security analyst receives the following output: Time: 12/15/2017 Action: Policy: Endpoint USB Transfer – Blocked Host: Host1 File Name: Q3-Finacials.PDF User: User1 Which of the following MOST likely occurred to produce this output?
The host-based firewall prevented an attack from a Trojan horse
USB-OTG prevented a file from being uploaded to a mobile device
The host DLP prevented a file from being moved off a computer
The firewall prevented an incoming malware-infected file

Answer 16

The Host DLP Prevented a File from Being Moved Off a Computer

Question 17

A security administrator is working with the human resources department to classify data held by the company. Determined the data contains a variety of data types, including health info, employee info, trade secrets, and confidential customer info. Which of the following should they do NEXT?
Apply a predefined set of labels from government sources to all data within the company
Create a custom set of data labels to group the data by sensitivity and protection requirements
Label sensitive data according to age to comply with retention policies
Destroy company information that is not labeled in compliance with government regulations and laws

Answer 17

Create a custom set of data labels to group the data by sensitivity and protection requirements

Question 18

An organization wants to use a ticket-based approach to access management for an internal network. Would like the solution to be vendor-independent and use a widely supported protocol, but it does not want to use an XML-based approach. Which of the following access protocols should the organization choose?
Kerberos
OAuth
MSCHAPv2
SAML

Answer 18

KERBEROS

Question 19

While testing a new application, a developer discovers that the inclusion of an apostrophe in a username causes the application to crash. Which of the following secure coding techniques would be MOST useful to avoid this problem?
Input validation
Code signing
Obfuscation
Encryption

Answer 19

Input Validation

Question 20

A network admin needs to restrict the users of the company’s WAPs to the sales department. The network admin changes and hides the SSID and then discovers several employees had connected their personal devices to the wireless network. Which of the following would limit access to the wireless network to only organization-owned devices in the sales department?
Implementing MAC filtering
Reducing the signal strength to encompass only the sales department
Replacing the APs and sales department wireless cards to support 802.11b
Issuing a BYOD policy

Answer 20

Implementing MAC Filtering

Question 21

During the penetration testing of an organization, the tester was provided with the names of a few key servers, along with their IP address. Which of the following is the organization conducting?
Gray box testing
White box testing
Black box testing
Isolated container testing
Vulnerability testing

Answer 21

Gray Box Testing

Question 22

A new employee received an email from an unknown source indicating she needed to click on the provided link to update her company’s profile. Once she clicked the link, a command prompt appeared with the following output: C:\Users\Ann\Documents\File1.pgp
C:\Users\Ann\Documents\AdvertisingReport.pgp
C:\Users\Ann\Documents\FinancialReport.pgp
Which of the following types of malware was executed?
Ransomware
Adware
Spyware
Virus

Answer 22

Ransomware

Question 23

An organization is setting up a satellite office and wishes to extend the corporate network to the new site. Which of the following is the BEST solution to allow the users to access corporate resources while focusing on usability and security?
Federated services
Single sign-on
Site-to-site VPN
SSL accelerators

Answer 23

Site-to-site VPN

Question 24

A company had users and printers in multiple geographic locations, and the printers are located in common areas of the offices. To preserve the confidentiality of PII, a security admin needs to implement the appropriate controls. Which of the following would BEST meet the confidentiality requirements of the data?
Enforcing location-based policy restrictions
Adding location to the standard naming convention
Implementing time-of-day restrictions based on location
Conducting regular account maintenance at each location

Answer 24

Enforcing location-based policy restrictions

Question 25

``` Company recently experienced a significant malware attack that caused all business operations to stop. After an investigation, a single PC was identified as the root cause, and a security analyst on the IR team disconnected the machine from the corporate network, both the wired and wireless connections. Which of the following incident response phases was just completed? Preparation Identification Containment Eradication Recovery Lessons learned ```

Answer 25

Containment

Question 26

``` An analysis of a threat actor, which had been active for several years, reveals the threat actor as high levels of funding, motivation, and sophistication. Which of the following types of threat actors does this BEST describe? Advanced persistent threat Hacktivist Organized crime Insider ```

Answer 26

Advanced Persistent Threat

Question 27

A network admin wants to gather info on the security of the network servers in the DMZ. The admin runs the following command: Telnet www.example.com 80 Which of the following actions is the admin performing? Grabbing the web server banner Logging into the web server Harvesting cleartext credentials Accessing the web server management console

Answer 27

Grabbing the Web Server Banner

Question 28

``` A company has forbidden the use of external media within its headquarters location. A security analyst is working on adding additional repositories to a server in the environment when the analyst notices some odd processes running on the system. The analyst runs a command and sees the following: $ history ifconfig -a netstat -n pskill 1788 pskill914 mkdir /tmp/1 mount -u sda101 /tmp/1 cp /tmp/1* ~/1/ umount /tmp/1 1s -a1 1/1/ apt-get update apt-get upgrade clear Given this output, which of the following security issues has been discovered? A misconfigured HIDS A malware installation A policy violation The activation of a Trojan ```

Answer 28

A Malware Installation

Question 29

``` During a routine check, a security analyst discovered the script responsible for the backup of the corporation file server had been to the following: date = get_currentdate() if date = $userA.Birthdate then exec ' rm -rf /' end if Which of the following BEST descries the type of malware the analyst discovered? Keylogger Rootkit RAT Logic bomb ```

Answer 29

Logic Bomb

Question 30

An organization has created a review process to determine how to best handle data with different sensitivity levels. The process includes the following requirements: -Soft copy PII must be encrypted -Hard copy PII must be placed in a locked container -Soft copy PHI must be encrypted and audited monthly -Hard copy PHI must be placed in a locked container and inventoried monthly Locked containers must be approved and designated for document storage. Any violations must be reported to the Chief Security Officer (CSO). While searching for coffee in the kitchen, an employee unlocks a cabinet and discovers a list of customer names and phone numbers. Which of the following actions should the employee take? Put the document back in the cabinet, lock the cabinet, and report the incident to the CSO Take custody of the document, secure it at a desk, and report the incident to the CSO Take custody of the document and immediately report the incident to the CSO Put the document back in the cabinet, inventory the contents, lock the cabinet, and report the incident to the CSO

Answer 30

Take custody of the document and immediately report the incident to the CSO

Question 31

``` A technician is implementing 802.1X with dynamic VLAN assignment based on a user Active Directory group membership. Which of the following configurations supports the VLAN definitions? RADIUS attribute SAML tag LDAP path Shibboleth IdP ```

Answer 31

LDAP Path

Question 32

Two companies need to exchange a large number of confidential files. Both run high availability UTM devices. They do not want to use email systems to exchange the data. Since the data needs to be exchanged in both directions, which of the following solutions should a security analyst recommend? Configuring the remote access feature on both UTMs Configuring an FTP server in one company Establishing a site-to-site VPN between the two companies Exchanging data by using a free cloud-storage product

Answer 32

Establishing a site-to-site VPN between the two companies

Question 33

``` A coffee company, which operates a chain of stores across a large geographical area, is deploying tablets to use as point-of-sale devices. A security consultant has been given the following requirements: -The cashiers must be able to log in to the devices quickly -The devices must be compliant with applicable regulations for credit card usage -The risk of loss or theft on the devices must be minimized -If devices are lost or stolen, all data must be removed from the device -The devices must be capable of being managed from a centralized location Which of the following should the security consultant configure in the MDM policies for the tablets? (Select TWO) Remote wipe Cable locks Screen locks Geofencing GPS tagging Carrier unlocking ```

Answer 33

Remote Wipe | Cable Locks

Question 34

``` An employee on the internet-facing part of a company’s website submits a 20-character phrase in a small textbox on a web form. The website returns a message back to the browser stating: Error: Table ‘advprofile’entry into column ‘Iname’ has exceeded number of allowed characters. Error saving database information. Of which of the following is this an example? Resource exhaustion Buffer overflow improperly configured account Improper error handling ```

Answer 34

Improper Error Handling