CompTIA CompTIA Security+ RC0-501 Questions & Answers

• Question 31:

  When considering a third-party cloud service provider, which of the following criteria would be the BEST to include in the security assessment process? (Select two.)

  A. Use of performance analytics

  B. Adherence to regulatory compliance

  C. Data retention policies

  D. Size of the corporation

  E. Breadth of applications support

  Correct Answer: BC

• Question 32:

  Which of the following occurs when the security of a web application relies on JavaScript for input validation?

  A. The integrity of the data is at risk.

  B. The security of the application relies on antivirus.

  C. A host-based firewall is required.

  D. The application is vulnerable to race conditions.

  Correct Answer: A

• Question 33:

  An analyst is reviewing a simple program for potential security vulnerabilities before being deployed to a Windows server. Given the following code:

  

  Which of the following vulnerabilities is present?

  A. Bad memory pointer

  B. Buffer overflow

  C. Integer overflow

  D. Backdoor

  Correct Answer: B

• Question 34:

  An organization needs to implement a large PKI. Network engineers are concerned that repeated transmission of the OCSP will impact network performance. Which of the following should the security analyst recommend is lieu of an OCSP?

  A. CSR

  B. CRL

  C. CA

  D. OID

  Correct Answer: B

• Question 35:

  When identifying a company's most valuable assets as part of a BIA, which of the following should be the FIRST priority?

  A. Life

  B. Intellectual property

  C. Sensitive data

  D. Public reputation

  Correct Answer: A

• Question 36:

  A security analyst observes the following events in the logs of an employee workstation: Given the information provided, which of the following MOST likely occurred on the workstation?

  

  A. Application whitelisting controls blocked an explogt payload from executing.

  B. Antivirus software found and quarantined three malware files.

  C. Automatic updates were initiated but failed because they had not been approved.

  D. The SIEM log agent was not turned properly and reported a false positive.

  Correct Answer: A

• Question 37:

  In terms of encrypting data, which of the following is BEST described as a way to safeguard password data by adding random data to it in storage?

  A. Using salt

  B. Using hash algorithms

  C. Implementing elliptical curve

  D. Implementing PKI

  Correct Answer: A

• Question 38:

  A system administrator wants to provide for and enforce wireless access accountability during events where external speakers are invited to make presentations to a mixed audience of employees and non-employees. Which of the following should the administrator implement?

  A. Shared accounts

  B. Preshared passwords

  C. Least privilege

  D. Sponsored guest

  Correct Answer: D

• Question 39:

  Which of the following would MOST likely appear in an uncredentialed vulnerability scan?

  A. Self-signed certificates

  B. Missing patches

  C. Auditing parameters

  D. Inactive local accounts

  Correct Answer: D

• Question 40:

  An information security specialist is reviewing the following output from a Linux server.

  

  Based on the above information, which of the following types of malware was installed on the server?

  A. Logic bomb

  B. Trojan

  C. Backdoor

  D. Ransomware

  E. Rootkit

  Correct Answer: A