CompTIA CompTIA Security+ SY0-501 Questions & Answers

• Question 31:

  An incident response analyst at a large corporation is reviewing proxy data log. The analyst believes a malware infection may have occurred. Upon further review, the analyst determines the computer responsible for the suspicious network traffic is used by the Chief Executive Officer (CEO). Which of the following is the best NEXT step for the analyst to take?

  A. Call the CEO directly to ensure awareness of the event

  B. Run a malware scan on the CEO's workstation

  C. Reimage the CEO's workstation

  D. Disconnect the CEO's workstation from the network

  Correct Answer: D

• Question 32:

  A law office has been leasing dark fiber from a local telecommunications company to connect a remote office to company headquarters. The telecommunications company has decided to discontinue its dark fiber product and is offering an MPLS connection, which the law office feels is too expensive. Which of the following is the BEST solution for the law office?

  A. Remote access VPN

  B. VLAN

  C. VPN concentrator

  D. Site-to-site VPN

  Correct Answer: D

• Question 33:

  An analyst is part of a team that is investigating a potential breach of sensitive data at a large financial services organization. The organization suspects a breach occurred when proprietary data was disclosed to the public. The team finds servers were accessed using shared credentials that have been in place for some time. In addition, the team discovers undocumented firewall rules, which provided unauthorized external access to a server. Suspecting the activities of a malicious insider threat, which of the following was MOST likely to have been utilized to exfiltrate the proprietary data?

  A. Keylogger

  B. Botnet

  C. Crypto-malware

  D. Backdoor

  E. Ransomware

  F. DLP

  Correct Answer: D

• Question 34:

  A company wants to provide centralized authentication for its wireless system. The wireless authentication system must integrate with the directory back end. Which of the following is a AAA solution that will provide the required wireless authentication?

  A. TACACS+

  B. MSCHAPv2

  C. RADIUS

  D. LDAP

  Correct Answer: C

• Question 35:

  A company is deploying a file-sharing protocol access a network and needs to select a protocol for authenticating clients. Management requests that the service be configured in the most secure way possible. The protocol must also be capable of mutual authentication, and support SSO and smart card logons. Which of the following would BEST accomplish this task?

  A. Store credentials in LDAP

  B. Use NTLM authentication

  C. Implement Kerberos

  D. Use MSCHAP authentication

  Correct Answer: C

• Question 36:

  As part of a corporate merger, two companies are combining resources. As a result, they must transfer files through the Internet in a secure manner. Which of the following protocols would BEST meet this objective? (Choose two.)

  A. LDAPS

  B. SFTP

  C. HTTPS

  D. DNSSEC

  E. SRTP

  Correct Answer: BC

• Question 37:

  An organization electronically processes sensitive data within a controlled facility. The Chief Information Security Officer (CISO) wants to limit emissions from emanating from the facility. Which of the following mitigates this risk?

  A. Upgrading facility cabling to a higher standard of protected cabling to reduce the likelihood of emission spillage

  B. Hardening the facility through the use of secure cabinetry to block emissions

  C. Hardening the facility with a Faraday cage to contain emissions produced from data processing

  D. Employing security guards to ensure unauthorized personnel remain outside of the facility

  Correct Answer: C

• Question 38:

  Which of the following encryption algorithms is used primarily to secure data at rest?

  A. AES

  B. SSL

  C. TLS

  D. RSA

  Correct Answer: A

• Question 39:

  A security auditor is performing a vulnerability scan to find out if mobile applications used in the organization are secure. The auditor discovers that one application has been accessed remotely with no legitimate account credentials. After investigating, it seems the application has allowed some users to bypass authentication of that application. Which of the following types of malware allow such a compromise to take place? (Choose two.)

  A. RAT

  B. Ransomware

  C. Worm

  D. Trojan

  E. Backdoor

  Correct Answer: AE

• Question 40:

  A security analyst is implementing PKI-based functionality to a web application that has the following requirements: File contains certificate information Certificate chains Root authority certificates Private key All of these components will be part of one file and cryptographically protected with a password. Given this scenario, which of the following certificate types should the analyst implement to BEST meet these requirements?

  A. .pfx certificate

  B. .cer certificate

  C. .der certificate

  D. .crt certificate

  Correct Answer: A