Question 1

An organization's help desk is flooded with phone calls from users stating they can no longer access certain websites. The help desk escalates the issue to the security team, as these websites were accessible the previous day. The security analysts run the following command: ipconfig /flushdns , but the issue persists. Finally, an analyst changes the DNS server for an impacted machine, and the issue goes away. Which of the following attacks MOST likely occurred on the original DNS server?

Accepted Answer

A)   DNS cache poisoning
B)   Domain hijacking
C)   Distributed denial-of-service
D)   DNS tunnelingE) A) and D)
F) None of the above

Question 2

The process of passively gathering information prior to launching a cyberattack is called:

Accepted Answer

A)   tailgating.
B)   reconnaissance.
C)   pharming.
D)   prepending.E) A) and C)
F) A) and B)

Question 3

A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use?

Accepted Answer

A)   RAID 0
B)   RAID 1
C)   RAID 5
D)   RAID 10E) B) and D)
F) A) and D)

Question 4

After reading a security bulletin, a network security manager is concerned that a malicious actor may have breached the network using the same software flaw. The exploit code is publicly available and has been reported as being used against other industries in the same vertical. Which of the following should the network security manager consult FIRST to determine a priority list for forensic review?

Accepted Answer

A)   The vulnerability scan output
B)   The IDS logs
C)   The full packet capture data
D)   The SIEM alertsE) C) and D)
F) B) and C)

Question 5

An organization has various applications that contain sensitive data hosted in the cloud. The company's leaders are concerned about lateral movement across applications of different trust levels. Which of the following solutions should the organization implement to address the concern?

Accepted Answer

A)   ISFW
B)   UTM
C)   SWG
D)   CASBE) A) and D)
F) A) and C)

Question 6

Which of the following is the purpose of a risk register?

Accepted Answer

A)   To define the level or risk using probability and likelihood
B)   To register the risk with the required regulatory agencies
C)   To identify the risk, the risk owner, and the risk measures
D)   To formally log the type of risk mitigation strategy the organization is usingE) B) and D)
F) A) and C)

Question 7

A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better:

Accepted Answer

A)   validate the vulnerability exists in the organization's network through penetration testing.
B)   research the appropriate mitigation techniques in a vulnerability database.
C)   find the software patches that are required to mitigate a vulnerability.
D)   prioritize remediation of vulnerabilities based on the possible impact.E) A) and D)
F) B) and C)

Question 8

In which of the following situations would it be BEST to use a detective control type for mitigation?

Accepted Answer

A)   A company implemented a network load balancer to ensure 99.999% availability of its web application.
B)   A company designed a backup solution to increase the chances of restoring services in case of a natural disaster.
C)   A company purchased an application-level firewall to isolate traffic between the accounting department and the information technology department.
D)   A company purchased an IPS system, but after reviewing the requirements, the appliance was supposed to monitor, not block, any traffic.
E)   A company purchased liability insurance for flood protection on all capital assets.F) None of the above
G) B) and E)

Question 9

A development team employs a practice of bringing all the code changes from multiple team members into the same development project through automation. A tool is utilized to validate the code and track source code through version control. Which of the following BEST describes this process?

Accepted Answer

A)   Continuous delivery
B)   Continuous integration
C)   Continuous validation
D)   Continuous monitoringE) B) and D)
F) None of the above

Exam 16: CompTIA Security+ 2021

The process of passively gathering information prior to launching a cyberattack is called:

Correct Answer
verified

An organization has various applications that contain sensitive data hosted in the cloud. The company's leaders are concerned about lateral movement across applications of different trust levels. Which of the following solutions should the organization implement to address the concern?

Correct Answer
verified

Which of the following is the purpose of a risk register?

Correct Answer
verified

In which of the following situations would it be BEST to use a detective control type for mitigation?

Correct Answer
verified

Correct Answer
verified

A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better:

Correct Answer
verified

Correct Answer
verified

A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use?

Correct Answer
verified

A development team employs a practice of bringing all the code changes from multiple team members into the same development project through automation. A tool is utilized to validate the code and track source code through version control. Which of the following BEST describes this process?

Correct Answer
verified

Exam 16: CompTIA Security+ 2021

The process of passively gathering information prior to launching a cyberattack is called:

Correct AnswerverifiedShow Answer

An organization has various applications that contain sensitive data hosted in the cloud. The company's leaders are concerned about lateral movement across applications of different trust levels. Which of the following solutions should the organization implement to address the concern?

Correct AnswerverifiedShow Answer

Which of the following is the purpose of a risk register?

Correct AnswerverifiedShow Answer

In which of the following situations would it be BEST to use a detective control type for mitigation?

Correct AnswerverifiedShow Answer

Correct AnswerverifiedShow Answer

A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better:

Correct AnswerverifiedShow Answer

Correct AnswerverifiedShow Answer

A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use?

Correct AnswerverifiedShow Answer

A development team employs a practice of bringing all the code changes from multiple team members into the same development project through automation. A tool is utilized to validate the code and track source code through version control. Which of the following BEST describes this process?

Correct AnswerverifiedShow Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified