CompTIA Security+ SY0-601 Chapter 1 - 4

Someone put malware on your computer that records all of your keystrokes. What aspect of security was primarily attacked?

• Confidentiality
• Integrity
• Availability

What type of control would a security assessment procedure be?

• Management
• Operational
• Physical
• Technical

Malware is a common example of a threat vector.

• true
• false

Which controls primarily protect data integrity?

• Backups
• Encryption
• Fault tolerance
• Hashing
• Need to know

A security program alerts you of a failed login attempt to a secure system. On investigation, you learn the system’s regular user accidentally had caps lock turned on. What kind of alert was it?

• True positive
• True negative
• False positive
• False negative

A new privacy law demands more robust protection for your customer database. First, you researched database security products to find which would reliably meet your needs. Now that you’ve selected and installed one, you’re currently training administrators to perform integrity checks, update the software, and review logs for suspicious activities. What are you practicing?

• Due care
• Due diligence
• Negligence
• Regulatory compliance

Your internal network is protected from internet attacks by a Cisco firewall. To improve security, your supervisor suggests installing a Fortinet firewall between the Cisco firewall and the trusted LAN, then using the space between as a perimeter network. Which security principles does this promote?

• Availability
• Defense in depth
• Security by design
• Security by obscurity
• Vendor diversity

Assuming that all four roles exist separately at your company, which is the most responsible for ensuring security goals and business goals are in alignment?

• CCO
• CISO
• CPO
• CSO

Your company is developing an application a private US-based hospital will use to give patients online access to their medical records. Regardless of what other data the application handles, what kind of compliance do you already know you need to research?

• FERPA
• FISMA
• HIPAA
• PCI-DSS

A US government agency plans to migrate some of its internally hosted data to a cloud-based service. You need to make sure the proposed vendor can meet the same security requirements as the current solution. What are you currently practicing?

• Due care
• Due diligence
• FISMA compliance
• GDPR compliance
• GLBA compliance