Sec+ Practice Test_2

The new Chief Information Security Officer at a company has asked the security team to implement stronger user account policies. The new policies require:

• Users to choose a password unique to their last ten passwords

• Users to not log in from certain high-risk countries

Which of the following should the security team implement? (Select TWO).

• Password complexity

• Password history

• Geolocation

• Geofencing

• Geotagging

Which of the following explains why RTO is included in a BIA?

• It identifies the amount of allowable downtime for an application or system,

• It prioritizes risks, so the organization can allocate resources appropriately,

• It monetizes the loss of an asset and determines a break-even point for risk mitigation.

• It informs the backup approach so that the organization can recover data at a known time.

Which of the following uses SAML for authentication?

• TOTP

• Federation

• Kerberos

• HOTP

Which of the following is a policy that provides a greater depth and breadth of knowledge across an organization?

• Asset management policy

• Separation of duties policy

• Acceptable use policy

• Job Rotation policy

A user reports falling for a phishing email to an analyst. Which of the following system logs would the analyst check FIRST?

• DNS

• Message gateway

• Network

• Authentication

A cyber-security administrator is using an enterprise firewall. The administrator created some rules, but now seems to be unresponsive. All connections being dropped by the firewall. Which of the following would be the BEST option to remove the rules?

• # iptables -t mangle -x

• # iptables -f

• # iptables -z

• # iptables -p input -j drop

A security analyst has been tasked with finding the maximum amount of data loss that can occur before ongoing business operations would be impacted. Which of the following terms BEST defines this metric?

• MTTR

• RTO

• RPO

• MTBF

A company is required to continue using legacy software to support a critical service. Which of the following BEST explains a risk of this practice?

• Default system configuration

• Unsecure protocols

• Lack of vendor support

• Weak encryption

A company wants to simplify the certificate management process. The company has a single domain with several dozen subdomains, all of which are publicly accessible on the internet. Which of the following BEST describes the type of certificate the company should implement?

• Subject alternative name

• Wildcard

• Self-signed

• Domain validation

A company wants the ability to restrict web access and monitor the websites that employees visit. Which of the following would BEST meet these requirements?

• internet proxy

• VPN

• WAF

• Firewall