Sec+ Practice Test_7

An employee's company account was used in a data breach. Interviews with the employee revealed:

• The employee was able to avoid changing passwords by using a previous password again.

• The account was accessed from a hostile, foreign nation, but the employee has never traveled to any other countries.

Which of the following can be implemented to prevent these issues from reoccurring? (Select TWO)

• Geographic dispersal

• Password complexity

• Geofencing

• Geotagging

• Password history

A system's analyst is responsible for generating a new digital forensics chain-of-custody form. Which of the following should the analyst include in this documentation? (Select two).

• The vendor's name

• A forensics NDA

• The order of volatility

• The date and time

• The provenance of the artifacts

An organization recently completed a security control assessment The organization determined some controls did not meet the existing security measures. Additional mitigations are needed to lessen the risk of the non-compliant controls. Which of the following best describes these mitigations?

• Corrective

• Compensating

• Deterrent

• Technical

Which of the following is used to quantitatively measure the criticality of a vulnerability?

• CVE

• CVSS

• CIA

• CERT

A candidate attempts to go to but accidentally visits http://comptiia.org. The malicious website looks exactly like the legitimate website. Which of the following best describes this type of attack?

• Reconnaissance

• Impersonation

• Typosquatting

• Watering-hole

A security architect is designing a remote access solution for a business partner. The business partner needs to access one Linux server at the company. The business partner wants to avid managing a password for authentication and additional software installation. Which of the following should the architect recommend?

• Soft token

• Smart card

• CSR

• SSH key

A company recently suffered a breach in which an attacker was able to access the internal mail servers and directly access several user inboxes. A large number of email messages were later posted online. Which of the following would best prevent email contents from being released should another breach occur?

• Implement S/MIME to encrypt the emails at rest.

• Enable full disk encryption on the mail servers.

• Use digital certificates when accessing email via the web.

• Configure web traffic to only use TLS-enabled channels

A company has hired an assessment team to test the security of the corporate network and employee vigilance. Only the Chief Executive Officer and Chief Operating Officer are aware of this exercise, and very little information has been provided to the assessors. Which of the following is taking place?

• A red-team test

• A white-team test

• A purple-team test

• A blue-team test

A large retail store's network was breached recently. and this news was made public. The Store did not lose any intellectual property, and no customer information was stolen. Although no fines were incurred as a result, the Store lost revenue after the breach. Which of the following is the most likely reason for this issue?

• Employee training

• Leadership changes

• Reputation

• Identity theft

A security analyst reviews web server logs and finds the following string:

• gallerys?file—../../../../../../../etc/passwd

• Which of the following attacks was performed against the web server?

• Directory traversal

• CSRF

• Pass the hash

• SQL injection