Comptia Sec plus part 3

A Chief Information Security Officer (CISO) has instructed the information assurance staff to act upon a fast-spreading virus. Which of the following steps in the incident response process should be taken NEXT?

• Identification

• Eradication

• Escalation

• Containment

An incident response analyst in a corporate security operations center receives a phone call from an SOC analyst. The SOC analyst explains the help desk recently reimaged a workstation that was suspected of being infected with an unknown type of malware; however, even after reimaging, the host continued to generate SIEM alerts. Which of the following types of malware is MOST likely responsible for producing the SIEM alerts?

• Ransomware

• Logic bomb

• Rootkit

• Adware

A security analyst is performing a manual audit of captured data from a packet analyzer. The analyst looks for base64 encoded strings and applies the filter http.authbasic. Which of the following BEST describes what the analyst is looking for?

• Unauthorized software

• Unencrypted credentials

• SSL certificate issues

• Authentication tokens

Which of the following BEST explains why a development environment should have the same database server secure baseline that exists in production even if there is no PII in the database?

• Without the same configuration in both development and production, there are no assurances that changes made in development will have the same effect in production.

• Attackers can extract sensitive, personal information from lower development environment databases just as easily as they can from production databases

• Databases are unique in their need to have secure configurations applied in all environments because they are attacked more often.

• Laws stipulate that databases with the ability to store personal information must be secured regardless of the environment or if they actually have PII.

An organization wants to deliver streaming audio and video from its home office to remote locations all over the world. It wants the stream to be delivered securely and protected from intercept and replay attacks. Which of the following protocols is BEST suited for this purpose?

• SSH

• SIP

• S/MIME

• SRTP

Which of the following is being used when a malicious actor searches various social media websites to find information about a company's systems administrators and help desk staff?

• Passive reconnaissance

• Initial exploitation

• Vulnerability scanning

• Social engineering

A security engineer is looking to purchase a fingerprint scanner to improve the security of a datacenter. Which of the following scanner characteristics is the MOST critical to successful implementation?

• Low false rejection rate

• High false rejection rate

• High false acceptance rate

• Low crossover error rate

A company has migrated to two-factor authentication for accessing the corporate network, VPN, and SSO. Several legacy applications cannot support multifactor authentication and must continue to use usernames and passwords. Which of the following should be implemented to ensure the legacy applications are as secure as possible while ensuring functionality? (Select Two)

• Password reuse restrictions

• Password complexity requirements

• Password recovery

• Account disablement

A company is planning to build an internal website that allows for access to outside contractors and partners. A majority of the content will only be available to internal employees with the option to share. Which of the following concepts is MOST appropriate?

• VPN

• Proxy

• DMZ

• Extranet

An organization runs applications in an environment where network and computing resources are restricted while the applications are being tested. This is an example of:

• a DMZ

• a VLAN

• an SDLC

• a sandbox