Security+ Chapters 1-3 Review

1. 1In the CIA Triforce, confidentiality is represented by [blank_start]Ganon[blank_end], Integrity is represented by [blank_start]Zelda[blank_end], and availability is represented by [blank_start]Link[blank_end].

   1. AGanon
   2. BZelda
   3. CLink
   4. DTingle
   5. EEpona
2. 2One of the best ways to ensure confidentiality is to use [blank_start]encryption[blank_end], even though it may cost additional resources.

   1. Aencryption
   2. Ba really quiet voice
   3. Chashes
   4. DRAID
3. 3The implementation of access controls is usually a multi-step process consisting of:
   [blank_start]Identification[blank_end], where a user is associated with a username.
   [blank_start]Authentication[blank_end], where a user must prove themselves with mechanisms such as passwords.
   [blank_start]Authorization[blank_end], where a user is granted or restricted access to resources.

   1. AIdentification
   2. BIdealization
   3. CAuthentication
   4. DAttribution
   5. EAuthorization
   6. FAuditing
4. 4Select all the following options that are methods of providing integrity through hashing.

   1. AMD5
   2. BSHA
   3. CHMAC
   4. DAES
   5. EPKI
   6. FTLS
   7. GCCMP
5. 5Using hashes, you can tell how a message has been modified or altered.

   1. ATrue
   2. BFalse
6. 6Digital signatures provide [blank_start]integrity[blank_end] by showing that something has not been modified. They also provide [blank_start]authentication[blank_end] by confirming the source of something. Finally, they also provide [blank_start]non-repudiation[blank_end], by making it harder for a source to deny it came from them.

   1. Aintegrity
   2. Bconfidentiality
   3. Cavailability
   4. Dresources
   5. Eauthentication
   6. Fauthorization
   7. Gauditing
   8. Hamortization
   9. Inon-repudiation
   10. Jredundancy
   11. KPKI
   12. Lpersistence
7. 7A primary goal of fault tolerance and redundancy is to:

   1. Aremove single points of failure.
   2. Bincrease return on investment.
   3. Chelp implement administrative controls.
   4. Dexponentially increase the number of acronyms used.
8. 8Below is a list of common fault-tolerance redundancy techniques. Match the words below to the key phrases.
   [blank_start]RAID[blank_end] = A type of disk redundancy
   [blank_start]Virtualization[blank_end] = Type of server redundancy
   [blank_start]Load Balancing[blank_end] = Using multiple servers to support a single service
   [blank_start]Hot site[blank_end] = A disaster recovery option that is ready and available 24/7
   [blank_start]Backup[blank_end] = Allows restoration of original data when something is done fucked up
   [blank_start]UPS[blank_end] = Source for alternate power
   [blank_start]HVAC[blank_end] = Reduces outages from heat and environmental issues

   1. ARAID
   2. BVirtualization
   3. CLoad Balancing
   4. DHot site
   5. EBackup
   6. FUPS
   7. GHVAC
   8. HPatching
   9. ISPOF
   10. JCold site
9. 9Which of the following are control *types*?

   1. ATechnical
   2. BAdministrative
   3. CPhysical
   4. DPreventive
   5. EDetective
   6. FCorrective
   7. GDeterrent
   8. HCompensating
10. 10Which of the following are control *goals*?

    1. ATechnical
    2. BAdministratative
    3. CPhysical
    4. DPreventive
    5. EDetective
    6. FCorrective
    7. GDeterrent
    8. HCompensating

11. 11Drag the devices and measures below to the matching control types and goals combination in the following list:
    [blank_start]Firewall[blank_end] = Technical Preventive
    [blank_start]IDS[blank_end] = Technical Detective
    [blank_start]Backups[blank_end] = Technical Corrective
    [blank_start]Awareness and Training[blank_end] = Administrative Preventive
    [blank_start]Strict security policy[blank_end] = Administrative Deterrent
    [blank_start]Cable locks[blank_end] = Physical Deterrent
    [blank_start]Fire extinguisher[blank_end] = Physical Corrective
    

    1. AFirewall
    2. BIDS
    3. CBackups
    4. DAwareness and Training
    5. EStrict security policy
    6. FCable locks
    7. GFire extinguisher
12. 12Below are diagrams of two different types of hypervisors. Drag the correct identifier to each diagram.

    

    1. AType I
    2. BType II
    3. CType O-
    4. DType A
    5. EType B
13. 13In a non-persistent virtual desktop, users can make changes to their desktop and they will revert back to a known state when they log off.

    1. ATrue
    2. BFalse
14. 14Virtualization is not without it's risks. [blank_start]VM sprawl[blank_end] occurs when an organization has many virtual machines that aren't managed properly. [blank_start]VM escape[blank_end] is an attack which allows an attacker to access the host system from within the virtual system. Loss of confidentiality can also occur, as virtual machines are simply [blank_start]files[blank_end] and thus easy to copy or steal.

    1. AVM sprawl
    2. BVM escape
    3. CVM nirvana
    4. DVM POODLE
    5. EVM escape
    6. FVM sprawl
    7. GVM nirvana
    8. HVM POODLE
    9. Ifiles
    10. Jsnapshots
    11. Kmarvelous
    12. Lpersistent
15. 15Drag the correct command to its platform and use.
    [blank_start]ping[blank_end] = Windows and Linux, tests connectivity.
    [blank_start]ipconfig[blank_end] = Windows, shows the TCP/IP configuration.
    [blank_start]ifconfig[blank_end] = Linux, shows TCP/IP configuration. Deprecated.
    [blank_start]ip[blank_end] = Linux, shows TCP/IP configuration. Newer.
    [blank_start]netstat[blank_end] = Windows and Linux, shows statistics for TCP/IP protocols on a system.
    [blank_start]tracert[blank_end] = Windows, lists the hops between two systems.
    [blank_start]traceroute[blank_end] = Linux, lists the hops between two systems.
    [blank_start]arp[blank_end] = Linux and Windows, lists known MAC address and IP pairings.

    1. Aping
    2. Bipconfig
    3. Cifconfig
    4. Dip
    5. Enetstat
    6. Ftracert
    7. Gtraceroute
    8. Harp
16. 16AAA works with identification to provide comprehensive access management. What are the three A's of AAA?

    1. Aauthentication
    2. Bauthorization
    3. Caccounting
    4. Davailability
    5. Eadministration
    6. Faccess
    7. Gacronym
    8. Haptitude
17. 17Drag the correct authentication term to the appropriate factor in the list below:
    Something you know: [blank_start]password[blank_end]
    Something you have: [blank_start]smart card[blank_end]
    Something you are: [blank_start]fingerprint[blank_end]
    Somewhere you are: [blank_start]geolocation[blank_end]
    Something you do: [blank_start]handwriting[blank_end]

    1. Apassword
    2. Bsmart card
    3. Cfingerprint
    4. Dgeolocation
    5. Ehandwriting
18. 18Overly complex requirements for passwords equates to a more secure password.

    1. ATrue
    2. BFalse
19. 19[blank_start]L0rdSh@xXru13z[blank_end] is a good password because it [blank_start]contains all four character types[blank_end], is [blank_start]at least 14 characters[blank_end], and [blank_start]has meaning to the user[blank_end].

    1. AL0rdSh@xXru13z
    2. BLordShaxxRules
    3. Cshaxx<3
    4. DjU@J^8Y2h)aE8.f
    5. E123456
    6. Fcontains all four character types
    7. Gcontains at least two character types
    8. Hcontains the name of someone awesome
    9. Icontains leet speak
    10. Jat least 14 characters
    11. Kat least 6 characters
    12. Lless than 20 characters
    13. M94^14 characters
    14. Nhas meaning to the user
    15. Owas chosen randomly
    16. Pis the combination to my luggage
    17. Qrules almost as much as Lord Shaxx
    18. Ris impossible to memorize
20. 20You're the security manager for a large company. An upper level manager comes in and says they can't remember their password. Your company does not have a way for users to reset their own passwords, and it must be done manually.
    The best course of action is:

    1. Areset the manager's password to a temporary password and force them to change it the first time they log in.
    2. Breset the manager's password to a password that they write down for you on a slip of paper that you then destroy.
    3. Ctell the manager that they're out of luck and they'll have to wait until they hire someone that cares to manage their security.
    4. Dreset the manager's password to something simple and request that they change it as soon as possible.
21. 21Using Microsoft's [blank_start]Active Directory Domain Services[blank_end] server role, you can attach [blank_start]Group Policy Objects[blank_end] to directory [blank_start]Organizational Units[blank_end] to enforce things like password policies or settings for users and computers.

    1. AActive Directory Domain Services
    2. BInternet Information Services
    3. CRADIUS
    4. DGroup Policy Objects
    5. EPublic Key Infrastructure
    6. FOrganizational Units
    7. GCommon Names
    8. HDomain Containers
22. 22Which of the following can you set in the Password Policy when using Group Policy Objects?

    1. AMaximum password age
    2. BMaximum password length
    3. CPassword must meet complexity requirements
    4. DPassword must be random
    5. EStore passwords using reversible encryption
    6. FRequire every password be unique
23. 23A [blank_start]smart card[blank_end] is a generic term for a credit card-sized card that has an embedded microchip and a certificate. The U.S. Department of Defense uses a specialized card called a [blank_start]CAC[blank_end], which also includes a picture of the user and other readable information. Similarly, many federal agencies use a specialized card called a [blank_start]PIV[blank_end], which also includes photo identification and provides confidentiality, integrity, authentication, and non-repudiation for the users.

    1. Asmart card
    2. BPKI
    3. CCAC
    4. DDAC
    5. EPIV
    6. FPII
24. 24Your company wants to implement dual-factor authentication using one-time password devices. They're concerned that users may be able to save tokens for later use, and want to restrict them so that they are only viable for a certain amount of time. What system should be considered?

    1. AHOTP
    2. BTOTP
    3. CPPTP
    4. DHMAC
    5. EJSMN
25. 25Label the requested points on the graph representing biometric errors.

    

    1. ACER
    2. BDER
    3. CFAR
    4. DRAR
    5. EFRR
    6. FBRR
26. 26What are some reasons you would not use retinal scanning for biometric authentication?

    1. AThe camera pointing at the retina will steal your soul.
    2. BIt requires physical contact with the scanner.
    3. CIt is not very accurate.
    4. DIt can show that you're diabetic.
    5. EIf incorrectly calibrated, it can cause blindness.
27. 27To use a new Fire Emblem Go app (where you can recruit house members in the wild and make them battle for you), you must register your fingerprint to unlock the app. The app then requires that you enter a PIN code. The app will then show you your current location and what house members are close by. House members you have recruited can be entertained at tea time by making particular gestures on the screen. How many factors of authentication are in use?

    1. A0 -- it's a fake app
    2. B1
    3. C2
    4. D3
    5. E4
    6. F5
    7. G94^14
28. 28What are the key requirements for Kerberos (pronounced care-BEAR-ohs) to function properly?

    1. AA method of issuing tickets for authentication.
    2. BTime synchronization.
    3. CA database of subjects or users.
    4. DA secure password policy.
    5. ECertificates issued using Public Key Infrastructure.
    6. FDiscretionary access control.
29. 29NTLM uses an MD4 hash and is still recommended for use today.

    1. ATrue
    2. BFalse
30. 30Correctly build the LDAP distinguished name for Geralt of Rivia on the ROACH AD DS Server:
    [blank_start]CN=Geralt of Rivia[blank_end],[blank_start]CN=Users[blank_end],[blank_start]DC=rivia,DC=test[blank_end]

    1. ACN=Geralt of Rivia
    2. BCN=Cirilla Fiona Elen Riannon
    3. CCN=Users
    4. DCN=Roach
    5. EDC=rivia,DC=test
    6. FOU=Toss a coin to your witcher
31. 31What are some true statements about LDAP?

    1. AIt stands for Leightweight Directory Access Protocol.
    2. BMicrosoft Active Directory is based on it.
    3. CIt is based on the Z.5000 standard.
    4. DWhen secured, we refer to it as SLDAP.
    5. EIt requires time synchronization to function properly.
    6. FIt provides a database of objects such as users and computers.
32. 32Using the provided diagram, choose True statements below.

    

    1. AUser Geralt can log in to the computer in the "bear" subdomain.
    2. BGeralt needs two accounts to use resources, one in the "bear" subdomain and one in the "wolf" subdomain.
    3. CThe diagram shows a network that supports SSO with transitive trust relationships.
    4. DThere is a direct trust between the "bear" and the "wolf" subdomains.
33. 33SAML is an [blank_start]XML[blank_end]-based standard used to exchange authentication and authorization information between different parties. SAML provides [blank_start]SSO[blank_end] for web-based applications.

    1. AXML
    2. BHTML
    3. CCSS
    4. DSSO
    5. ELDAP
    6. FJSMN
34. 34Select the AAA services below that provide SSO.

    1. AKerberos
    2. BNTP
    3. CSAML
    4. DXML
    5. EOAuth
    6. FGPO
35. 35[blank_start]Least privilege[blank_end] specifies that individuals or processes are granted only those rights and permissions needed to perform their assigned tasks or functions. [blank_start]Need to know[blank_end] is similar, in that users are granted access only to the data and information that is required for their job.

    1. ALeast privilege
    2. BMost privilege
    3. CDual accounts
    4. DNeed to know
    5. EFederation
    6. FNeed to privilege
36. 36Drag the type of account to its description:
    
    [blank_start]End User[blank_end] - Typical accounts for typical users. Created by administrators and assigned privileges as required by their responsibilites.
    [blank_start]Privileged Accounts[blank_end] - Has additional rights than what a typical user has. For example, may have admin control over their local computer.
    [blank_start]Guest Accounts[blank_end] - Provide limited access to a computer without creating a new account. Typically disabled.
    [blank_start]Service Accounts[blank_end] - An account for when an application needs to have rights or privileges to local files or resources.

    1. AEnd User
    2. BPrivileged Accounts
    3. CGuest Accounts
    4. DService Accounts
    5. EGod Mode
37. 37What is one method of preventing privilege escalation attacks?

    1. ARequiring administrators to use two accounts, a privileged account, and an end-user account.
    2. BAllows administrators to use shared accounts to ease the burden of account administration.
    3. CImplement a standard naming convention for user accounts.
    4. DDelete accounts when they are no longer needed.
38. 38When an employee is terminated, their account should immediately be deleted to free up space and resources.

    1. ATrue
    2. BFalse
39. 39Select true statements about the provided screenshot.

    

    1. AThis is a screenshot of an account with time restrictions.
    2. BThis is a screenshot of an account with location-based policies.
    3. CGeralt can't log in on the weekend.
    4. DAll witchers in the wolf school can log in on the weekday.
40. 40What type of access control model is shown?

    

    1. ARole-based access control
    2. BRule-based access control
    3. CDiscretionary access control
    4. DMandatory access control
    5. EAttribute-based access control
41. 41What type of access control is shown?

    

    1. ARole-based access control
    2. BRule-based access control
    3. CDiscretionary access control
    4. DMandatory access control
    5. EAttribute-based access control
42. 42What type of access control is shown?

    

    1. ARole-based access control
    2. BRule-based access control
    3. CDiscretionary access control
    4. DMandatory access control
    5. EAttirbute-based access control
43. 43What type of access control is shown?

    

    1. ARole-based access control
    2. BRule-based access control
    3. CDiscretionary access control
    4. DMandatory access control
    5. EAttribute-based access control
44. 44When using encryption, [blank_start]SSL[blank_end] has been compromised by a serious vulnerability known as the [blank_start]POODLE[blank_end] attack. Because of this, it is no longer recommended for use, and it's replacement, [blank_start]TLS[blank_end], should be used instead.

    1. ASSL
    2. BPOODLE
    3. CTLS
    4. DIPsec
    5. EBULLDOG
    6. FSSH
45. 45Match the service to the port:
    SSH - TCP [blank_start]22[blank_end]
    SMTP - TCP [blank_start]25[blank_end]
    POP3 - TCP [blank_start]110[blank_end]
    IMAP4 - TCP [blank_start]143[blank_end]
    HTTP - TCP [blank_start]80[blank_end]
    HTTPS - TCP [blank_start]443[blank_end]
    RDP - TCP/UDP [blank_start]3389[blank_end]
    DNS - UDP [blank_start]53[blank_end]

    1. A22
    2. B25
    3. C110
    4. D143
    5. E80
    6. F443
    7. G3389
    8. H53
46. 46SFTP uses [blank_start]SSH[blank_end] to transmit files, while FTPS uses [blank_start]FTP and TLS[blank_end].

    1. ASSH
    2. Bmagic
    3. CFTP and TLS
    4. DIPsec
47. 47In a DNS zone, IPv4 have [blank_start]A[blank_end] records for address, while IPv6 uses [blank_start]AAAA[blank_end] records.

    1. AA
    2. BSOA
    3. CAAAA
    4. DMX
48. 48Which of the following is one of the primary methods of preventing a DNS poisoning attack?

    1. ADNSSEC
    2. BDNS antivenom
    3. Creverse proxy
    4. Dnslookup
    5. Esetting a low TTL
49. 49Within IPsec, ESP and AH use protocol numbers, and IKE uses a UDP port.

    1. ATrue
    2. BFalse
50. 50You are trying to go the secure website "amazingsite.com", but it is running it's secured web server on port 8443, instead of the usual port 443. What *full* URL would you type to access the site?
    
    [blank_start]https://amazingsite.com:8443[blank_end]

    1. Ahttps://amazingsite.com:8443
51. 51Which of the following are typically true of a network switch?

    1. AIt keeps a cache of MAC addresses
    2. BIt always sends unicast traffic to all of its ports
    3. CIt is considered a Layer 2 device
    4. DIt can switch traffic based on Layer 3 port and protocol
    5. EIt can limit devices on a port by using port security
    6. FThere is no way to prevent switch looping problems
52. 52Loop protection is an important service that is enabled by default on most modern switches. Select methods of loop protection.

    1. ASTP
    2. BRSTP
    3. CRJ-45
    4. DMAC
    5. ESSL
53. 53Switches have several ways to protect themselves from MAC flood attacks. Select valid methods below.

    1. ALimit the amount of memory to store MAC address per port
    2. BUse SNMP traps for alerts of flood attacks
    3. CRestrict the number of MACs that can be associated per port using port security
    4. DEnable Spanning Tree Protocol to prevent MAC flooding
    5. EConfigure VLANs to isolate MAC flood attacks
    6. FStack multiple switches to increase the memory pool
    7. GDeploy MAC flood sandbags
54. 54A router connects multiple network segments together into a single network.

    1. ATrue
    2. BFalse
55. 55You are configuring a router and need to add a rule to the ACL to allow all traffic from the management address of 192.168.0.2 to the network 192.168.1.0/24

    1. Apermit ip host 192.168.0.2 192.168.1.0 0.0.0.255
    2. Bdeny ip host 192.168.0.2 192.168.1.0 0.0.0.255
    3. Cpermit tcp host 192.168.0.2 192.168.1.0 0.0.0.255
    4. Dpermit ip any any
    5. Epermit ip 192.168.1.0 0.0.0.255 host 192.168.0.2
56. 56A [blank_start]host-based firewall[blank_end] provides protection for individual servers or workstations, whereas a [blank_start]network-based firewall[blank_end] provides protection for the network.

    1. Ahost-based firewall
    2. Bnetwork bridge
    3. Cnetwork-based firewall
    4. Dsecurity guard
57. 57Build a firewall ACL rule to allow traffic from network 10.0.0.0/8 to the HTTPS server on host address 192.168.1.2.
    
    [blank_start]permit[blank_end] [blank_start]tcp[blank_end] [blank_start]10.0.0.0 0.0.0.255[blank_end] [blank_start]host 192.168.1.2[blank_end] [blank_start]eq 443[blank_end]

    1. Apermit
    2. Bdeny
    3. Ctcp
    4. Dudp
    5. Eip
    6. F10.0.0.0 0.255.255.255
    7. G192.168.1.0 0.0.0.255
    8. Hhost 192.168.1.2
    9. Iany
    10. Jhost 192.168.1.2
    11. K10.0.0.0 0.255.255.255
    12. Lany
    13. M192.168.1.0 0.0.0.255
    14. Neq 443
    15. Oeq 80
    16. Peq any
    17. Qeq www
    18. Ricmp
58. 58If you need to protect traffic on a network from TCP session attacks and verify the context of the three-way handshake, you should be using a [blank_start]stateful[blank_end] firewall.

    1. Astateful
    2. Bstateless
    3. Chost-based
    4. Dweb application
    5. Eexpensive
59. 59Drag the type of device to the correct description.
    
    [blank_start]Switch[blank_end] - learns MAC addresses of computers that are connected to it and allows them to communicate directly to each other, operating at Layer 2
    [blank_start]Router[blank_end] - connects multiple network segments together into a single network and sends traffic between segments based on Layer 3 information
    [blank_start]Bridge[blank_end] - also connects multiple network segments together in a single network, but operates at Layer 2 using MAC addresses
    [blank_start]Firewall[blank_end] - filters incoming and outgoing traffic for hosts or networks, operating on Layer 4 information
    
    

    1. ASwitch
    2. BHub
    3. CRouter
    4. DIDS
    5. EBridge
    6. FProxy
    7. GFirewall
    8. HGuard dog
60. 60Label the network diagram provided.

    

    1. ADMZ
    2. BInternet
    3. CBorder Firewall
    4. DIntranet Firewall
    5. EWeb Server
    6. FLAN
    7. GKhrystal's Gaseous Emissions
    8. HBurning Stack of Bricks
    9. IEarth Orbiting a Computer
61. 61You have a medium-sized network with several workstations using private network addresses. You need to allow these workstations access to the Internet using a single public Internet address. What should be implemented on the border router?

    1. APort Address Translation
    2. BStatic Network Address Translation
    3. CDynamic Network Address Translation
    4. DA Hope and a Prayer
    5. EVirtual Private Networking
62. 62You need to implement isolation of VoIP traffic from normal workstation traffic on a business network. What's an easy way to do this with Layer 3 capable switches?

    1. AConfigure separate VLANs for the VoIP devices and workstations
    2. BConfigure the switch as an RTP proxy
    3. CConfigure an ACL on the switch to deny the workstation traffic
    4. DConfigure the VoIP devices to use WLANs
63. 63Drag the correct proxy type to its description:
    
    [blank_start]Transparent Proxy[blank_end] - Accepts and forwards request without modifying them, providing caching.
    [blank_start]Nontransparent Proxy[blank_end] - Can modify and filter requests, restricting what users can access.
    [blank_start]Reverse Proxy[blank_end] - Accepts requests from the Internet, and forwards the request to the internal server.
    [blank_start]Application Proxy[blank_end] - Used for specific applications to accept requests and forward them to an appropriate server, typically using an API.

    1. ATransparent Proxy
    2. BNontransparent Proxy
    3. CReverse Proxy
    4. DApplication Proxy
64. 64A UTM appliance typically combines multiple security controls into a single appliance. What are some of the capabilities of a UTM device?

    1. AURL filtering
    2. BMalware inspection
    3. CDDoS mitigation
    4. DEMP hardening
    5. EPatch management
    6. FTOTP passwords
    7. GBiometric scanning
65. 65What protocol can be used to securely manage network devices?

    1. ASNMP
    2. BSNMPv3
    3. CTCP/IP
    4. DLDAPS
    5. ELDAP
    6. FRSTP

Description

12th grade Computer Science Quiz on Security+ Chapters 1-3 Review, created by Adam Yearout on 20/02/2020.

Author

Adam Yearout

Language

English

Views

10

Tags

computer science12th grade

Rating

No ratings yet

Rate this quiz

Rate this quiz

More on CompTIA Security+ Exam Domains and Terminology