Question 1

A security administrator is developing controls for creating audit trails and tracking if a PHI data breach is to occur. The administrator has been given the following requirements: All access must be correlated to a user account. All user accounts must be assigned to a single individual. User access to the PHI data must be recorded. Anomalies in PHI data access must be reported. Logs and records cannot be deleted or modified. Which of the following should the administrator implement to meet the above requirements? (Choose three.)

Accepted Answer

- Eliminate shared accounts (A) ensures that each user has a unique account, meeting the requirement that all access must be correlated to a user account.- Implement usage auditing and review (C) allows for recording user access to PHI data, meeting the requirement that user access to the PHI data must be recorded.- Copy logs in real time to a secured WORM drive (E) ensures that logs and records cannot be deleted or modified, meeting the requirement that logs and records cannot be deleted or modified.

Question 2

Malicious traffic from an internal network has been detected on an unauthorized port on an application server. Which of the following network-based security controls should the engineer consider implementing?

Accepted Answer

Access Control Lists (ACLs) can be used to block or allow traffic based on port numbers, which would help in controlling unauthorized traffic on specific ports.

Question 3

A high-security defense installation recently begun utilizing large guard dogs that bark very loudly and excitedly at the slightest provocation. Which of the following types of controls does this BEST describe?

Accepted Answer

The use of large guard dogs that bark loudly serves as a deterrent control by discouraging potential intruders from attempting unauthorized access due to the fear of being detected or attacked.

Question 4

A company's user lockout policy is enabled after five unsuccessful login attempts. The help desk notices a user is repeatedly locked out over the course of a workweek. Upon contacting the user, the help desk discovers the user is on vacation and does not have network access. Which of the following types of attacks are MOST likely occurring? (Select two.)

Accepted Answer

Brute force and dictionary attacks involve repeated login attempts with different passwords, which can trigger account lockouts.

Question 5

When configuring settings in a mandatory access control environment, which of the following specifies the subjects that can access specific data objects?

Accepted Answer

The answer of When configuring settings in a mandatory access...

Question 6

A company has a data classification system with definitions for "Private" and "Public". The company's security policy outlines how data should be protected based on type. The company recently added the data type "Proprietary". Which of the following is the MOST likely reason the company added this data type?

Accepted Answer

The addition of a "Proprietary" data type likely aims to improve data classification by providing a more specific category for sensitive company information that is not meant for public or private classification.

Question 7

An organization's internal auditor discovers that large sums of money have recently been paid to a vendor that management does not recognize. The IT security department is asked to investigate the organizations the organization's ERP system to determine how the accounts payable module has been used to make these vendor payments. The IT security department finds the following security configuration for the accounts payable module: New Vendor Entry - Required Role: Accounts Payable Clerk New Vendor Approval - Required Role: Accounts Payable Clerk Vendor Payment Entry - Required Role: Accounts Payable Clerk Vendor Payment Approval - Required Role: Accounts Payable Manager Which of the following changes to the security configuration of the accounts payable module would BEST mitigate the risk?

Accepted Answer

The answer of An organization's internal auditor discovers that large...

Question 8

A security consultant discovers that an organization is using the PCL protocol to print documents, utilizing the default driver and print settings. Which of the following is the MOST likely risk in this situation?

Accepted Answer

The answer of A security consultant discovers that an organization...

Question 9

Joe, an employee, wants to show his colleagues how much he knows about smartphones. Joe demonstrates a free movie application that he installed from a third party on his corporate smartphone. Joe's colleagues were unable to find the application in the app stores. Which of the following allowed Joe to install the application? (Choose two.)

Accepted Answer

Rooting/jailbreaking allows users to bypass restrictions on a device, enabling the installation of unauthorized apps. Sideloading refers to installing apps from sources other than official app stores.

Question 10

Which of the following encryption methods does PKI typically use to securely protect keys?

Accepted Answer

PKI (Public Key Infrastructure) typically uses asymmetric encryption to securely protect keys, as it involves a pair of keys (public and private) for encryption and decryption.

Question 11

An attacker compromises a public CA and issues unauthorized X.509 certificates for Company.com. In the future, Company.com wants to mitigate the impact of similar incidents. Which of the following would assist Company.com with its goal?

Accepted Answer

Certificate pinning helps mitigate the risk of unauthorized certificates by associating a host with its expected certificate or public key, ensuring that only the legitimate certificate is accepted.

Question 12

A security administrator has found a hash in the environment known to belong to malware. The administrator then finds this file to be in in the preupdate area of the OS, which indicates it was pushed from the central patch system. File: winx86_adobe_flash_upgrade.exe Hash: 99ac28bede43ab869b853ba62c4ea243 The administrator pulls a report from the patch management system with the following output:  Given the above outputs, which of the following MOST likely happened?

Accepted Answer

The answer of A security administrator has found a hash...

Question 13

Which of the following security controls does an iris scanner provide?

Accepted Answer

An iris scanner is a physical security control that uses biometric technology to identify individuals based on the unique patterns in their irises.

Question 14

A department head at a university resigned on the first day of the spring semester. It was subsequently determined that the department head deleted numerous files and directories from the server-based home directory while the campus was closed. Which of the following policies or procedures could have prevented this from occurring?

Accepted Answer

Offboarding procedures ensure that access rights and permissions are revoked when an employee leaves a position, preventing them from making unauthorized changes or deletions.

Question 15

A database backup schedule consists of weekly full backups performed on Saturday at 12:00 a.m. and daily differential backups also performed at 12:00 a.m. If the database is restored on Tuesday afternoon, which of the following is the number of individual backups that would need to be applied to complete the database recovery?

Accepted Answer

The answer of A database backup schedule consists of weekly...

Question 16

Which of the following implements two-factor authentication?

Accepted Answer

Two-factor authentication requires two different types of evidence to verify identity. An ATM requiring both a credit card (something you have) and a PIN (something you know) is an example of this.

Question 17

Ann, a security administrator, has been instructed to perform fuzz-based testing on the company's applications. Which of the following best describes what she will do?

Accepted Answer

Fuzz-based testing involves inputting random or invalid data into an application to identify potential vulnerabilities or faults.

Question 18

A network administrator at a small office wants to simplify the configuration of mobile clients connecting to an encrypted wireless network. Which of the following should be implemented in the administrator does not want to provide the wireless password or he certificate to the employees?

Accepted Answer

Wi-Fi Protected Setup (WPS) allows users to connect to a wireless network without needing to enter a password, simplifying the process for mobile clients.

Question 19

When trying to log onto a company's new ticketing system, some employees receive the following message: Access denied: too many concurrent sessions . The ticketing system was recently installed on a small VM with only the recommended hardware specifications. Which of the following is the MOST likely cause for this error message?

Accepted Answer

The error message "Access denied: too many concurrent sessions" indicates that the system is unable to handle the number of users trying to access it at the same time. This is most likely due to the VM not having enough processing power to handle the load.

Question 20

As part of a new industry regulation, companies are required to utilize secure, standardized OS settings. A technical must ensure the OS settings are hardened. Which of the following is the BEST way to do this?

Accepted Answer

A configuration compliance scanner is specifically designed to check if systems adhere to predefined security configurations and standards, ensuring that OS settings are hardened according to industry regulations.

Exam 15: CompTIA Security+