CompTIA CompTIA Security+ RC0-501 Questions & Answers

• Question 121:

  The chief security officer (CS0) has issued a new policy that requires that all internal websites be configured for HTTPS traffic only. The network administrator has been tasked to update all internal sites without incurring additional costs. Which of the following is the best solution for the network administrator to secure each internal website?

  A. Use certificates signed by the company CA

  B. Use a signing certificate as a wild card certificate

  C. Use certificates signed by a public ca

  D. Use a self-signed certificate on each internal server

  Correct Answer: D

  This is a way to update all internal sites without incurring additional costs? To be a CA (Certificate Authority), you need an infrastructure that consists of considerable operational elements, hardware, software, policy frameworks and practice statements, auditing, security infrastructure and personnel.

• Question 122:

  A security program manager wants to actively test the security posture of a system. The system is not yet in production and has no uptime requirement or active user base. Which of the following methods will produce a report which shows vulnerabilities that were actually explogted?

  A. Peer review

  B. Component testing

  C. Penetration testing

  D. Vulnerability testing

  Correct Answer: C

  A penetration test, or pen test, is an attempt to evaluate the security of an IT infrastructure by safely trying to explogt vulnerabilities.

• Question 123:

  A computer on a company network was infected with a zero-day explogt after an employee accidently opened an email that contained malicious content. The employee recognized the email as malicious and was attempting to delete it, but

  accidently opened it. Which of the following should be done to prevent this scenario from occurring again in the future?

  A. Install host-based firewalls on all computers that have an email client installed

  B. Set the email program default to open messages in plain text

  C. Install end-point protection on all computers that access web email

  D. Create new email spam filters to delete all messages from that sender

  Correct Answer: C

• Question 124:

  A company wants to ensure that the validity of publicly trusted certificates used by its web server can be determined even during an extended internet outage. Which of the following should be implemented?

  A. Recovery agent

  B. Ocsp

  C. Crl

  D. Key escrow

  Correct Answer: B

• Question 125:

  An administrator intends to configure an IPSec solution that provides ESP with integrity protection, but not confidentiality protection. Which of the following AES modes of operation would meet this integrity-only requirement?

  A. HMAC

  B. PCBC

  C. CBC

  D. GCM

  E. CFB

  Correct Answer: A

• Question 126:

  A system administrator needs to implement 802.1x whereby when a user logs into the network, the authentication server communicates to the network switch and assigns the user to the proper VLAN. Which of the following protocols should be used?

  A. RADIUS

  B. Kerberos

  C. LDAP

  D. MSCHAP

  Correct Answer: A

• Question 127:

  Which of the following types of cloud Infrastructures would allow several organizations with similar structures and interests to realize shared storage and resources?

  A. Private

  B. Hybrid

  C. Public

  D. Community

  Correct Answer: D

• Question 128:

  After a user reports stow computer performance, a systems administrator detects a suspicious file, which was installed as part of a freeware software package.

  The systems administrator reviews the output below:

  

  Based on the above information, which of the following types of malware was installed on the user's computer?

  A. RAT

  B. Keylogger

  C. Spyware

  D. Worm

  E. Bot

  Correct Answer: A

• Question 129:

  A company wants to host a publicly available server that performs the following functions:

  Evaluates MX record lookup

  Can perform authenticated requests for A and AAA records Uses RRSIG Which of the following should the company use to fulfill the above requirements? Which of the following should the company use to fulfill the above requirements?

  A. DNSSEC

  B. SFTP

  C. nslookup

  D. dig

  Correct Answer: A

  DNS Security Extensions (DNSSEC) provides, among other things, cryptographic authenticity of responses using Resource Record Signatures (RRSIG) and authenticated denial of existence using Next-Secure (NSEC) and Hashed-NSEC records (NSEC3).

• Question 130:

  A company has a data classification system with definitions for "Private" and public." The company's security policy outlines how data should be protected based on type. The company recently added the data type "Proprietary". Which of the following is the MOST likely reason the company added this data type?

  A. Reduced cost

  B. More searchable data

  C. Better data classification

  D. Expanded authority of the privacy officer

  Correct Answer: C