CompTIA CompTIA Security+ RC0-501 Questions & Answers

• Question 131:

  A security administrator is developing training for corporate users on basic security principles for personal email accounts. Which of the following should be mentioned as the MOST secure way for password recovery?

  A. Utilizing a single Qfor password recovery

  B. Sending a PIN to a smartphone through text message

  C. Utilizing CAPTCHA to avoid brute force attacks

  D. Use a different e-mail address to recover password

  Correct Answer: B

• Question 132:

  A company researched the root cause of a recent vulnerability in its software. It was determined that the vulnerability was the result of two updates made in the last release. Each update alone would not have resulted in the vulnerability. In order to prevent similar situations in the future, the company should improve which of the following?

  A. Change management procedures

  B. Job rotation policies

  C. Incident response management

  D. Least privilege access controls

  Correct Answer: A

• Question 133:

  Which of the following technologies would be MOST appropriate to utilize when testing a new software patch before a company-wide deployment?

  A. Cloud computing

  B. Virtualization

  C. Redundancy

  D. Application control

  Correct Answer: B

  Virtualization is used to host one or more operating systems in the memory of a single host computer and allows multiple operating systems to run simultaneously on the same hardware, reducing costs. Virtualization offers the filexibility of quickly and easily making backups of entire virtual systems, and quickly recovering the virtual system when errors occur. Furthermore, malicious code compromises of virtual systems rarely affect the host system, which allows for safer testing and experimentation.

• Question 134:

  Phishing emails frequently take advantage of high-profile catastrophes reported in the news. Which of the following principles BEST describes the weakness being explogted?

  A. Intimidation

  B. Scarcity

  C. Authority

  D. Social proof

  Correct Answer: D

• Question 135:

  New magnetic locks were ordered for an entire building. In accordance with company policy, employee safety is the top priority. In case of a fire where electricity is cut, which of the following should be taken into consideration when installing the new locks?

  A. Fail safe

  B. Fault tolerance

  C. Fail secure

  D. Redundancy

  Correct Answer: A

• Question 136:

  Anne, the Chief Executive Officer (CEO), has reported that she is getting multiple telephone calls from someone claiming to be from the helpdesk. The caller is asking to verify her network authentication credentials because her computer is broadcasting across the network. This is MOST likely which of the following types of attacks?

  A. Vishing

  B. Impersonation

  C. Spim

  D. Scareware

  Correct Answer: A

• Question 137:

  An administrator discovers the following log entry on a server:

  Nov 12 2013 00:23:45 httpd[2342]: GET /app2/prod/proc/process.php?input=change;cd%20../../../etc;cat%20shadow

  Which of the following attacks is being attempted?

  A. Command injection

  B. Password attack

  C. Buffer overflow

  D. Cross-site scripting

  Correct Answer: A

• Question 138:

  A security team wants to establish an Incident Response plan. The team has never experienced an incident. Which of the following would BEST help them establish plans and procedures?

  A. Table top exercises

  B. Lessons learned

  C. Escalation procedures

  D. Recovery procedures

  Correct Answer: A

• Question 139:

  Which of the following would verify that a threat does exist and security controls can easily be bypassed without actively testing an application?

  A. Protocol analyzer

  B. Vulnerability scan

  C. Penetration test

  D. Port scanner

  Correct Answer: B

  A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be explogted and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Vulnerability scanning typically refers to the scanning of systems that are connected to the Internet but can also refer to system audits on internal networks that are not connected to the Internet in order to assess the threat of rogue software or malicious employees in an enterprise.

• Question 140:

  A system administrator is configuring a site-to-site VPN tunnel. Which of the following should be configured on the VPN concentrator during the IKE phase?

  A. RIPEMD

  B. ECDHE

  C. Diffie-Hellman

  D. HTTPS

  Correct Answer: C