CompTIA CompTIA Security+ RC0-501 Questions & Answers

• Question 191:

  A security administrator returning from a short vacation receives an account lock-out message when attempting to log into the computer. After getting the account unlocked the security administrator immediately notices a large amount of

  emails alerts pertaining to several different user accounts being locked out during the past three days. The security administrator uses system logs to determine that the lock-outs were due to a brute force attack on all accounts that has been

  previously logged into that machine.

  Which of the following can be implemented to reduce the likelihood of this attack going undetected?

  A. Password complexity rules

  B. Continuous monitoring

  C. User access reviews

  D. Account lockout policies

  Correct Answer: B

• Question 192:

  A company has a security policy that specifies all endpoint computing devices should be assigned a unique identifier that can be tracked via an inventory management system. Recent changes to airline security regulations have cause many

  executives in the company to travel with mini tablet devices instead of laptops. These tablet devices are difficult to tag and track. An RDP application is used from the tablet to connect into the company network.

  Which of the following should be implemented in order to meet the security policy requirements?

  A. Virtual desktop infrastructure (IDI)

  B. WS-security and geo-fencing

  C. A hardware security module (HSM)

  D. RFID tagging system

  E. MDM software

  F. Security Requirements Traceability Matrix (SRTM)

  Correct Answer: E

• Question 193:

  After a merger between two companies a security analyst has been asked to ensure that the organization's systems are secured against infiltration by any former employees that were terminated during the transition. Which of the following actions are MOST appropriate to harden applications against infiltration by former employees? (Select TWO)

  A. Monitor VPN client access

  B. Reduce failed login out settings

  C. Develop and implement updated access control policies

  D. Review and address invalid login attempts

  E. Increase password complexity requirements

  F. Assess and eliminate inactive accounts

  Correct Answer: CF

• Question 194:

  A new mobile application is being developed in-house. Security reviews did not pick up any major flaws, however vulnerability scanning results show fundamental issues at the very end of the project cycle. Which of the following security activities should also have been performed to discover vulnerabilities earlier in the lifecycle?

  A. Architecture review

  B. Risk assessment

  C. Protocol analysis

  D. Code review

  Correct Answer: D

• Question 195:

  A security administrator is creating a subnet on one of the corporate firewall interfaces to use as a DMZ which is expected to accommodate at most 14 physical hosts. Which of the following subnets would BEST meet the requirements?

  A. 192.168.0.16 255.25.255.248

  B. 192.168.0.16/28

  C. 192.168.1.50 255.255.25.240

  D. 192.168.2.32/27

  Correct Answer: B

• Question 196:

  Which of the following differentiates a collision attack from a rainbow table attack?

  A. A rainbow table attack performs a hash lookup

  B. A rainbow table attack uses the hash as a password

  C. In a collision attack, the hash and the input data are equivalent

  D. In a collision attack, the same input results in different hashes

  Correct Answer: A

• Question 197:

  A help desk is troubleshooting user reports that the corporate website is presenting untrusted certificate errors to employees and customers when they visit the website. Which of the following is the MOST likely cause of this error, provided the certificate has not expired?

  A. The certificate was self signed, and the CA was not imported by employees or customers

  B. The root CA has revoked the certificate of the intermediate CA

  C. The valid period for the certificate has passed, and a new certificate has not been issued

  D. The key escrow server has blocked the certificate from being validated

  Correct Answer: C

• Question 198:

  A security analyst is investigating a suspected security breach and discovers the following in the logs of the potentially compromised server:

  

  Which of the following would be the BEST method for preventing this type of suspected attack in the future?

  A. Implement password expirations

  B. Implement restrictions on shared credentials

  C. Implement account lockout settings

  D. Implement time-of-day restrictions on this server

  Correct Answer: C

• Question 199:

  A security administrator is trying to encrypt communication. For which of the following reasons should administrator take advantage of the Subject Alternative Name (SAM) attribute of a certificate?

  A. It can protect multiple domains

  B. It provides extended site validation

  C. It does not require a trusted certificate authority

  D. It protects unlimited subdomains

  Correct Answer: B

• Question 200:

  A company is developing a new system that will unlock a computer automatically when an authorized user sits in front of it, and then lock the computer when the user leaves. The user does not have to perform any action for this process to occur. Which of the following technologies provides this capability?

  A. Facial recognition

  B. Fingerprint scanner

  C. Motion detector

  D. Smart cards

  Correct Answer: A