Comptia Security+ Exam Practice 5

Match the system log entries to the to the corresponding type of possible malicious activity.

An application owner reports suspicious activity on an internal financial application from various internal users within the past 14 days. A security analyst notices the following:
* Financial transactions were occurring during irregular time frames and outside of business hours by unauthorized users.
* Internal users in question were changing their passwords frequently during that time period.
* A jump box that several domain administrator users use to connect to remote devices was recently compromised.
* The authentication method used in the environment is NTLM.
Which of the following types of attacks is MOST likely being used to gain unauthorized access?

A help desk technician receives a phone call from someone claiming to be a part of the organization’s cybersecurity incident response team. The caller asks the technician to verify the network’s internal firewall IP Address. Which of the following is the technician’s BEST course of action?

A multinational corporation is implementing a new internal communication system that includes email, chat, and file-sharing capabilities. The corporation wants to ensure that all communications and data transfers within this system are secure and confidential. What cryptographic protocol should be the focus of the security implementation to achieve end-to-end encryption within the communication system?

A company wants to modify its current backup strategy to minimize the number of backups that would need to be restored in case of data loss. Which of the following would be the BEST backup strategy to implement?

You work for a large healthcare company in the US that recently had a breach of over 52,000 medical records. The records contained securely encrypted payment data and plaintext patient and doctor names and were intercepted through an insecure Wi-Fi connection. The board of directors initially chose not to disclose the breach to regulators or the public. However, after a third-party audit uncovered the breach, the board reported the incident according to the relevant laws, and also notified the media and affected patients.

What is the MOST likely outcome in this scenario?

A company’s network security system detects an unusual increase in outbound traffic. Further investigation reveals that a recently opened PDF document contained a hidden script which, when activated, began exfiltrating sensitive data from the user’s computer. The PDF was received as an email attachment from a seemingly legitimate source. This incident is indicative of which type of file-based threat?

A company recently upgraded its authentication infrastructure and now has more computing power. Which of the following should the company consider using to ensure user credentials are being transmitted and stored more securely?

Match the term for an element of effective security governance with its brief description.

healthcare organization experienced a ransomware attack that encrypted critical patient data and disabled key systems. The organization had a disaster recovery plan in place, but recovery efforts were slower than expected, leading to prolonged service disruptions. In revising their disaster recovery plan, what should be the organization’s PRIMARY focus to improve response times in future incidents?

A network analyst is setting up a wireless access point for a home office in a remote, rural location. The requirement is that users need to connect to the access point securely but do not want to have to remember passwords Which of the following should the network analyst enable to meet the requirement?

Match the term for an element of effective security governance with its brief description.

A network administrator at a medium-sized company notices an unusual increase in wireless network traffic. Further investigation reveals that an unauthorized access point (AP) is operating on the same channel as the company’s wireless network. This AP is suspected of being used for a “man-in-the-middle” attack. What should be the administrator’s FIRST step in mitigating this security threat?

A Chief Security Officer is looking for a solution that can provide increased scalability and flexibility for back-end infrastructure, allowing it to be updated and modified without disruption to services. The security architect would like the solution selected to reduce the back-end server resources and has highlighted that session persistence is not important for the applications running on the back-end servers. Which of the following would BEST meet the requirements?

The _______ plan includes the Business Impact Analysis and the Disaster Recovery Plan, Risk Management process and Contingency Plan.

During a routine security assessment, an IT technician discovers that a company’s file server has a rootkit that grants unauthorized access to confidential files. After removing the rootkit, what should be the technician’s NEXT step to secure the server against similar future threats?

____________ is a specific approach within the broader category of data anonymization. It involves creating a structurally similar version of existing real-world data that obfuscates the original data values while retaining the data’s usability for purposes like software testing and development.

The ___________  is created to ensure that your company is able to resume operation in a timely manner.

This data source helps to identity weaknesses in the network or systems and helps proactively address security flaws before they can be exploited by attackers.

A forensics investigator is examining a number of unauthorized payments that were reported on the company’s website. Some unusual log entries show users received an email for an unwanted mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be:
<a href=”https://www.company.com/payto.do?routing=00001111&acct=22223334&amount=250″>Click here to unsubscribe</a>

Which of the following will the forensics investigator MOST likely determine has occurred?