Comptia Sec+ Practice 3

A luxury hotel is planning to install access control vestibules at entrances to its VIP guest floors for enhanced security. The hotel wants the vestibules to provide effective security without compromising guest convenience. Which TWO of the following features should be included in the access control vestibules to meet these requirements? (SELECT TWO)

A financial consulting firm has recently implemented a CYOD policy, providing its employees with a choice of laptops and tablets for their work. The firm is particularly concerned about protecting sensitive financial data and maintaining regulatory compliance. Which TWO of the following security measures should be prioritized to address these concerns in the CYOD environment? (SELECT TWO)

An educational institution uses a legacy student information system that lacks modern security features. The IT department proposes an upgrade, but stakeholders are hesitant due to the potential learning curve and integration challenges. As a result, the upgrade is postponed, and later a security breach compromises sensitive student data. What lesson can be learned about legacy applications and change management from this scenario?

A retail company experiences an unexpected data breach involving customer payment information. The IT manager decides to conduct an ad hoc risk assessment to understand the breach’s impact and prevent future incidents. What should the IT manager prioritize in this assessment? (SELECT TWO)

To enhance the security of Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks, which two of the following practices should be prioritized? (SELECT TWO)

A healthcare provider manages large volumes of sensitive patient health records and needs to ensure the data is securely protected in various states. Which TWO of the following encryption strategies should the provider implement to comprehensively secure patient health records? (SELECT TWO)

A large corporation recently experienced a network breach where attackers exploited vulnerabilities in the Simple Mail Transfer Protocol (SMTP) service running on their mail server. As part of the response, the security team decides to review and update the firewall settings related to ports and protocols. Considering the need to maintain email functionality while enhancing security, which of the following firewall modifications would be most effective?

A small business adopts a cloud-based password manager to improve security and manage passwords more effectively. After implementation, the business owner is concerned about the security of storing all passwords in one place. What feature should the business owner look for in a password manager to alleviate this concern?

A web application in a financial organization is experiencing slow response times. Analysis reveals an unusual pattern of database queries being executed, including several that involve large data extractions. What is the MOST likely security concern indicated by this pattern, and what should be the initial response?

A company’s receptionist receives a call from an individual claiming to be from the IT department, stating they need remote access to update software on the company’s server. The caller provides specific technical details and sounds professional, but the receptionist has not been notified of any scheduled updates. In the context of social engineering, what is the appropriate action for the receptionist to take in this situation?

A healthcare organization is enhancing its network architecture to support its critical online services. The IT team is planning to deploy a load balancer. Which of the following is an important consideration when configuring the load balancer to ensure high availability and security for the organization’s services?

InfoGuard Corp. conducts a vulnerability analysis and identifies several vulnerabilities with varying exposure factors. The vulnerabilities include an unpatched software vulnerability (EF 60%), weak passwords used by employees (EF 40%), and a misconfigured firewall (EF 70%). To effectively manage these vulnerabilities based on their exposure factors, which TWO of the following actions should InfoGuard Corp. prioritize? (SELECT TWO)

Upon accessing the security dashboard, a system administrator observes alerts indicating multiple instances of policy violations related to unauthorized software installations on employee workstations. To address these violations and improve overall security compliance, which of the following actions should be taken? (SELECT TWO)

A financial services company is integrating Secure Access Service Edge (SASE) into its network infrastructure to modernize security and networking capabilities. The CISO is considering various components and features that are essential to maximize the effectiveness of SASE. Which TWO of the following elements should be prioritized in the SASE implementation for optimal security and performance? (SELECT TWO)

To enhance an organization’s defenses against privilege escalation attacks, which TWO of the following strategies should be prioritized? (SELECT TWO)

An IT manager at DataCorp is implementing a new role-based access control (RBAC) system. The manager needs to ensure that permission assignments align with security best practices and organizational needs. Which TWO of the following actions should the manager take to achieve this goal? (SELECT TWO)

During a routine OSINT gathering exercise, a cybersecurity team at TechGuard Inc. discovers a leaked database containing login credentials that match their company’s email domain. What is the most effective initial action for the team to mitigate the potential risk posed by this exposure?

A large enterprise is reviewing its security policies for critical systems, including firewalls, IDSs, and access control systems. The IT security team needs to decide which systems should be configured to fail-open and which should fail-closed, based on the potential impact on security and operations. Considering the balance between maintaining security and ensuring business continuity, which TWO of the following systems should be configured to fail-closed? (SELECT TWO)

A smart home technology company provides a range of IoT devices, including smart thermostats, security cameras, and lighting systems. These devices are connected to the internet and can be controlled remotely by homeowners. Given the recent rise in IoT-targeted cyberattacks, what should be the company’s FIRST step in hardening these smart home devices against potential security breaches?

A university decides to implement application allow lists on its administrative computers to improve cybersecurity. Which TWO of the following outcomes are most likely to be achieved through this implementation? (SELECT TWO)

A major online retailer experienced a Distributed Denial of Service (DDoS) attack during a significant sales event, leading to the temporary shutdown of its website. The attack did not result in any data breach or ransom demands but caused substantial financial loss due to interrupted sales. What type of threat actor is most likely responsible for this incident?

A company’s security team discovers that one of their critical applications was compromised through a malicious update. The team is tasked with implementing measures to protect against similar incidents in the future. Which of the following measures should be included in their security strategy? (SELECT TWO)

In an organization, the IT department sets up an automated attestation process for reviewing and confirming user access rights. However, a subsequent security review finds that several users still have access rights that they should not possess. What is the MOST likely reason for the failure of the automated attestation process?

A large corporation has implemented automated guard rails in its cloud environment to enforce security policies. Despite this, a recent audit revealed that several cloud storage buckets containing sensitive data were publicly accessible. Which of the following is the MOST likely reason for this security lapse?

A multinational corporation with extensive research and development in cutting-edge technology experienced two separate espionage incidents. In the first incident, trade secrets and proprietary research were stolen and traced to a competitor. In the second incident, confidential communication between top executives was intercepted, revealing strategic business plans. The attack methods were discreet and focused on data collection. Which TWO of the following motivations are most likely behind these espionage incidents? (SELECT TWO)

A healthcare provider is planning a maintenance window to update its patient record system with enhanced security measures. To ensure the update is successful and minimizes impact on operations, which TWO of the following actions should be prioritized in planning the maintenance window? (SELECT TWO)