CompTIA SY0-201 Security+ - 2008

You work as the security administrator at TestKing.com. One morning you discover thata user named Mia Hamm has used her user account to log on to a network server. Mia has then executed a program and been able to perform operations which only a network administrator or security administrator should be able to. What type of attack has occurred?

Which of the following attacks are being referred to if someone is accessing your e-mail server and sending inflammatory information to others?

Which security management model works on the basis that all new privilege assignments and privilege assignment modifications made to existing privileges are performed through one governing group?

What does the MAC access control model use to identify the users who have permissions to a resource?

An attack in which a user logs into a server with his user account, executes a program and then performed activities only available to an administrator is an example of which of thefollowing?

You work as the security administrator at TestKing.com. One morning you discover that a user named Mia Hamm has used her user account to log on to a network server. Mia has then executed a program and been able to perform operations which only a network administrator or security administrator should be able to. What type of attack has occurred?

Choose the statement which best defines the characteristics of a computer virus.

Which description is correct about an application or string of code that could not automatically spread from one system to another but is designed to spread from file to file?

To which of the following viruses does the characteristic when the virus may attempt to infect your boot sector, infect all of your executable files, and destroy your applications files form part of?

To which of the following viruses does the characteristic when the virus may attempt to infect your boot sector, infect all of your executable files, and destroy your applications files form part of?

Which of the following should be scanned for viruses?

Which of the following would be considered a detrimental effect of a virus hoax? (Select TWO).

To which of the following viruses does the characteristic when the virus attacks your system, display a message on your computer, and delete files on your system form part of?

Which of the following definitions should BEST suit the functions of an e-mail server?

By which means do most network bound viruses spread?

To which of the following viruses does the characteristic when the virus will attempt to avoid detection by masking itself from applications. It may attach itself to the boot sector of the hard drive, form part of?

What is the main reason why e-mail security concepts do not work?

Which of the following definitions should BEST suit the functions of an e-mail server?

To which of the following viruses does the characteristic when the virus will attempt toavoid detection by masking itself from applications. It may attach itself to the boot sector of the hard drive, form part of?

What is a piece of malicious code that has no productive purpose but can replicate itself and exist only to damage computer systems or create further vulnerabilities called?

Which of the following is used to describe an autonomous agent that copies itself into one or more host programs, then propagates when the host is run?

What is a program that can infect other programs by modifying them to include a versionof it called?

What type of virus can hides itself by intercepting disk access requests?

By which means do most network bound viruses spread?

Which of the following types of malicious software travels across computer networks without requiring a user to distribute the software?

Which of the following best describes the term cold site?

When connecting a network to the Internet, which of the following will ensure that theinternal network IP (Internet Protocol) addresses are not compromised?

Of the intrusion detection capabilities listed below, which is FALSE for a network based IDS system?

Which of the following best describes a DMZ (Demilitarized Zone)?

Which of the rules listed here are FALSE for implementing effective password policies for users?

Which method can be used to correct a single security issue on a workstation?

From the listing of attacks, which uses either improperly formatted MTUs (Maximum Transmission Unit) or the ICMP (Internet Control Message Protocol) to crash the targeted network computer?

Choose the network mapping tool (scanner) which uses ICMP (Internet Control Message Protocol).

One of the below is a description for a password cracker, which one is it?

John works as a network administrator for his company. He uses a tool to check SMTP,DNS, P0P3, and ICMP packets on the network. This is an example of which of the following?

Risk assessment is a common first step in a risk management process. Risk assessment is the determination of quantitative or qualitative value of risk related to a concrete situationand a recognized threat (also called hazard). As a best practice, risk assessments should be based upon which of the following?

Which of the following would allow an administrator to find weak passwords on the network?

What is used to find weak passwords on the network?

Which programs and codes will permit an untraceable presence on a system with administrative rights?

What is an installable package that encompasses of numerous patches from the samevend or for different applications called?

Which one of the following is not Bluetooth threat?

Which statement best describes a static NAT?

In computer networking, network address translation (NAT) is the process of modifying network address information in datagram packet headers while in transit across a traffic routing device for the purpose of remapping a given address space into another. Which description is true about a static NAT?

Which of the following does PGP use to encrypt data?

One type of port scan can determine which ports are in a listening state on the network, and can then perform a two way handshake. Which type of port scan can perform this set of actions?

One type of port scan can determine which ports are in a listening state on the network, and can then perform a two way handshake. Which type of port scan can perform this set of actions?

What is a program that appears to be useful but contains hidden code that allows unauthorized individuals to exploit or destroy data is commonly known?

Remote authentication allows you to authenticate users using a locally hosted script. Which of the following is an example of remote authentication?

Which of the following is the MOST significant flaw in Pretty Good Privacy (PGP) authentication?

Identify the malicious software that can be transmitted across computer networks without needing a client to distribute the software?

Which malicious software can be transmitted across computer networks without user intervention?

Identify the malicious code that does not need human involvement to install itself and to spread?

A company's new employees are asked to sign a document that describes the methods of and purposes for accessing the company's IT systems. Which of the following BEST describes this document?

Which of the following policies detail guidelines on the rights, privileges, and restrictions for using company equipment and assets?

What does the DAC access control model use to identify the users who have permissions to a resource?

Which of the following statements best suits the wireless communication technology ODFM?

Which of the following statements best suits the wireless communication technology FHSS?

Which of the following elements, included in password policy, defines the time duration for which a locked out account remains locked out?

After the maximum number attempts have failed, which of the following could set an account to lockout for 30 minutes?

Which of the following can be used to implement a procedure to control inbound and outbound traffic on a network segment?

Which of the following security mechanisms can be used to control the flow of packets traveling through routers?

Which of the following associates users and groups to certain rights to use, read, write, modify, or execute objects on the system?

Which of the following Directory Services does the statement that it is the backbone for all security, access, and network implementations from here on out refer to?

In order to encrypt credit card data, which will be the most secure algorithm with the least CPU utilization?

Which of the following provides the MOST secure form of encryption?

Encryption is the conversion of data into a form, called a ciphertext that cannot be easily understood by unauthorized people. Which encryption is the strongest by use of mathematical evaluation techniques?

Which item will effectively allow for fast, highly secure encryption of a USB flash drive?

Most current encryption schemes are based on

On the topic of the DAC (Discretionary Access Control) model, choose the statement(s) which are TRUE.

A honeypot is used to:

One of these options best defines the main purpose of implementing an e-mail relay server. Which is it?

Which of the following will require setting a baseline? (Select TWO).

An SMTP server is the source of email spam in an organization. Which of the following is MOST likely the cause?

An SMTP server is the source of email spam in an organization. Which of the following is MOST likely the cause?

Which of the following is the general philosophy behind a DMZ?

Which type of Service Level Agreement (SLA) deals with hosting of a specific application or service?

Which of the following types of firewalls provides inspection at layer 7 of the OSI model?

Which description is correct about a way to prevent buffer overflows?

What are best practices while installing and securing a new system for a home user?(Select THREE).

To reduce vulnerabilities on a web server, an administrator should adopt which of the following preventative measures?

Which of the following is the best defense against IP (Internet Protocol) spoofing attacks?

Which of the following are components of host hardening? (Select TWO).

Which of the following definitions fit correctly to VPN?

Which of the following statements are true regarding FTP Secure?

Which of the following best describes the term "separation of duties"?

PKI is based on which of the following types of encryption?

For which of the following can digital signatures be used?

Choose the scheme or system used by PGP (Pretty Good Privacy) to encrypt data.

The CHAP (Challenge Handshake Authentication Protocol) sends a logon request from the client to the server, and the server sends a challenge back to the client At which stage does the CHAP protocol perform the handshake process? Choose the best complete answer.

Which of the following would be the BEST reason to disable unnecessary services on a server?

Patch management must be combined with full-featured systems management to be effective. Determining which patches are needed, applying the patches and which of the following are three generally accepted activities of patch management?

The concept of forensic analysis involves a standard approach or process. Choose the correct combination of steps for this process. (Select THREE)

Which of the following concepts pertain to the process which proves that evidence presented is in fact the evidence which was collected?

For which of the following can biometrics be used?

Which of the following are the main components of a Kerberos server?

The difference between identification and authentication is that:

Which of the following security services are provided by digital signatures? (Select THREE).

Which component of a security triad deals with ensuring that any needed data is available when necessary?

A security specialist has downloaded a free security software tool from a trusted industry site. The source has published the MD5 hash values for the executable program. The specialist performs a successful virus scan on the download but the MD5 hash is different. Which of the following steps should the specialist take?

Which item can be commonly programmed into an application for ease of administration?

Loki, NetCaZ, Masters Paradise and NetBus are examples of what type of attack?

Alex is a network administrator of his company. He is backing up all server data nightly to a local NAS device. Which additional action should Alex perform to block disaster in the case the primary site is permanently lost?

When power must be delivered to critical systems, which of the following is a countermeasure?

Which of the following security topologies is a dual-homed device used to connect the outside network with the inside network. This would also be one of the first devices where public traffic arrives, and where specialized software defines which types of traffic are allowed to pass through?

A user accesses a retailer from an Internet search. While browsing the retailer's web site,the user wants to purchase an item and enters the credit card information. The user later observes unknown charges on the credit card bill and has not received the purchased items. Which of the following actions should the user take?

After installing new software on a machine, what needs to be updated to the baseline?

What should you update to the baseline after installing new software on a machine?

Which solution can be used by a user to implement very tight security controls for technicians that seek to enter the users' datacenter?

Which item is not a logical access control method?

Which of the following methods of authentication makes use of hand scanners, fingerprints, retinal scanners or DNA structure to identify the user?

Which of the following is the most costly method of an authentication?

Which of the following provides the strongest form of authentication?

One type of network attack sends two different messages that use the same hash function to generate the same message digest. Which network attack does this?

CRL is short for Certificate Revocation List. Which types of keys are included in a CRL?

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoSattack) is an attempt to make a computer resource unavailable to its intended users. Which method can be used to perform denial of service (DoS) attacks?

Which of the following would be the BEST reason for certificate expiration?

Which one of the following options overwrites the return address within a program to execute malicious code?

Which of the following describes a server or application that is accepting more input than the server or application is expecting?

Which of the following is a common type of attack on web servers?

What exploit that can be considered a DoS attack because more traffic than what the node can handle is flooded to that node.

Which of the following occurs when a string of data is sent to a buffer that is larger than the buffer was designed to handle?

Which of the following type of attacks exploits poor programming techniques and lack of code review?

Which of the following is a DoS exploit that sends more traffic to a node than anticipated?

Which of the following is a common type of attack on web servers?

The MOST common exploits of Internet-exposed network services are due to:

Which of the following can affect heaps and stacks?

Identify common utilization of Internet-exposed network services?

Which of the following web vulnerabilities is being referred to when it receives more data than it is programmed to accept?

How to test the integrity of a company's backup data?

Which of the following can be used by a technician to detect staff members that are connecting to an unauthorized website?

When a network-based IDS detects a suspicious event, it can perform a number of actions. Which of the following does not apply?

A host-based IDS system can perform a number of monitoring and intrusion detection activities which a network IDS cannot. Choose the one that does not apply?

An administrator wants to make sure that no equipment is damaged when encountering a fire or false alarm in the server room. Which type of fire suppression system should beused?

Which of the following types of removable media is write-once and appropriate for archiving security logs?

A Faraday cage or Faraday shield is an enclosure formed by conducting material, or by a mesh of such material. Such an enclosure blocks out external static electrical fields. Faraday cages are named after physicist Michael Faraday, who built one in 1836. Which of the following would a Faraday cage prevent usage of?

Which security management model works on the basis that all new privilege assignment sand privilege assignment modifications made to existing privileges are performed through one governing group?

Which of the following is included in a CRL (Certificate Revocation List)?

Internet filter appliances/servers will most likely analyze which three items? (SelectTHREE).

Which of the following web vulnerabilities is being referred to when it's an older form of scripting that was used extensively in early web systems?

Which description is correct about the form used while transferring evidence?

To preserve evidence for later use in court, which of the following needs to be documented?

What should be established immediately upon evidence seizure?

Which of the following avoids the allegations that the evidence may have been tampered with when it was unaccounted for?

Sending a patch through a testing and approval process is an example of which option?

In forensics, which of the following tasks should be performed when an incident occurs? (Choose all that apply)

Which description is correct about the standard load for all systems?

Which item specifies a set of consistent requirements for a workstation or server?

Removable storage has been around almost as long as the computer itself. Which of the following is the GREATEST security risk regarding removable storage?

Which of the following refers to the ability to be reasonably certain that data is not disclosed to unintended persons?

Which description is true about the external security testing?

Which method will most effectively verify that a patch file downloaded from a third party has not been modified since the time that the original manufacturer released the patch?

Which option is correct about a hash algorithms ability to avoid the same output from two guessed inputs?

You work as a network administrator for your company. Your company has just detected a malware incident. Which will be your first response?

Identify the primary security risk linked with removable storage?

Which of the following can be used to track a user's browsing habits on the Internet?

Which of the following can be used to retain connection data, user information, history of sites visited, and can be used by attackers for spoofing an on-line identity?

Which practice is the best to secure log files?

The first step in creating a security baseline would be:

Which of the following methods, based on the separation of duties principle, involves provisioning of at least two people for a task to enhance security, and also ensures that multiple people are trained for each task?

Which practice can best code applications in a secure manner?

With which privileges are ActiveX control executed?

Which access control model uses Access Control Lists to identify the users who have permissions to a resource?

Which of the following best describes an access control mechanism that allows the data owner to create and administer access control?

Which of the following CANNOT be performed by a proxy server?

A peer-to-peer computer network uses diverse connectivity between participants in a network and the cumulative bandwidth of network participants rather than conventional centralized resources where a relatively low number of servers provide the core value to aservice or application. Which of the following is a security risk while using peer-to-peersoftware?

Which one of the following options is an attack launched from multiple zombie machines in attempt to bring down a service?

What is used in a distributed denial of service (DDOS) attack?

Choose the option that best describes the definition of human resource policies.

Using software on an individual computer to generate a key pair is an example of which of the following approaches to PKI architecture?

Which of the following is employed to allow distrusted hosts to connect to services inside a network without allowing the hosts direct access to the internal networks?

Which of the following portions of a company's network is between the Internet and an internal network?

Which of the following options is the correct sequence for the TCP Three-Way Handshake?

Which of the following protocols suites are responsible for IP addressing?

Which of the following common attacks would the attacker capture the user's login information and replay it again later?

In which of the following attacks does the attacker pretend to be a legitimate user?

You are the security administrator at TestKing.com. You detect intruders accessing your internal network. The source IP (Internet Protocol) addresses originate from trusted networks. What type of attack are you experiencing?

Which of the following is the best defense against IP (Internet Protocol) spoofing attacks?

Nmap has been run against a server and more open ports than expected have been discovered. Which of the following would be the FIRST step to take?

Which of the following network attacks cannot occur in an e-mail attack?

The CEO of your company is worrying about staff browsing inappropriate material on the Internet via HTTPS. Your company is advised to purchase a product which can decrypt the SSL session, scan the content and then repackage the SSL session without staff knowing. Which type of attack is similar to this product?

Which of the following definitions would be correct regarding Active Inception?

In which of the following does someone use an application to capture and manipulate packets as they are passing through your network?

Which of the following is the best defense against man in the middle attacks?

Which of the following types of attacks is BEST described as an attacker capturing part of a communication and later sending that communication segment to the server while pretending to be the client?

When an attacker captures part of a communication and later sends the communication segment to the server whilst pretending to be the user it is known as a:

One type of network attack sends two different messages that use the same hash function to generate the same message digest. Which network attack does this?

One of the below options are correct regarding the DoS (Denial of Service) attack?

Which of the following is a DoS (Denial of Service) attack that exploits TCP's (Transmission Control Protocol) three-way handshake for new connections?

Which of the following is a security breach that does not usually result in the theft of information or other security loss but the lack of legitimate use of that system?

Which of the following is a possible technical impact of receiving large quantifies of spam?

One of the below options are correct regarding the DDoS (Distributed Denial of Service) attack?

Which one of the following options is an attack launched from multiple zombie machines in attempt to bring down a service?

Which of the following is most common method of accomplishing DDoS (Distributed Denial of Service) attacks?

Identify the attack that targets a web server if numerous computers send a lot of FIN packets at the same time with spoofed source IP addresses?

How can you determine whether the workstations on the internal network are functioning as zombies participating in external DDoS attacks?

You configure a computer to act as a zombie set in order to attack a web server on aspecific date. What would this contaminated computer be part of?

What is used in a distributed denial of service (DDOS) attack?

What can result in DDoS?

Study the following items carefully, which one will permit a user to float a domain registration for a maximum of five days?

In computing, a Uniform Resource Locator (URL) is a type of Uniform ResourceIdentifier (URI) that specifies where an identified resource is available and the mechanism for retrieving it. When a user attempts to go to a website, he notices the URL has changed, which attack will MOST likely cause the problem?

Which of the following portions of a company's network is between the Internet and an internal network?

What is the BEST model to consider with regards to a secured Email infrastructure?

What is the area in which a system administrator would place the web server to isolate it from other servers on the network called?

Which of the following best describes a DMZ (Demilitarized Zone)?

Which of the following would be placed in a DMZ (Demilitarized Zone)?

Which of the following is the general philosophy behind a DMZ?

How can a demilitarized zone (DMZ) network segment be created?

A compromise of which device could result in a VLAN being compromised?

You work as the security administrator at TestKing.com. You must ensure that internal access to other parts of the network is controlled and restricted. The solution which you implement to restrict network access must be hardware based. You also want to use the least amount of administrative effort to accomplish your task. How will you accomplish the task?

Which of the following can be used to mitigate against sniffers and decrease broadcast traffic?

You work as the network administrator at TestKing.com. You want to restrict internal access to other parts of the network. Your solution will be hardware based and must be implemented with the least amount of administrative effort. Which of the following would be your best solution?

Which statement best describes a static NAT?

Which of the following could cause communication errors with an IPSec VPN tunnel because of changes made to the IP header?

On which of the following devices would you not implement NAT?

Which of the following could cause communication errors with an IPSec VPN tunnel because of changes made to the IP header?

Which type of NAT configuration maps a range of internal IP addresses to a range of external IP address?

After auditing file, which log will show unauthorized usage attempts?

Which of the following is MOST often used to allow a client or partner access to a network?

Fiber optic cable is considered safer than CAT5 because fiber optic cable: (Select TWO).

Which of the following access attacks would involve listening in on someone's network?