CompTIA Security+
What protocol may be used to secure passwords in transit to a web application?
TLS
What data obfuscation technique is intended to be reversible?
Tokenization
Bob is planning to use a cryptographic cipher that rearranges the characters in a message. What type of cypher is Bob planning to use?
Transposition cipher
It is difficult to develop defenses against APT attackers True or False
True
It is generally a bad practice to run software after the vendor's end-of-life True or False
True
Privelege escalation attacks require a normal user account to execute True or False
True
The main purpose of a code repository is to store the source files used in software development in a centralized location that allows for secure storage. True or False
True
What Java clause is critical for error handling
Try...Catch
The attacker called a help desk employee and persuaded her that she was a project manager on a tight deadline and locked out of her account. The help desk technician provided the attacker with access to the account. What social engineering principle was used?
Urgency
What phase of the capability maturity model introduces the reuse of code across projects?
(Quantitatively) Managed
Which one of the following is not a possible hash length from the SHA-2 function? a. 224 bits b. 128 bits c. 384 bits d. 512 bits
128 bits
How many keys should be used with 3DES to achieve the greatest level of security?
3
What CVSS value is the threshold at which PCI DSS requires remediation to achieve a passing scan?
4
What length encryption key does the Data Encryption Standard use?
56 bits
What type of phishing attack focuses specifically on senior executives of a targeted organization?
Whaling
What is the name of the application control technology built-in to Microsoft Windows?
AppLocker
What approach to threat identification begins with a listing of all resources owned by the organization?
Asset-focused
What is the basic principle underlying threat hunting activities?
Assumption of Compromise
What algorithm uses Blowfish cipher along with a salt to strengthen cryptographic keys?
Bcrypt
In a _____ penetration test, the attacker has no prior knowledge of the environment.
Black box
What input validation approach works to exclude prohibited input?
Blacklisting
Alice would like to send a message to Bob using RSA encryption. What key should she use to encrypt the message?
Bob's public key
What type of attack seeks to write data to areas of memory reserved for other purposes?
Buffer overflow
As Dave works with his colleagues in other IT disciplines, he notices that they use different names to refer to the same products and vendors. Which SCAP component would best assist him in reconciling these differences?
CPE (Common Platform Enumeration)
What technology can you use to tell clients that a certificate is unlikely to change over time?
Certificate pinning
In the early 1990s, the NSA attempted to introduce key escrow using what failed technology?
Clipper chip
CCE
Common Configuration Enumeration
CPE
Common Platform Enumeration
CVE
Common Vulnerabilities and Exposures
CVSS
Common Vulnerability Scoring System
The reuse of passwords across multiple sites makes an individual susceptible to ______ attacks?
Credential stuffing
Alan is analyzing his web server logs and sees several strange entries that contain strings similar to "../../" in URL requests. What type of attack was attempted against his server?
Directory traversal
What attack technique wraps malicious code around a legitimate driver?
Driver shimming
Which one of the following encryption approaches is most susceptible to a quantum computing attack? a. quantum cryptography b. RSA cryptography c. AES cryptography d. Elliptic Curve Cryptography
Elliptic Curve Cryptography
What operation uses a cryptographic key to convert plaintext into ciphertext?
Encryption
What type of digital certificate offers the highest possible level of trust?
Extended Validation (EV)
XCCDF
Extensible Configuration Checklist Description Format
Companies should always manage bug bounty programs internally. True or False
False
Database normalization should always be used to improve database security True or False
False
Removing names and identification numbers is usually all that is necessary to deidentify a dataset True or False
False
The DevOps model prioritizes development efforts over operational tasks. True or False
False
Static code testing software executes code to verify that it is functioning properly. True or False
False *Static code testing software does NOT execute code, only analyzes it
The analysis of adversary TTP includes tools, techniques, and policies. True or False
False Correct definition of TTP includes tools, techniques and *procedures
Jason recently investigated a vulnerability discovered during a scan and, after exhaustive research, determined that the vulnerability did not exist. What type of error occurred?
False Positive
What type of attacker is primarily concerned with advancing an ideological agenda?
Hacktivist
What is a common command and control mechanism for botnets?
IRC (Internet Relay Chat)
What type of organization facilitates cybersecurity information sharing among industry-specific communities?
ISAC
What is the most effective defense against cross-site scripting attacks?
Input validation
What action can users take to overcome security flaws in RC4?
It is not possible to use RC4 securely.
______ consist of shared code objects that perform related functions.
Libraries
What type of malware delivers its payload only after certain conditions are met?
Logic bomb
Maloof would like to digitally sign a message that he is sending to Clementine. What key does he use the create the digital signature?
Maloof's private key
What type of fuzz testing captures real software input and modifies it?
Mutation Fuzzing
Alice would like to be able to prove to Charlie that a message she received actually came from Bob. What cryptographic goal is Alice trying to enforce?
Non-repudiation
Harold works for a certificate authority and wants to ensure that his organization is able to revoke digital certificates that it creates. What is the most effective method of revoking digital certificates?
Online Certificate Status Protocol
OVAL
Open Vulnerability and Assessment Language
What is the first step of a Fagan inspection?
Planning
Matt would like to limit the tests performed by his vulnerability scanner to only those that affect operating systems installed in his environment. Which setting should he modify?
Plug-ins
What language is commonly used to automate the execution of system administration tasks on Windows systems?
PowerShell
What type of AI technique is most commonly associated with optimization?
Prescriptive Analytics
In what technique do attackers pose as their victim to elicit information from third parties?
Pretexting
Dan is engaging in a password cracking attack where he uses precomputed hash values. What type of attack is Dan waging?
Rainbow table
CryptoLocker is an example of what type of malware?
Ransomware
What component of a change management program includes final testing that the software functions properly?
Release management
What security technology best assists with the automation of security workflows?
SOAR
Which of the following is a standardized language used to communicate security information between systems and organizations? a. ISAC b. OVAL c. STIX d. CVSS
STIX
In what type of social engineering attack does the attacker physically observe the victim's activity?
Shoulder Surfing
What type of website does the attacker use when waging a watering hole attack?
Site trusted by the end user
What device is often used in card cloning attacks?
Skimmer
What software development methodology uses four stages in an iterative process?
Spiral
Jasmine comes across a file sent out of her organization that she suspects contains proprietary trade secrets but appears to be an innocuous image. What technique might the sender have used to hide information in the image?
Steganography
In a cybersecurity exercise, what team is responsible for serving as moderators?
White Team
Where do fileless viruses often store themselves to maintain persistence?
Windows Registry
What standard governs the structure and content of digital certificates?
X.509
Which one of the following metrics does not contribute to the Exploitability score for a vulnerability in CVSS? a. Confidentiality b. User Interaction c. Attack Vector d. Attack Complexity
a. Confidentiality Reason: Confidentiality shows IMPACT not EXPLOITABILITY
Which one of the following is an example of an in-band approach to key exchange? a. Diffie-Hellman b. U.S. mail c. Physical meeting d. Phone call
a. Diffie-Hellman
Which one of the following is not an effective defense against XSRF attacks? a. Network segmentation b. User education c. Preventing the use of HTTP GET requests d. Automatic logouts
a. Network segmentation
Renee is creating a prioritized list of scanning targets. Which one of the following is the least important criteria for her prioritization? a. Operating System b. Targets c. Type of Scan d. None of these are low priority
a. Operating System
Which one of these file extensions is always associated with certificates stored in binary form? a. PFX b. PEM c. P7B d. CRT
a. PFX
Randy is developing a vulnerability management program. Which one of the following is not a common source of requirements for such a program? a. Sales team requests b. Legal requirements c. Security objectives d. Corporate policy
a. Sales team requests
Which one of the following is NOT critical to the security of one time pad operations? a. using AES in conjunction with the one-time pad b. choosing the key at random c. securely exchanging the pads d. only using the pad one time
a. using AES in conjunction with the one-time pad
Which one of the following is not a standard application hardening technique? a. Apply security patching b. Conduct cross-site scripting c. Validate user input d. Encrypt sensitive information
b. Conduct cross-site scripting
Helen has vulnerability scanners located at several points on her network. Which one of the following scanners is likely to provide the most complete picture of the vulnerabilities present on a public web server? a. Public Scanner b. DMZ Scanner c. Rough Scanner d. BNC Scanner
b. DMZ Scanner
Which one of the following issues is not generally associated with the use of default configurations? a. extraneous services running b. SQL injection flaws c. open ports d. vendor-assigned passwords
b. SQL injection flaws
Which one of the following is not a barrier to using the web of trust (WoT) approach? a. Technical knowledge required of users b. Use of weak cryptography c. Decentralized approach d. High barrier to entry
b. Use of weak cryptography
What basic cryptographic functions does the AES algorithm use to encrypt plaintext?
both substitution and transposition
Which of the following is an example of an open-source intelligence resource? a. social media b. vulnerability databases c. all of these answers d. security websites
c. all of these answers
Which one of the following controls is not particularly effective against insider threats? a. least privilege b. background checks c. firewalls d. separation of duties
c. firewalls
Data breaches violate which principle of cybersecurity?
confidentiality
What type of object must a hacker typically access in order to engage in a session hijacking attack?
cookie
Which one of the following technologies is an example of a parameterized query? a. Output encoding b. Masked identifier c. Hashed identifier d. Stored procedure
d. Stored Procedure
Which of the following is a race condition attack? a. SQLi b. XSRF c. XSS d. TOC/TOU
d. TOC/TOU
Developers wishing to sign their code must have a ______
digital certificate
When you communicate over the Tor network, which of the following entities do you communicate with directly? a. entry node b. delivery node c. destination server d. Network node
entry node
What is the simplest way to take an existing cipher and make it stronger?
increase the length of the encryption key
What condition occurs when a software package fails to release memory that it reserved for use?
memory leak
The difficulty of solving what mathematical problem provides the security underlying the Diffie-Hellman Algorithm?
prime factorization
What key is actually used to encrypt the contents of a message when using PGP?
randomly generated key
If Alice wants to send a message to Bob using symmetry cryptography, what key does she use to encrypt the message?
shared secret key
What type of malware can spread without user interaction?
worm