Practice+Questions+Answer

=CompTIA Security+ Answers to Practice Questions= (corresponding objective: 1.3)
 * Question 1**

Creating a basic standard for application settings, security settings, and active services on every company laptop would be considered...

A. group policy B. baseline configuration C. patch management
 * D. a security template**

(corresponding objective: 3.7)
 * Question 2**

All of the following are correct about LDAP EXCEPT:

A. some implementations use x.509 certificates for securing communications B. some of the implementations use default TCP ports 389 and 636 D. most of the implementations use the x.500 directory model
 * C. all attributes will be encrypted**

(corresponding objective: 1.6)
 * Question 3**

Which of the following is a key reason for using virtual machines in a test lab where attackers or malware may compromise a machine?

A. Easier for the attacker to compromise the machine B. Harder for the attacker to compromise the machine D. Harder to restore the system to the original state
 * C. Easier to restore the system to the original state**

(corresponding objective: 1.1)
 * Question 4**

Which of the following is more of an irritation than a security threat?

A. Rootkit C. Spyware D. Trojan
 * B. Adware**

(corresponding objective: 3.1)
 * Question 5**

Least privilege is defined as giving access to information:

A. based on tenure at the company B. based on sense of urgency from management C. that may be revealed to the public
 * D. needed to complete the task**

(corresponding objective: 1.1)
 * Question 6**

Which of the following describes a piece of malicious code that is activated when specified conditions are met?

A. Trojan B. Spyware D. Virus
 * C. Logic Bomb**

(corresponding objective: 4.6)
 * Question 7**

An administrator wishes to enable network auditing policies. Which of the following should the security administrator log?

A. Only logon failures B. Only logon success D. Only logon failures for non-existent users
 * C. Both logon successes and logon failures**

(corresponding objective: 4.4)
 * Question 8**

From a security perspective a performance baseline is MOST useful for:

B. assuring that systems are working to their optimal capacity C. knowing when security scans are going to finish D. predicting the end of useful life for the firewall
 * A. detecting performance anomalies that may be due to security breaches**

(corresponding objective: 2.5)
 * Question 9**

A company creates its own application that accesses the company databases and requires a unique login, based on the user’s domain account. The developer has an undocumented login for testing that does not need to be authenticated against the domain. Which of the following is a security issue regarding this scenario?

A. The login should be the same as the domain account for authentication purposes C. The application should not be deployed if it is not fully tested D. It is not considered best practice to have a user remember multiple logins
 * B. It can be used as a backdoor into the company’s databases**

(corresponding objective: 2.1)
 * Question 10**

In order to perform a TCP hijacking attack, an attacker would be required to:

A. have a protocol analyzer intercept traffic between two hosts C. perform a man-in-the-middle attack and communicate directly with two hosts D. obtain the MAC address of the both hosts
 * B. know the IP addresses of both hosts and sequence numbers of the TCP/IP packets**