CompTIA Security+Exam (SY0-701) Free Questions - Part 16

Question No : 226) An incident response technician collected a mobile device during an investigation. Which of the following should the technician do to maintain chain of custody?

A. Document the collection and require a sign-off when possession changes.

B. Lock the device in a safe or other secure location to prevent theft or alteration.

C. Place the device in a Faraday cage to prevent corruption of the data.

D. Record the collection in a blockchain-protected public ledger.

Question No : 227) A security analyst is preparing a threat for an upcoming internal penetration test. The analyst needs to identify a method for determining the tactics, techniques, and procedures of a threat against the organization’s network. Which of the following will the analyst MOST likely use to accomplish the objective?

A. A table exercise

B. NST CSF

C. MTRE ATT$CK

D. OWASP

Question No : 228) Which of the following organizational policies are MOST likely to detect fraud that is being conducted by existing employees? (Select TWO).

A. Offboarding

B. Mandatory vacation

C. Job rotation

D. Background checks

E. Separation of duties

F. Acceptable use

Question No : 229) A company is designing the layout of a new datacenter so it will have an optimal environmental temperature Which of the following must be included? (Select TWO)

A. An air gap

B. A cold aisle

C. Removable doors

D. A hot aisle

E. An loT thermostat

F. A humidity monitor

Question No : 230) An attacker is attempting to exploit users by creating a fake website with the URL users. Which of the following social-engineering attacks does this describe?

A. Information elicitation

B. Typo squatting

C. Impersonation

D. Watering-hole attack

Question No : 231) A security modern may have occurred on the desktop PC of an organization's Chief Executive Officer (CEO) A duplicate copy of the CEO's hard drive must be stored securely to ensure appropriate forensic processes and the chain of custody are followed. Which of the following should be performed to accomplish this task?

A. Install a new hard drive in the CEO's PC, and then remove the old hard drive and place it in a tamper-evident bag

B. Connect a write blocker to the hard drive Then leveraging a forensic workstation, utilize the dd command m a live Linux environment to create a duplicate copy

C. Remove the CEO's hard drive from the PC, connect to the forensic workstation, and copy all the contents onto a remote fileshare while the CEO watches

D. Refrain from completing a forensic analysts of the CEO's hard drive until after the incident is confirmed, duplicating the hard drive at this stage could destroy evidence

Question No : 232) A security analyst needs to perform periodic vulnerability scans on production systems. Which of the following scan Types would produce the BEST vulnerability scan report?

A. Port

B. Intrusive

C. Host discovery

D. Credentialed

Question No : 233) A security analyst reviews the datacenter access logs for a fingerprint scanner and notices an abundance of errors that correlate with users' reports of issues accessing the facility. Which of the following MOST likely the cause of the cause of the access issues?

A. False rejection

B. Cross-over error rate

C. Efficacy rale

D. Attestation

Question No : 234) A technician needs to prevent data loss in a laboratory. The laboratory is not connected to any external networks. Which of the following methods would BEST prevent the exfiltration of data? (Select TWO).

A. VPN

B. Drive encryption

C. Network firewall

D. File level encryption

E. USB blocker

F. MFA

Question No : 235) A cybersecurity department purchased o new PAM solution. The team is planning to randomize the service account credentials of the Windows server first. Which of the following would be the BEST method to increase the security on the Linux server?

A. Randomize the shared credentials

B. Use only guest accounts to connect.

C. Use SSH keys and remove generic passwords

D. Remove all user accounts.

Question No : 236) A security analyst needs to produce a document that details how a security incident occurred, the steps that were taken for recovery, and how future incidents can be avoided. During which of the following stages of the response process will this activity take place?

A. Recovery

B. Identification

C. Lessons learned

D. Preparation

Question No : 237) A security engineer needs to Implement the following requirements:

• All Layer 2 switches should leverage Active Directory tor authentication.

• All Layer 2 switches should use local fallback authentication If Active Directory Is offline.

• All Layer 2 switches are not the same and are manufactured by several vendors.

Which of the following actions should the engineer take to meet these requirements? (Select TWO).

A. Implement RADIUS.

B. Configure AAA on the switch with local login as secondary.

C. Configure port security on the switch with the secondary login method.

D. Implement TACACS+

E. Enable the local firewall on the Active Directory server.

F. Implement a DHCP server.

Question No : 238) A client sent several inquiries to a project manager about the delinquent delivery status of some critical reports. The project manager darned the reports were previously sent via email but then quickly generated and backdated the reports before submitting them via a new email message Which of the following actions MOST likely supports an investigation for fraudulent submission?

A. Establish chain of custody

B. Inspect the file metadata

C. Reference the data retention policy

D. Review the email event logs

Question No : 239) A network engineer is troubleshooting wireless network connectivity issues that were reported by users. The issues are occurring only in the section of the building that is closest to the parking lot. Users are intermittently experiencing slow speeds when accessing websites and are unable to connect to network drives. The issues appear to increase when laptop users return desks after using their devices in other areas of the building. There have also been reports of users being required to enter their credentials on web pages in order to gain access to them. Which of the following is the MOST likely cause of this issue?

A. An external access point is engaging in an evil-twin attack.

B. The signal on the WAP needs to be increased in that section of the building.

C. The certificates have expired on the devices and need to be reinstalled.

D. The users in that section of the building are on a VLAN that is being blocked by the firewall.

Question No : 240) An attacker is trying to gain access by installing malware on a website that is known to be visited by the target victims. Which of the following is the attacker MOST likely attempting?

A. A spear-phishing attack

B. A watering-hole attack

C. Typo squatting

D. A phishing attack