ComptiA Security+ Certification Exam Questions and answer - Part 11

1. A computer on a company network was infected with a zero-day exploit after an employee accidently opened an email that contained malicious content. The employee recognized the email as malicious and was attempting to delete it,but accidently opened it. Which of the following should be done to prevent this scenario from occurring again in the future?

A) Install host-based firewalls on all computers that have an email client installed
B) Create new email spam filters to delete all messages from that sender
C) Install end-point protection on all computers that access web email
D) Set the email program default to open messages in plain text



2. A company is developing a new secure technology and requires computers being used for development to be isolated. Which of the following should be implemented to provide the MOST secure environment?

A) An air gapped computer network
B) A perimeter firewall and IDS
C) A bastion host
D) An ad hoc network with NAT
E) A honeypot residing in a DMZ


3. A company has three divisions,each with its own networks and services. The company decides to make its secure web portal accessible to all employees utilizing their existing usernames and passwords. The security administrator has elected to use SAML to support authentication. In this scenario,which of the following will occur when users try to authenticate to the portal? (Select two.)(Select 2answers)

A) The back-end networks will verify the assertion token issued by the portal functioning as the identity provider.
B) The portal will request an authentication ticket from each network that is transitively trusted.
C) The portal will function as an identity provider and issue an authentication assertion.
D) The back-end networks will function as an identity provider and issue an authentication assertion.
E) The back-end networks will request authentication tickets from the portal,which will act as the third-party service provider authentication store.
F) The portal will function as a service provider and request an authentication assertion.

4. A company utilizes 802.11 for all client connectivity within a facility. Users in one part of the building are reporting they are unable to access company resources when connected to the company SSID. Which of the following should the security administrator use to assess connectivity?

A) Wireless scanner
B) Sniffer
C) Honeypot
D) Routing tables



5. After an identified security breach,an analyst is tasked to initiate the IR process. Which of the following is the NEXT step the analyst should take?

A) Documentation
B) Preparation
C) Recovery
D) Escalation
E) Identification