ComptiA Security+ Certification Exam Questions and answer - Part 28

1. An incident response analyst at a large corporation is reviewing proxy log data. The analyst believes a malware infection may have occurred. Upon further review,the analyst determines the computer responsible for the suspicious network traffic is used by the Chief Executive Officer (CEO). Which of the following is the best NEXT step for the analyst to take?

A) Call the CEO directly to ensure awareness of the event
B) Run a malware scan on the CEO - s workstation
C) Reimage the CEO - s workstation
D) Disconnect the CEO - s workstation from the network



2. An incident response manager has started to gather all the facts related to a SIEM alert showing multiple systems may have been compromised. The manager has gathered these facts: The breach is currently indicated on six user PCs One service account is potentially compromised Executive management has been notified In which of the following phases of the IRP is the manager currently working?

A) Recovery
B) Eradication
C) Containment
D) Identification



3. An information security analyst needs to work with an employee who can answer questions about how data for a specific system is used in the business. The analyst should seek out an employee who has the role of:

A) steward
B) owner
C) privacy officer
D) systems administrator



4. An information system owner has supplied a new requirement to the development team that calls for increased non-repudiation within the application. After undergoing several audits,the owner determined that current levels of non-repudiation were insufficient. Which of the following capabilities would be MOST appropriate to consider implementing is response to the new requirement?

A) Transitive trust
B) Symmetric encryption
C) Two-factor authentication
D) Digital signatures
E) One-time passwords


5. An in-house penetration tester has been asked to evade a new DLP system. The tester plans to exfiltrate data through steganography. Discovery of which of the following would help catch the tester in the act?

A) Abnormally high numbers of outgoing instant messages that contain obfuscated text
B) Large-capacity USB drives on the tester's desk with encrypted zip files
C) Outgoing emails containing unusually large image files
D) Unusual SFTP connections to a consumer IP address