ComptiA Security+ Certification Exam Questions and answer - Part 50

1. A security analyst conducts a manual scan on a known hardened host that identifies many non-compliant items. Which of the following BEST describe why this has occurred? (Choose two.)(Select 2answers)

A) Non-applicable plugins were selected in the scan policy
B) Privileged-user credentials were used to scan the host
C) The target host has been compromised
D) The output of the report contains false positives
E) The incorrect audit file was used


2. A senior incident response manager receives a call about some external IPs communicating with internal computers during off hours. Which of the following types of malware is MOST likely causing this issue?

A) Armored virus
B) Botnet
C) Ransomware
D) Polymorphic malware



3. A security administrator is trying to encrypt communication. For which of the following reasons should administrator take advantage of the Subject Alternative Name (SAM) attribute of a certificate?

A) It protects unlimited subdomains
B) It can protect multiple domains
C) It does not require a trusted certificate authority
D) It provides extended site validation



4. A security administrator has completed a monthly review of DNS server query logs. The administrator notices continuous name resolution attempts from a large number of internal hosts to a single Internet addressable domain name. The security administrator then correlated those logs with the establishment of persistent TCP connections out to this domain. The connections seem to be carrying on the order of kilobytes of data per week. Which of the following is the MOST likely explanation for this company?

A) A worm is attempting to spread to other hosts via SMB exploits.
B) Employees are playing multiplayer computer games.
C) An attacker is infiltrating large amounts of proprietary company data.
D) Internal hosts have become members of a botnet.



5. A security analyst is securing smartphones and laptops for a highly mobile workforce. Priorities include: Remote wipe capabilities Geolocation services Patch management and reporting Mandatory screen locks Ability to require passcodes and pins Ability to require encryption Which of the following would BEST meet these requirements?

A) Deploying relevant group policies to the devices
B) Removing administrative rights to the devices
C) Implementing MDM software
D) Installing full device encryption