comptia sy0-501 online test

CompTIA Security+

What students need to know about the sy0-501 exam

  • Total 1132 Questions & Answers

Question 1

Which of the following should a security analyst perform FIRST to determine the vulnerabilities of a legacy system?

  • A. Passive scan
  • B. Aggressive scan
  • C. Credentialed scan
  • D. Intrusive scan
Answer:

A

Discussions

Question 2

The website of a bank that an organization does business with is being reported as untrusted by the organizations web
browser. A security analyst has been assigned to investigate. The analyst discovers the bank recently merged with another
local bank and combined names. Additionally, the users bookmark automatically redirects to the website of the newly named
bank. Which of the following is the MOST likely cause of the issue?

  • A. The company’s web browser is not up to date
  • B. The website’s certificate still has the old bank’s name
  • C. The website was created too recently to be trusted
  • D. The website’s certificate has expired
Answer:

B

Discussions

Question 3

Upon entering an incorrect password, the logon screen displays a message informing the user that the password does not
match the username provided and is not the required length of 12 characters. Which of the following secure coding
techniques should a security analyst address with the application developers to follow security best practices?

  • A. Input validation
  • B. Error handling
  • C. Obfuscation
  • D. Data exposure
Answer:

B

Discussions

Question 4

Joe notices there are several user accounts on the local network generating spam with embedded malicious code.
Which of the following technical control should Joe put in place to BEST reduce these incidents?

  • A. Account lockout
  • B. Group Based Privileges
  • C. Least privilege
  • D. Password complexity
Answer:

A

Discussions

Question 5

A company wants to configure its wireless network to require username and password authentication. Which of the following
should the systems administrator implement?

  • A. WPS
  • B. PEAP
  • C. TKIP
  • D. PKI
Answer:

A

Discussions

Question 6

A systems administrator wants to generate a self-signed certificate for an internal website.
Which of the following steps should the systems administrator complete prior to installing the certificate on the server?

  • A. Provide the private key to a public CA.
  • B. Provide the public key to the internal CA.
  • C. Provide the public key to a public CA.
  • D. Provide the private key to the internal CA.
  • E. Provide the public/private key pair to the internal CA
  • F. Provide the public/private key pair to a public CA.
Answer:

D

Discussions

Question 7

Many employees are receiving email messages similar to the one shown below:
From IT department
To employee
Subject email quota exceeded
Pease click on the following link http:www.website.info/email.php?quota=1Gb and provide your username and password to
increase your email quota. Upon reviewing other similar emails, the security administrator realized that all the phishing URLs
have the following common elements; they all use HTTP, they all come from .info domains, and they all contain the same
URI.
Which of the following should the security administrator configure on the corporate content filter to prevent users from
accessing the phishing URL, while at the same time minimizing false positives?

  • A. BLOCK http://www.*.info/"
  • B. DROP http://"website.info/email.php?*
  • C. Redirect http://www,*. Info/email.php?quota=*TOhttp://company.com/corporate_polict.html
  • D. DENY http://*.info/email.php?quota=1Gb
Answer:

D

Discussions

Question 8

A security analyst is assessing a small companys internal servers against recommended security practices. Which of the
following should the analyst do to conduct the assessment? (Choose two.)

  • A. Compare configurations against platform benchmarks
  • B. Confirm adherence to the company’s industry-specific regulations
  • C. Review the company’s current security baseline
  • D. Verify alignment with policy related to regulatory compliance
  • E. Run an exploitation framework to confirm vulnerabilities
Answer:

C E

Discussions

Question 9

The Chief Executive Officer (CEO) received an email from the Chief Financial Officer (CFO), asking the CEO to send
financial details. The CEO thought it was strange that the CFO would ask for the financial details via email. The email
address was correct in the From section of the email. The CEO clicked the form and sent the financial information as
requested. Which of the following caused the incident?

  • A. Domain hijacking
  • B. SPF not enabled
  • C. MX records rerouted
  • D. Malicious insider
Answer:

B

Discussions

Question 10

Which of the following access management concepts is MOST closely associated with the use of a password or PIN??

  • A. Authorization
  • B. Authentication
  • C. Accounting
  • D. Identification
Answer:

B

Discussions
To page 2