Exam Report: B.8 CompTIA Security+ Certification Practice Exam
Overall Performance
Passing Score: 95%
View results by: Objective Analysis Individual Responses
Individual Responses
Question 1: Correct
Your company security policy requires separation of duties for all network security matters.
Which of the following scenarios best describes this concept?
Only the security officer can implement new border router rule sets.
Security policy authors may never fraternize with system administration personnel.
The system administrator configures remote access privileges and the security officer
reviews and activates each account.
Every change to the default system image requires concurrent processing by multiple
domain controllers.
Explanation
Separation of duties is designed to limit an individual's ability to cause severe damage or
conduct unauthorized acts alone. By limiting the scope of authority and requiring multiple
individuals to facilitate an action, exposure to malicious activity is greatly reduced. In this
scenario, requiring the security officer to approve and activate all remote access requests is the
best example of this concept.
[All Questions SecPro2017_v6.exm EMPLOYEE_MGMT_10]
Question 2: Correct
You have conducted a risk analysis to protect a key company asset. You identify the following
values:
• Asset value = 400
• Exposure factor = 75
• Annualized rate of occurrence = .25
What is the Annualized Loss Expectancy (ALE)?
25
75
100
175
, 475
Explanation
To calculate the ALE, use the following formula:
Asset value (AV) x exposure factor (EF) x Annualized Rate of Occurrence (ARO)
400 x 75% x .25 = 75
[All Questions SecPro2017_v6.exm RISK_MANAGE_10]
Question 3: Incorrect
Which of the following is an example of a decentralized privilege management solution?
Workgroup
TACACS+
Active Directory
RADIUS
Explanation
A workgroup is an example of a decentralized privilege management solution. In a workgroup,
user accounts are defined on each individual system rather than on a centralized access control
server. All of the other selections are centralized privilege management solutions.
[All Questions SecPro2017_v6.exm ACT_DIR_OVW_01]
Question 4: Correct
Which command should you use to scan for open TCP ports on your Linux system? (Tip: Enter
the command as if at the command prompt.)
Explanation
Use nmap -sT to scan for open TCP ports. Open ports can provide information about which
operating system a computer uses and might provide entry points or information about ways to
formulate an attack.
Use nmap -sU to scan for open UDP ports.
[All Questions SecPro2017_v6.exm LINUX_HOST_SEC_01]
Question 5: Correct
Which of the following is an advantage of a virtual browser?
Prevents phishing and drive-by downloads
Filters internet content based on ratings
Prevents adware and spyware that monitors your internet activity
Protects the host operating system from malicious downloads
Explanation
A virtual browser operates within a security sandbox that keeps activities within the browser
from affecting the rest of the system. For example, malware downloaded by the virtual browser
is limited to security sandbox and cannot harm the operating system.
,The virtual browser does not prevent adware, spyware, or phishing; these threats are still
possible within the virtual browser. However, if malware is installed within the virtual session, the
malware cannot harm the rest of the system, and the virtual browser can be easily restored to
remove the maliecious s0oftware.exm HOST_VIRT_04]
Question 6: Correct
Which of the following is not an example of a single sign-on solution?
Workgroup
Scripted access
Kerberos
Directory services
Explanation
A workgroup is not a form of single sign-on. Each time you visit or access a resource on another
system, you must authenticate to that system.
Kerberos, directory services, and some forms of scripted access are single sign-on solutions.
After you provide your login credentials, you are not required to provide them again as long as
you remain within the same security realm.
[All Questions SecPro2017_v6.exm AUTH_10]
Question 7: Correct
In which phase of the system life cycle is security integrated into the product?
Project initiation
Maintenance
Installation
Software development
Explanation
Security is integrated into the product in the very first phase, project initiation.
Security is integrated into the project in the very first phase of the software life cycle, waiting
until any later stage makes security more costly and less effective and reliable. Therefore,
maintenance, installation, and software development phases are too late to integrate security.
[All Questions SecPro2017_v6.exm APP_DEV_DEPLOY_05]
Question 8: Correct
Which of the following switch attacks associates the attacker's MAC address with the IP address
of the victim's devices?
ARP spoofing/poisoning
Cross-site scripting
DNS poisoning
MAC spoofing
, Explanation
ARP spoofing/poisoning associates the attacker's MAC address with the IP address of the victim.
[All Questions SecPro2017_v6.exm SWITCH_ATTACKS_02]
Question 9: Correct
Drag the software-defined networking (SDN) layer on the left to the appropriate function on the
right. (Each SDN layer may be used once, more than once, or not at all.)
This layer receives its requests from the application layer.
Control layer
This layer is also known as the infrastructure layer.
Physical layer
This layer communicates with the control layer through what’s called the northbound
interface.
Application layer
This layer provides the physical layer with configuration and instructions.
Control layer
On this layer, individual networking devices use southbound APIs to communicate with the
control plane.
Physical layer
Explanation
The SDN architecture consists of three layers:
• Application layer: Communicates with the control layer through the northbound interface.
These are sometimes called northbound APIs.
• Control layer: Receives its requests from the application layer and then provides the
physical layer with its configuration and instructions.
• Physical layer: Communicates to the control layer through the. southbound interface. The
individual networking devices use southbound APIs to communicate with the control plane
and vice versa. Even though this is called the physical layer, it is where both physical and
virtual network devices sit. (Also known as the infrastructure layer.)
[All Questions SecPro2017_v6.exm NET_DESIGN_02]
Question 10: Correct
Your organization recently purchased 18 iPad tablets for use by the organization's management
team. These devices have iOS pre-installed on them.
To increase the security of these devices, you want to apply a default set of security-related
configuration settings.
What is the best approach to take to accomplish this? (Select two. Each option is a part of a
complete solution.)
Enroll the devices in a mobile device management system
Configure and apply security policy settings in a mobile device management system
Require uses to install the configuration profile
Overall Performance
Passing Score: 95%
View results by: Objective Analysis Individual Responses
Individual Responses
Question 1: Correct
Your company security policy requires separation of duties for all network security matters.
Which of the following scenarios best describes this concept?
Only the security officer can implement new border router rule sets.
Security policy authors may never fraternize with system administration personnel.
The system administrator configures remote access privileges and the security officer
reviews and activates each account.
Every change to the default system image requires concurrent processing by multiple
domain controllers.
Explanation
Separation of duties is designed to limit an individual's ability to cause severe damage or
conduct unauthorized acts alone. By limiting the scope of authority and requiring multiple
individuals to facilitate an action, exposure to malicious activity is greatly reduced. In this
scenario, requiring the security officer to approve and activate all remote access requests is the
best example of this concept.
[All Questions SecPro2017_v6.exm EMPLOYEE_MGMT_10]
Question 2: Correct
You have conducted a risk analysis to protect a key company asset. You identify the following
values:
• Asset value = 400
• Exposure factor = 75
• Annualized rate of occurrence = .25
What is the Annualized Loss Expectancy (ALE)?
25
75
100
175
, 475
Explanation
To calculate the ALE, use the following formula:
Asset value (AV) x exposure factor (EF) x Annualized Rate of Occurrence (ARO)
400 x 75% x .25 = 75
[All Questions SecPro2017_v6.exm RISK_MANAGE_10]
Question 3: Incorrect
Which of the following is an example of a decentralized privilege management solution?
Workgroup
TACACS+
Active Directory
RADIUS
Explanation
A workgroup is an example of a decentralized privilege management solution. In a workgroup,
user accounts are defined on each individual system rather than on a centralized access control
server. All of the other selections are centralized privilege management solutions.
[All Questions SecPro2017_v6.exm ACT_DIR_OVW_01]
Question 4: Correct
Which command should you use to scan for open TCP ports on your Linux system? (Tip: Enter
the command as if at the command prompt.)
Explanation
Use nmap -sT to scan for open TCP ports. Open ports can provide information about which
operating system a computer uses and might provide entry points or information about ways to
formulate an attack.
Use nmap -sU to scan for open UDP ports.
[All Questions SecPro2017_v6.exm LINUX_HOST_SEC_01]
Question 5: Correct
Which of the following is an advantage of a virtual browser?
Prevents phishing and drive-by downloads
Filters internet content based on ratings
Prevents adware and spyware that monitors your internet activity
Protects the host operating system from malicious downloads
Explanation
A virtual browser operates within a security sandbox that keeps activities within the browser
from affecting the rest of the system. For example, malware downloaded by the virtual browser
is limited to security sandbox and cannot harm the operating system.
,The virtual browser does not prevent adware, spyware, or phishing; these threats are still
possible within the virtual browser. However, if malware is installed within the virtual session, the
malware cannot harm the rest of the system, and the virtual browser can be easily restored to
remove the maliecious s0oftware.exm HOST_VIRT_04]
Question 6: Correct
Which of the following is not an example of a single sign-on solution?
Workgroup
Scripted access
Kerberos
Directory services
Explanation
A workgroup is not a form of single sign-on. Each time you visit or access a resource on another
system, you must authenticate to that system.
Kerberos, directory services, and some forms of scripted access are single sign-on solutions.
After you provide your login credentials, you are not required to provide them again as long as
you remain within the same security realm.
[All Questions SecPro2017_v6.exm AUTH_10]
Question 7: Correct
In which phase of the system life cycle is security integrated into the product?
Project initiation
Maintenance
Installation
Software development
Explanation
Security is integrated into the product in the very first phase, project initiation.
Security is integrated into the project in the very first phase of the software life cycle, waiting
until any later stage makes security more costly and less effective and reliable. Therefore,
maintenance, installation, and software development phases are too late to integrate security.
[All Questions SecPro2017_v6.exm APP_DEV_DEPLOY_05]
Question 8: Correct
Which of the following switch attacks associates the attacker's MAC address with the IP address
of the victim's devices?
ARP spoofing/poisoning
Cross-site scripting
DNS poisoning
MAC spoofing
, Explanation
ARP spoofing/poisoning associates the attacker's MAC address with the IP address of the victim.
[All Questions SecPro2017_v6.exm SWITCH_ATTACKS_02]
Question 9: Correct
Drag the software-defined networking (SDN) layer on the left to the appropriate function on the
right. (Each SDN layer may be used once, more than once, or not at all.)
This layer receives its requests from the application layer.
Control layer
This layer is also known as the infrastructure layer.
Physical layer
This layer communicates with the control layer through what’s called the northbound
interface.
Application layer
This layer provides the physical layer with configuration and instructions.
Control layer
On this layer, individual networking devices use southbound APIs to communicate with the
control plane.
Physical layer
Explanation
The SDN architecture consists of three layers:
• Application layer: Communicates with the control layer through the northbound interface.
These are sometimes called northbound APIs.
• Control layer: Receives its requests from the application layer and then provides the
physical layer with its configuration and instructions.
• Physical layer: Communicates to the control layer through the. southbound interface. The
individual networking devices use southbound APIs to communicate with the control plane
and vice versa. Even though this is called the physical layer, it is where both physical and
virtual network devices sit. (Also known as the infrastructure layer.)
[All Questions SecPro2017_v6.exm NET_DESIGN_02]
Question 10: Correct
Your organization recently purchased 18 iPad tablets for use by the organization's management
team. These devices have iOS pre-installed on them.
To increase the security of these devices, you want to apply a default set of security-related
configuration settings.
What is the best approach to take to accomplish this? (Select two. Each option is a part of a
complete solution.)
Enroll the devices in a mobile device management system
Configure and apply security policy settings in a mobile device management system
Require uses to install the configuration profile
