CompTIA Security+ Practice Test (SY0-701)

Changing default credentials is an essential security measure to prevent unauthorized access, as many attack vectors involve using known defaults to gain control over systems. Attackers often rely on databases of default usernames and passwords-such as those exploited by the Mirai botnet-to compromise devices that have not had their credentials changed from the manufacturer's defaults. Regularly updating device passwords to complex, unique values greatly reduces this risk. Conducting a vulnerability scan or updating firmware, while important, would not address the immediate exposure created by default credentials. Disabling remote management could limit some attack vectors but still leaves the device vulnerable if the credentials remain unchanged.

Security policies and procedures should be treated as living documents. The best practice is to review them on a regular, scheduled basis (e.g., annually) and also whenever significant changes occur. Significant changes can include new regulatory requirements, major shifts in technology (like adopting a new cloud platform), emerging threats, or lessons learned from security incidents. Reviewing them only after a major incident is a reactive approach that fails to proactively address risks. While events like the introduction of a new technology or fiscal year planning might trigger reviews, a comprehensive approach involves both periodic reviews and event-driven updates.

Endpoint protection software's role as a system hardening technique is to enhance the security of individual devices within a network by providing a combination of various security measures against threats such as malware, exploits, and unauthorized access attempts. It typically includes functionalities like antivirus, antimalware, and personal firewalls. The correct answer encapsulates these capabilities. The incorrect answers either misrepresent the scope of endpoint protection or attribute unrelated functions to it.

A salt in cryptography refers to a randomly generated value that is added to the password before hashing. The salt is not intended to remain secret; its primary purpose is to be unique for each user's password. This uniqueness prevents attackers from using precomputed tables (such as rainbow tables) to reverse hash values into passwords. It also ensures that even if two users have the same password, their hashed values will be distinct.

A directory traversal attack, also known as path traversal, involves an attacker manipulating variables that reference files with dot-dot-slash (../) sequences to access restricted directories. This can lead to unauthorized viewing of sensitive files or execution of commands located outside of the web server's document root directory. SQL injection targets databases, buffer overflows target memory allocation, and cross-site scripting involves injecting malicious scripts into websites for users to execute; none of these match the described threat.

This scenario describes a phishing attack that is conducted through SMS messages, commonly known as 'SMS phishing' or by its other name Smishing. Both 'Spyware Installation' and 'Direct Malware Injection' can be results of this kind of attack if the recipient takes the bait, but they are not names of the attack method itself. 'Exploit Kits via MMS' involve multimedia content and are not the same as text-based phishing attacks.

Account lockouts are an effective mitigation strategy against brute force attacks because they prevent unlimited, rapid guessing of passwords by locking the account after a certain number of failed login attempts. This drastically reduces the attacker's ability to systematically try all possible password combinations, thus safeguarding against brute force attacks. While all other options can enhance security, they do not specifically address the prevention of brute force attacks on passwords as directly as account lockouts do. Strong password policies make it more difficult for brute force attacks to succeed but do not stop attempts. Monitoring for unauthorized access can detect an ongoing attack but may not prevent it. Disabling unused accounts helps reduce the attack surface but does not directly prevent a brute force attack on active accounts.

Containment techniques are options for limiting the spread of malware after it has been discovered on a network. The best response is to isolate any systems that are infected or believed to be infected so they cannot propagate the malware to other systems. From the security and IT teams can begin determining the impact and remediation options.

An unauthorized user attempting to access confidential files can be detected through application logs by the presence of multiple failed login attempts followed by a successful login, especially if the timestamps of these events suggest that they occurred in rapid succession. This could imply a brute force attack or the compromise of legitimate credentials. It's essential to investigate such anomalies to prevent potential data breaches. Repeated timeouts suggest a denial of service condition but don't necessarily indicate unauthorized file access, while connection errors and single login failures are common and might not represent security incidents.

Resilience refers to the ability of a system to continue to operate properly in the face of adversity. This can include redundancy, fault tolerance, and robust design choices that allow a system to endure and recover from disruptions. Scalability refers to the capacity of a system to handle growth, while maintainability concerns the ease with which a system can be kept operational. Responsiveness measures how quickly a system reacts to input.

Shadow IT refers to hardware or software deployed on a network that is not authorized or managed by the IT department. This scenario is a classic example of Shadow IT. While it is a form of an insider threat, 'Shadow IT' is the more specific and accurate term, as the employee's intent was not overtly malicious.

Full disk encryption (FDE) is the correct choice as it provides comprehensive encryption of all data on the storage medium, ensuring that without the appropriate decryption key, no data can be read, regardless of the system state or whether the storage device is transferred to another machine. Encrypting individual files, while useful, does not offer the same level of protection if an attacker gains access to the underlying file system. Encrypting data using a VPN only secures data in transit, not at rest. SSL/TLS also protects data in transit and does not apply to data at rest.

Changing the default credentials of a router is the most effective first step in securing a router because factory-set usernames and passwords are often well-known and easily discoverable by malicious actors. Manufacturers often use the same default credentials across similar router models, which can be easily exploited if not changed. While other hardening steps like disabling unused ports and keeping firmware updated are important, an easily guessable default password presents the most immediate and critical vulnerability.

A honeypot is designed to appear as a vulnerable system to attract attackers. By mimicking services and recording interactions, it allows organizations to study attack methods without compromising actual assets. While an intrusion detection system monitors network traffic for suspicious activity, it does not simulate vulnerable services. A firewall configured with logging controls access but doesn't engage attackers to gather intelligence. A vulnerability scanner identifies weaknesses but doesn't record attacker interactions.

A fraudulent access point that appears to be legitimate used by an attacker to gain access to network traffic is called an evil twin. The attacker can possibly can access to information such as passwords and PII.

Change management is an operational control that provides a structured approach for handling modifications to systems. It ensures that all changes are properly reviewed, tested, and approved before implementation, minimizing the risk of disruptions. Intrusion detection is a technical control that monitors for security breaches, security awareness training is a managerial control focused on educating staff, and encryption protocols are technical controls for data protection. Therefore, change management is the most effective operational control for managing system updates and modifications in day-to-day operations.

An Uninterruptible Power Supply provides immediate backup power to connected systems in the event of a power failure, ensuring continuity of operations for a short duration. This allows for continued operation during brief outages and can signal connected devices to execute a safe shutdown process if the outage is prolonged, preserving data integrity. In contrast, surge protectors do not provide backup power but only protect against voltage spikes. Generators may supply power for extended outages but typically have a startup delay and do not supply power instantaneously. Redundant power circuits offer resilience to a failure in one circuit but do not address an outage affecting all primary power sources.

Pretexting involves the creation of a fabricated scenario designed to persuade a victim to release information or perform some action. In this case, the attacker is pretending to be a familiar and legitimate entity—such as an IT department representative—to gain the trust of the employee and obtain sensitive information. This is a common tactic where attackers carefully craft a believable story that seems legitimate to the victim.

The Incident Response Policy is designed to provide a framework for reporting and managing security incidents, which includes vulnerabilities. Implementing this policy helps establish clear procedures for employees to follow in the event of a security weakness, ensuring a coherent and swift response. The Disaster Recovery and Business Continuity policies are concerned with maintaining operations during and after a disaster, not the reporting of vulnerabilities. Change Management policies guide the process for system changes but are not specific to security incident reporting.

For devices that are often off the company's network, a client-based solution, which involves installing an agent on each device, is most effective. This agent can perform vulnerability assessments independently of the device's network connection. Agentless solutions, on the other hand, require that devices be connected to the network for assessments to occur, which is not practical for a mobile workforce.