CompTIA Security+ Practice Test (SY0-701)

The malware found is a Keylogger. It records the input typed by the user and, in this case, recorded user account credentials (username and password) . Situations like this are common when companies allow Bring Your Own Device (BYOD), as network administrators have very limited control over devices not owned by the company. A RAT (Remote Access Trojan) is incorrect because its primary function is to provide remote control, though it may include keylogging capabilities; "Keylogger" is more specific to the described function . A Worm's primary characteristic is self-replication across a network, which is not described . A Virus attaches itself to other programs to replicate, which is too general and not the best description .

A packet capture involves collecting all the packets that pass through a certain point on a network. It allows security professionals to see the data being transmitted over the network, which can be valuable for analyzing traffic, troubleshooting network problems, or investigating security incidents. Examining packet contents helps to identify malicious activities, policy violations, or unauthorized data exfiltration. It's a detailed form of network monitoring used to closely inspect network traffic.

Using a standardized security configuration guide specifically designed for the intended system or platform is the best method to establish a secure baseline. These guides, often developed by experts and incorporating industry best practices, ensure that all devices start from a common, secure state before being introduced into the production environment. They typically include settings and configurations that have been widely recognized and vetted for their effectiveness in securing devices. While patching, encryption, and decommissioning play roles in the lifecycle of maintaining security for active devices, they are not methods used for establishing the baseline itself.

Likelihood refers to the probability that a potential vulnerability could be exploited by a threat actor within a given time frame. Calculating likelihood involves evaluating how exposed the vulnerability is, the presence and capabilities of threat actors, the effectiveness of current controls, and the historical data of security incidents similar to the one being assessed. While options such as evaluating the impact of the threat and considering the cost of potential security controls are also parts of risk assessment, they do not directly relate to the determination of likelihood.

The correct answer is a Distributed Denial-of-Service (DDoS) attack. DDoS attacks aim to make an online service unavailable by overwhelming it with traffic from multiple sources, disrupting legitimate user access. Credential Replay involves reusing stolen credentials to gain unauthorized access, DNS Spoofing redirects traffic to malicious sites, and Wireless Eavesdropping intercepts wireless communications. None of these directly cause service unavailability through traffic overload.

Implementing multi-factor authentication (MFA) provides a powerful defense against unauthorized access, as it requires users to provide two or more verification factors to gain access to resources, thus protecting against compromised credentials. Email encryption is a security measure that protects the contents of emails but does not secure access to collaboration tools and resources. While limiting connection times could potentially reduce the window of opportunity for an attack, it would not be practical for collaboration needs and does not strengthen authentication methods. The frequency of changing passwords, without the additional step of verifying the user's identity, may be less effective against sophisticated attacks.

The correct answer is that an unnecessary open port increases the system's attack surface. Even if no legitimate service is running on the port, it can be probed by attackers using techniques like port scanning. This can reveal information about the operating system and attract further attacks, such as brute-force attempts or the exploitation of a vulnerability if a service is ever misconfigured or a malicious one is installed on that port. Unused ports do not inherently consume significant resources, cause data exfiltration, or block legitimate traffic to other services. Best practice is to close all unused ports to minimize the attack surface.

Granting standard employees local administrator rights exceeds what they need for their daily tasks and dramatically enlarges the potential attack surface, so it violates the principle of least privilege. The other options either restrict access to only what is required or provide temporary elevated rights that are revoked afterward, which aligns with the principle.

An 'Ad Hoc' risk assessment is performed as required, without a regular schedule, often in response to significant changes or new threats to an organization's environment. It contrasts with recurring or continuous assessments that happen at regular intervals or constantly, respectively. A 'Qualitative' risk assessment refers to the process that prioritizes risks based on their severity and impact, rather than their frequency or timing.

The programmer created a backdoor in the application to grant themselves access later on. The backdoor allowed them to bypass the application's usual authentication measures. A backdoor could also be set up by a malicious application, but in this case, it was the work of a lazy programmer who knew he would be fired soon.

The specific behaviors outlined – notably the unanticipated system slowdowns, printing of documents without user commands, and unwarranted system restarts – are classic manifestations of a virus infection on a computer. A virus typically engages system resources, causing performance degradation, and can execute unauthorized tasks such as issuing print jobs or rebooting the computer. The cross-departmental propagation suggests the virus could be disseminating through mediums such as network drives, emails, or compromised files. A simple misconfiguration is unlikely to result in this diverse set of symptoms manifesting similarly across multiple disparate departments. While hardware failure can cause system issues, it would not lead to network-wide symptoms. Script kiddie activities, typically representing low-skill-level threats often using pre-made tools, would not commonly result in the widespread and uniform symptoms seen here.

A decentralized architecture spreads out processing and decision-making across multiple network points, which can provide resilience and reduce single points of failure. This is contrasted with a centralized architecture, where processes and decision-making are conducted in a single central location, which can become a single point of failure and may pose more risk if not adequately secured.

A salt in cryptography refers to a randomly generated value that is added to the password before hashing. The salt is not intended to remain secret; its primary purpose is to be unique for each user's password. This uniqueness prevents attackers from using precomputed tables (such as rainbow tables) to reverse hash values into passwords. It also ensures that even if two users have the same password, their hashed values will be distinct.

Employing an encrypted tunneling protocol is the best option for securing data sent across a public network because it encloses the data in an encrypted 'tunnel,' ensuring confidentiality and integrity while also providing a means of authenticating the parties involved. Only authorized users can access the tunnel, preventing unauthorized interception or alteration of data. Encrypted email services provide security for email message contents but are not comprehensive for all company data in transit. An encrypted file transfer would secure individual file transfers but lacks the full communication authentication features of a tunneling protocol. Meanwhile, solely digitally signing the documents secures authenticity and integrity, but does not encrypt the actual data contents, leaving them vulnerable if intercepted during transmission.

A next-generation firewall (NGFW) combines the functionality of a traditional firewall with an IPS to provide additional security.