CompTIA Security+ Practice Quiz - 10 Real Questions

Summary

In this video, Dennis from CyberCraft walks viewers through a CompTIA practice quiz, explaining his thought process behind each question. He demonstrates how to carefully analyze questions, identify key terms, and select the correct answers. Throughout the quiz, Dennis emphasizes the importance of reading each question thoroughly, considering different possible answers, and understanding the context behind technical terms. His approach not only helps with answering individual questions but also provides valuable strategies for studying and preparing for CompTIA certification exams, making this a useful resource for anyone preparing for Security+ or similar certifications.

Takeaways

• 😀 Always read the question multiple times to fully understand it before selecting an answer.
• 😀 Focus on keywords in the question (like 'lock symbol', 'contact email', etc.) to identify the nature of the attack (e.g., ransomware).
• 😀 When configuring firewall rules, ensure the source and destination IP addresses are correctly identified to block unwanted traffic.
• 😀 Unskilled attackers typically use common, publicly available tools to attempt attacks, which is why they are less sophisticated.
• 😀 Non-repudiation refers to ensuring that actions cannot be denied by the user, particularly in auditing and logging systems.
• 😀 Preventative controls (e.g., firewalls, encryption) are the most effective in decreasing the likelihood of a cyber security breach.
• 😀 Bug bounty programs are effective in improving security by compensating individuals who identify vulnerabilities in applications.
• 😀 Always ensure you are clear on the final step of any process (e.g., 'Lessons Learned' in incident response) to correctly identify where the action fits.
• 😀 Read all available answer choices carefully, as one word or phrase can change the entire meaning of the question.
• 😀 Backup systems are crucial in restoring data after a ransomware attack, provided traditional recovery methods are available.
• 😀 When working with third-party penetration testers, ensure that 'Rules of Engagement' are clearly defined, outlining the terms of the test.

Q & A

What is the first step Dennis takes when approaching each question in the practice quiz?

Dennis reads the question twice to ensure he understands it fully and then rephrases it to confirm his comprehension before proceeding.

Why does Dennis choose 'ransomware' as the answer to the first question about missing files and a lock symbol?

He identifies the 'lock symbol' and the requirement for users to contact an email address for access as common signs of a ransomware attack, where attackers demand payment for restoring access.

What is Dennis's approach when setting up a firewall rule to block a malicious IP address?

Dennis selects the correct firewall rule, ensuring that the source IP address is blocked from accessing the organization's network while keeping the destination address set to any.

Which type of threat actor is most likely to use common hacking tools found on the internet?

Dennis concludes that an 'unskilled attacker' would be most likely to use publicly available tools, as their skill level is not advanced enough for custom attacks.

What does Dennis identify as the goal of the system administrator who wants to make it difficult for someone to deny performing an action?

Dennis identifies the goal as 'non-repudiation', which involves recording actions or auditing them to ensure users cannot deny performing an action.

Which control type does Dennis believe decreases the likelihood of a cybersecurity breach occurring?

Dennis selects 'preventative control' as the best option, as it is designed to reduce the likelihood of a breach happening in the first place.

What is the term Dennis uses to describe the program where a company compensates researchers for discovering vulnerabilities?

Dennis identifies the program as a 'bug bounty,' where security researchers are rewarded for finding and reporting vulnerabilities in the company's systems.

In the context of incident response, which is the final step in the process according to Dennis?

The final step is 'Lessons Learned,' where the organization captures and reviews what was learned during the incident response process to improve future responses.

What is the correct term Dennis uses to refer to the agreement outlining the terms of a penetration test with a third-party tester?

Dennis refers to the agreement as the 'Rules of Engagement,' which clearly defines the scope, boundaries, and objectives of the penetration test.

When a company uses a VPN to connect its headquarters and branch locations, what type of data is it primarily protecting?

Dennis identifies that the VPN is primarily protecting 'data in transit,' which refers to the data being transmitted over the network, such as communication between branch offices.