Mike Chapple - CompTIA CySA+ Practice Tests

219 Joe discovered a critical vulnerability in his organization's database server and received permission from his supervisor to implement an emergency change after the close of business. He has eight hours before the planned change window. In addition to planning the technical aspects of the change, what else should Joe do to prepare for the change?Ensure that all stakeholders are informed of the planned outage.Document the change in his organization's change management system.Identify any potential risks associated with the change.All of the above.

220 Julian recently detected the vulnerability shown here on several servers in his environment. Because of the critical nature of the vulnerability, he would like to block all access to the affected service until it is resolved using a firewall rule. He verifies that the following TCP ports are open on the host firewall. Which one of the following does Julian not need to block to restrict access to this service?137139389445

221 Ted recently ran a vulnerability scan of his network and was overwhelmed with results. He would like to focus on the most important vulnerabilities. How should Ted reconfigure his vulnerability scanner?Increase the scan sensitivity.Decrease the scan sensitivity.Increase the scan frequency.Decrease the scan frequency.

222 After running a vulnerability scan, Janet discovered that several machines on her network are running Internet Explorer 8 and reported the vulnerability shown here. Which one of the following would not be a suitable replacement browser for these systems?Internet Explorer 11Google ChromeMozilla FirefoxMicrosoft Edge

223 Sunitha discovered the vulnerability shown here in an application developed by her organization. What application security technique is most likely to resolve this issue?Bounds checkingNetwork segmentationParameter handlingTag removal

224 Sherry runs a vulnerability scan and receives the high-level results shown here. Her priority is to remediate the most important vulnerabilities first. Which system should be her highest priority?ABCD

225 Victor is configuring a new vulnerability scanner. He set the scanner to run scans of his entire datacenter each evening. When he went to check the scan reports at the end of the week, he found that they were all incomplete. The scan reports noted the error “Scan terminated due to start of preempting job.” Victor has no funds remaining to invest in the vulnerability scanning system. He does want to cover the entire datacenter. What should he do to ensure that scans complete?Reduce the number of systems scanned.Increase the number of scanners.Upgrade the scanner hardware.Reduce the scanning frequency.

226 Vanessa ran a vulnerability scan of a server and received the results shown here. Her boss instructed her to prioritize remediation based on criticality. Which issue should she address first?Remove the POP server.Remove the FTP server.Upgrade the web server.Remove insecure cryptographic protocols.

227 Gil is configuring a scheduled vulnerability scan for his organization using the QualysGuard scanner. If he selects the Relaunch On Finish scheduling option shown here, what will be the result?The scan will run once each time the schedule occurs.The scan will run twice each time the schedule occurs.The scan will run twice the next time the schedule occurs and once on each subsequent schedule interval.The scan will run continuously until stopped.

228 Terry is reviewing a vulnerability scan of a Windows server and came across the vulnerability shown here. What is the risk presented by this vulnerability?An attacker may be able to execute a buffer overflow and execute arbitrary code on the server.An attacker may be able to conduct a denial-of-service attack against this server.An attacker may be able to determine the operating system version on this server.There is no direct vulnerability, but this information points to other possible vulnerabilities on the server.

229 Andrea recently discovered the vulnerability shown here on the workstation belonging to a system administrator in her organization. What is the major likely threat that should concern Andrea?An attacker could exploit this vulnerability to take control of the administrator's workstation.An attacker could exploit this vulnerability to gain access to servers managed by the administrator.An attacker could exploit this vulnerability to prevent the administrator from using the workstation.An attacker could exploit this vulnerability to decrypt sensitive information stored on the administrator's workstation.

230 Mateo completed the vulnerability scan of a server in his organization and discovered the results shown here. Which one of the following is not a critical remediation action dictated by these results?Remove obsolete software.Reconfigure the host firewall.Apply operating system patches.Apply application patches.

231 Tom's company is planning to begin a bring your own device (BYOD) policy for mobile devices. Which one of the following technologies allows the secure use of sensitive information on personally owned devices, including providing administrators with the ability to wipe corporate information from the device without affecting personal data?Remote wipeStrong passwordsBiometric authenticationContainerization

232 Sally discovered during a vulnerability scan that a system that she manages has a high-priority vulnerability that requires a patch. The system is behind a firewall and there is no imminent threat, but Sally wants to get the situation resolved as quickly as possible. What would be her best course of action?Initiate a high-priority change through her organization's change management process.Implement a fix immediately and then document the change after the fact.Implement a fix immediately and then inform her supervisor of her action and the rationale.Schedule a change for the next quarterly patch cycle.

233 Gene runs a vulnerability scan of his organization's datacenter and produces a summary report to share with his management team. The report includes the chart shown here. When Gene's manager reads the report, she points out that the report is burying important details because it is highlighting too many unimportant issues. What should Gene do to resolve this issue?Tell his manager that all vulnerabilities are important and should appear on the report.Create a revised version of the chart using Excel.Modify the sensitivity level of the scan.Stop sharing reports with the management team.

234 Avik recently conducted a PCI DSS vulnerability scan of a web server and noted a critical PHP vulnerability that required an upgrade to correct. She applied the update. How soon must Avik repeat the scan?Within 30 daysAt the next scheduled quarterly scanAt the next scheduled annual scanImmediately

235 Chandra's organization recently upgraded the firewall protecting the network where they process credit card information. This network is subject to the provisions of PCI DSS. When is Chandra required to schedule the next vulnerability scan of this network?ImmediatelyWithin one monthBefore the start of next monthBefore the end of the quarter following the upgrade

236 Fahad is concerned about the security of an industrial control system that his organization uses to monitor and manage systems in their factories. He would like to reduce the risk of an attacker penetrating this system. Which one of the following security controls would best mitigate the vulnerabilities in this type of system?Network segmentationInput validationMemory protectionRedundancy

237 Glenda routinely runs vulnerability scans of servers in her organization. She is having difficulty with one system administrator who refuses to correct vulnerabilities on a server used as a jump box by other IT staff. The server has had dozens of vulnerabilities for weeks and would require downtime to repair. One morning, her scan reports that all of the vulnerabilities suddenly disappeared overnight, while other systems in the same scan are reporting issues. She checks the service status dashboard, and the service appears to be running properly with no outages reported in the past week. What is the most likely cause of this result?The system administrator corrected the vulnerabilities.The server is down.The system administrator blocked the scanner.The scan did not run.