A penetration tester finds an unused Ethernet port during an on-site penetration test. Upon plugging a device into the unused port, the penetration tester notices that the machine is assigned an IP address, allowing the tester to enumerate the local network. Which of the following should an administrator implement in order to prevent this situation from happening in the future?
Answer(s): A
Port security is a network security feature that restricts input to an Ethernet port based on MAC addresses, which helps prevent unauthorized devices from gaining access to the network. By implementing port security, administrators can control which devices are allowed to connect to specific network ports, preventing unauthorized access through unused or untrusted ports. This measure would have prevented the penetration tester from gaining access to the local network by plugging into an unused port.
Which of the following should be used to ensure an attacker is unable to read the contents of a mobile device's drive if the device is lost?
Answer(s): C
Full Disk Encryption (FDE) ensures that all data on a mobile device's drive is encrypted, making it unreadable without the proper decryption key. If the device is lost or stolen, the data remains protected because the contents of the drive are encrypted and cannot be accessed without the appropriate credentials. This is the most effective method to protect the data in case of device loss.
A security administrator documented the following records during an assessment of network services:Two weeks later, the administrator performed a log review and noticed the records were changed as follows:When consulting the service owner, the administrator validated that the new address was not part of the company network. Which of the following was the company most likely experiencing?
Answer(s): B
DNS poisoning (also known as DNS cache poisoning) involves an attacker manipulating DNS records, redirecting traffic to malicious destinations. In this case, the change in the DNS records to an IP address outside the company's network suggests that the attacker may have poisoned the DNS cache or altered the DNS records to reroute traffic, potentially leading to a malicious site or server.This is not a DDoS attack, ransomware compromise, or spyware infection as the primary issue appears to be manipulation of DNS records, which is characteristic of DNS poisoning.
Which of the following is the primary reason why false negatives on a vulnerability scan should be a concern?
False negatives in vulnerability scanning occur when the scan fails to detect existing vulnerabilities. This is a concern because it means that the system has vulnerabilities, but they are not being identified and addressed, leaving the system potentially exposed to exploitation. Unlike false positives, which result in wasted time on vulnerabilities that aren't actually present, false negatives directly impact security by failing to identify real risks.
A company is concerned about theft of client data from decommissioned laptops. Which of the following is the most cost-effective method to decrease this risk?
Wiping is the most cost-effective method to decrease the risk of client data theft from decommissioned laptops. Wiping involves using software tools to securely erase all data on the hard drive, making it unrecoverable. This ensures that sensitive information cannot be accessed, even if the laptop is later reused or disposed of. Compared to shredding (which involves physical destruction and is more costly) or simple deletion (which does not truly erase the data), wiping is an effective, inexpensive way to mitigate the risk.
Post your Comments and Discuss CompTIA SY0-701 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SY0-701 content, but please register or login to continue.