CompTIA Security+ Question D-14

A security administrator has concerns that employees are installing unapproved applications on their company provide smartphones. Which of the following would BEST mitigate this?

A. Implement remote wiping user acceptance policies
B. Disable removable storage capabilities
C. Implement an application whitelist
D. Disable the built-in web browsers

Answer: C

CompTIA Security+ Question C-42

A security administrator develops a web page and limits input into the fields on the web page as well as filters special characters in output. The administrator is trying to prevent which of the following attacks?

A. Spoofing
B. XSS
C. Fuzzing
D. Pharming

Answer: B

Explanation:
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug-in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user.

By validating user input and preventing special characters, we can prevent the injection of client-side scripting code.

CompTIA Security+ Question B-78

Recent data loss on financial servers due to security breaches forced the system administrator to harden their systems. Which of the following algorithms with transport encryption would be implemented to provide the MOST secure web connections to manage and access these servers?

A. SSL
B. TLS
C. HTTP
D. FTP

Answer: B

Explanation:
Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols designed to provide communications security over a computer network. Transport Layer Security (TLS) is a security protocol that expands upon SSL. Many industry analysts predict that TLS will replace SSL in the future. TLS 1.0 was first defined in RFC 2246 in January 1999 as an upgrade of SSL Version 3.0. As of February 2015, the latest versions of all major web browsers support TLS 1.0, 1.1, and 1.2, have them enabled by default.

CompTIA Security+ Question B-69

Which of the following transportation encryption protocols should be used to ensure maximum security between a web browser and a web server?

A. SSLv2
B. SSHv1
C. RSA
D. TLS

Answer: D

Explanation:
* HTTP Secure HTTP Secure (HTTPS) is the protocol used for “secure” web pages that users should see when they must enter personal information such as credit card numbers, passwords, and other identifiers. It combines HTTP with SSL/TLS to provide encrypted communication. Transport Layer Security (TLS) is a security protocol that expands upon SSL. Many industry analysts predict that TLS will replace SSL, and it is also referred to as SSL 3.1.

CompTIA Network+ Question B-70

After repairing a computer infected with malware, a technician determines that the web browser fails to go to the proper address for some sites. Which of the following should be checked?

A. Server host file
B. Subnet mask
C. Local hosts file
D. Duplex settings

Correct Answer: C

Explanation:
The local hosts file is a text file that contains hostname-to-IP address mappings. By default, host to IP address mappings that are configured in the Hosts file supersede the information in DNS. If there is an entry for a domain name in the Hosts file, then the server will not attempt to query DNS servers for that name. Instead, the IP address that is configured in the Hosts file will be used. If the IP address corresponding to a name changes and the Hosts file is not updated, you may be unable to connect to the host.

CompTIA Network+ Question A-97

A technician needs to secure web traffic for a new e-commerce website. Which of the following will secure traffic between a web browser and a website?

A. SSL
B. DNSSEC
C. WPA2
D. MTU

Correct Answer: A

Explanation:
Secure Sockets Layer (SSL) provides cryptography and reliability for upper layers (Layers 5–7) of the OSI model. SSL (and TLS) provide secure web browsing (web traffic) via Hypertext Transfer Protocol Secure (HTTPS).

CompTIA Network+ Question A-85

A network technician is diagnosing a time-out issue generated from an end user’s web browser. The web browser issues standard HTTP get and post commands to interact with the website. Given this information, the technician would like to analyze the entire TCP handshake of the HTTP requests offline. Which of the following tools would allow the technician to view the handshake?

A. Packet analyzer
B. Port analyzer
C. SNMP traps
D. Spectrum analyzer

Correct Answer: A

CompTIA A+ Core 2 Question J-97

Phishing is:

A. An infection that causes a web browser to go to a different site than the one intended from a search result page.
B. A technique used to obtain financial information from a user mimicking a legitimate website.
C. An infection that causes a computer to behave erratically by playing music and launching browser windows.
D. A technique used to obtain financial information from a user by compiling information from social networks and their friends.

CompTIA A+ Core 2 Question J-31

A user is reporting their web browser is not going to the site they are attempting to access. Which of the following would BEST resolve this?

A. Delete all Internet cookies.
B. Ensure the user is not utilizing a proxy server.
C. Remove all Internet shortcuts.
D. Clear all Internet cache and saved passwords.

Correct Answer: B

Explanation:
One solution to this problem might be related to proxy server. If the web browser is not accessing a site, try to disable proxy server from the browser proxy settings.