- (Exam Topic 1)
A cybersecurity administrator needs to implement a Layer 7 security control on a network and block potential attacks. Which of the following can block an attack at Layer 7? (Select TWO).

1. A. HIDS
2. B. NIPS
3. C. HSM
4. D. WAF
5. E. NAC
6. F. NIDS
7. G. Stateless firewall

Correct Answer: DF
A WAF (Web Application Firewall) and NIDS (Network Intrusion Detection System) are both examples of Layer 7 security controls. A WAF can block attacks at the application layer (Layer 7) of the OSI model by filtering traffic to and from a web server. NIDS can also detect attacks at Layer 7 by monitoring network traffic for suspicious patterns and behaviors. References: CompTIA Security+ Study Guide, pages 94-95, 116-118

- (Exam Topic 2)
A data cento has experienced an increase in under-voltage events Mowing electrical grid maintenance outside the facility These events are leading to occasional losses of system availability Which of the following would be the most cost-effective solution for the data center 10 implement''

1. A. Uninterruptible power supplies with battery backup
2. B. Managed power distribution units lo track these events
3. C. A generator to ensure consistent, normalized power delivery
4. D. Dual power supplies to distribute the load more evenly

Correct Answer: A
Uninterruptible power supplies with battery backup would be the most cost-effective solution for the data center to implement to prevent under-voltage events following electrical grid maintenance outside the facility. An uninterruptible power supply (UPS) is a device that provides emergency power to a load when the main power source fails or drops below an acceptable level. A UPS with battery backup can help prevent under-voltage events by switching to battery power when it detects a voltage drop or outage in the main power source. A UPS with battery backup can also protect the data center equipment from power surges or spikes.
References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://www.apc.com/us/en/faqs/FA158852/

- (Exam Topic 1)
An analyst is working on an email security incident in which the target opened an attachment containing a worm. The analyst wants to implement mitigation techniques to prevent further spread. Which of the following is the BEST course of action for the analyst to take?

1. A. Apply a DLP solution.
2. B. Implement network segmentation
3. C. Utilize email content filtering,
4. D. isolate the infected attachment.

Correct Answer: D
Network segmentation is the BEST course of action for the analyst to take to prevent further spread of the worm. Network segmentation helps to divide a network into smaller segments, isolating the infected attachment from the rest of the network. This helps to prevent the worm from spreading to other devices within the network. Implementing email content filtering or DLP solution might help in preventing the email from reaching the target or identifying the worm, respectively, but will not stop the spread of the worm. References: CompTIA Security+ Study Guide, Chapter 5: Securing Network Infrastructure, 5.2 Implement Network Segmentation, pp. 286-289

- (Exam Topic 4)
A security analyst receives a SIEM alert that someone logged in to the app admin test account, which is only used for the early detection of attacks. The security analyst then reviews the following application log:

Which of the following can the security analyst conclude?

1. A. A replay attack is being conducted against the application.
2. B. An injection attack is being conducted against a user authentication system.
3. C. A service account password may have been changed, resulting in continuous failed logins within the application.
4. D. A credentialed vulnerability scanner attack is testing several CVEs against the application.

Correct Answer: A
A replay attack is a type of network attack where an attacker captures and retransmits a valid data transmission, such as a login request, to gain unauthorized access or impersonate a legitimate user. In this case, the attacker may have captured the credentials of the app admin test account and used them to log in to the application. The application log shows multiple failed login attempts from different IP addresses, which indicates a replay attack.

- (Exam Topic 3)
Which of the following terms should be included in a contract to help a company monitor the ongo-ing security maturity Of a new vendor?

1. A. A right-to-audit clause allowing for annual security audits
2. B. Requirements for event logs to kept for a minimum of 30 days
3. C. Integration of threat intelligence in the companys AV
4. D. A data-breach clause requiring disclosure of significant data loss

Correct Answer: A
A right-to-audit clause is a contractual provision that allows one party to audit the records and activities of another party to ensure compliance with security policies and standards. It can help a company monitor the ongoing security maturity of a new vendor by conducting annual security audits and identifying any gaps or issues that need to be addressed.