24 COMPTIA Security+ Guide to Network Security Fundamentals

familiarity level of capability/sophistication spear phishing

financial loss on-premises platform spim
firmware open permissions state actors
gray hat hackers open ports and services supply chain
hacker outsourced code development system integration
hacktivists patch tailgating
hoax pharming third parties
hybrid warfare influence campaign phishing threat actor
identity fraud (also called prepending trust
impersonation) pretexting typo squatting
identity theft reconnaissance unsecure protocols
impersonation (also called reputation unsecured root accounts
identity fraud) resources and funding urgency
influence campaigns scarcity vendor management
insider threat script kiddies vishing
intent/motivation shadow IT watering hole attack
internal shoulder surfing weak configurations
intimidation smishing weak encryption
invoice scam social engineering whaling
lack of vendor support social media influence campaign white hat hackers
legacy platform spam zero day

Review Questions
1. After Bella earned her security certification, she c. Security is less important than convenience.
was offered a promotion. As she reviewed the job d. Security and convenience are equal in importance.
responsibilities, she saw that in this position she 4. Which of the following of the CIA Triad ensures that
will report to the CISO and supervise a group of information is correct, and no unauthorized person
security technicians. Which of these generally has altered it?
recognized security positions has she been offered? a. Confidentiality
a. Security administrator b. Integrity
b. Security technician c. Availability
c. Security officer d. Assurance
d. Security manager
5. Which of the following is not used to describe those
2. Which of the following is false about the CompTIA who attack computer systems?
Security1 certification? a. Threat actor
a. Security1 is one of the most widely acclaimed b. Hacker
security certifications. c. Malicious agent
b. Security1 is internationally recognized as validating d. Attacker
a foundation level of security skills and knowledge.
c. The Security1 certification is a vendor-neutral 6. Which of the following is not true regarding security?
credential. a. Security is a goal.
d. Professionals who hold the Security1 certification b. Security includes the necessary steps to protect
earn about the same or slightly less than security from harm.
professionals who have not achieved this c. Security is a process.
certification. d. Security is a war that must be won at all costs.

3. Which of the following is true regarding the 7. Luna is reading a book about the history
relationship between security and convenience? of cybercrime. She read that the very first
a. Security and convenience are inversely cyberattacks were mainly for what purpose?
proportional. a. Fortune
b. Security and convenience have no relationship. b. Fame

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
 Module 1 Introduction to Security 25

c. Financial gain 14. How do vendors decide which should be the

d. Personal security default settings on a system?
8. Which of the following ensures that only authorized a. Those that are the most secure are always the
parties can view protected information? default settings.
a. Authorization b. There is no reason specific default settings are
b. Confidentiality chosen.
c. Availability c. Those settings that provide the means by which the
d. Integrity user can immediately begin to use the product.
d. The default settings are always mandated by
9. Which type of hacker will probe a system for industry standards.
weaknesses and then privately provide that
information back to the organization? 15. Which tool is most commonly associated with state
a. Black hat hackers actors?
b. White hat hackers a. Closed-Source Resistant and Recurrent Malware
c. Gray hat hackers (CSRRM)
d. Red hat hackers b. advanced persistent threat (APT)
c. Unlimited Harvest and Secure Attack (UHSA)
10. Complete this definition of information security: d. Network Spider and Worm Threat (NSAWT)
That which protects the integrity, confidentiality, and
availability of information _________________. 16. What is the term used to describe the connectivity
a. on electronic digital devices and limited analog between an organization and a third party?
devices that can connect via the Internet or through a. System integration
a local area network. b. Platform support
b. through a long-term process that results in ultimate c. Resource migration
security. d. Network layering
c. using both open-sourced as well as supplier-sourced 17. What is an objective of state-sponsored
hardware and software that interacts appropriately attackers?
with limited resources. a. To right a perceived wrong
d. through products, people, and procedures on the b. To amass fortune over of fame
devices that store, manipulate, and transmit the c. To spy on citizens
information. d. To sell vulnerabilities to the highest bidder
11. Which of the following groups have the lowest level 18. Which of the following is not an issue with
of technical knowledge? patching?
a. Script kiddies a. Difficulty patching firmware
b. Hacktivists b. Few patches exist for application software
c. State actors c. Delays in patching OSs
d. Insiders d. Patches address zero-day vulnerabilities
12. Which of the following groups use advanced 19. Which of the following is not a recognized attack
persistent threats? vector?
a. Brokers a. Supply chain
b. Criminal syndicates b. Social media
c. Shadow IT c. On-prem
d. State actors d. Email
13. Which of the following is not a reason a legacy 20. What is the category of threat actors that sell their
platform has not been updated? knowledge of vulnerabilities to other attackers or
a. Limited hardware capacity governments?
b. An application only operates on a specific OS a. Cyberterrorists
version b. Competitors
c. Neglect c. Brokers
d. No compelling reason for any updates d. Resource managers

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
 Module 2 Threat Management and Cybersecurity Resources 57

Payment Card Industry Data regulations standard

Security Standard (PCI DSS) request for comments (RFC) threat feeds
penetration testing rules of engagement threat hunting
persistence Security Information and Event unmanned aerial vehicle (UAV)
pivot Management (SIEM) user behavior analysis
platform/vendor-specific Security Orchestration, vulnerability feeds
guides Automation and Response vulnerability scan
privilege escalation (SOAR) war driving
Purple Team sentiment analysis war flying
Red Team SSAE SOC 2 Type II White box
reference architecture SSAE SOC 2 Type III White Team

Review Questions
1. Ebba has received a new initiative for her security 5. What penetration testing level name is given to
team to perform an in-house penetration test. What testers who have no knowledge of the network and
is the first step that Ebba should undertake? no special privileges?
a. Approval a. Black box
b. Budgeting b. Gray box
c. Planning c. White box
d. Documentation d. Purple box
2. Which of the following is NOT a characteristic of a 6. Which of the following is NOT an advantage of
penetration test? crowdsourced penetration testing?
a. Automated a. Faster testing
b. Finds deep vulnerabilities b. Less expensive
c. Performed occasionally c. Ability to rotate teams
d. May use internal employees or external consultants d. Conducting multiple tests simultaneously
3. Linnea has requested to be placed on the 7. Tilde is working on a contract with the external
penetration testing team that scans for penetration testing consultants. She does not
vulnerabilities to exploit them. Which team does want any executives to receive spear-phishing
she want to be placed on? emails. Which rule of engagement would cover this
a. Blue Team limitation?
b. Purple Team a. Scope
c. White Team b. Exploitation
d. Red Team c. Targets
4. Lykke’s supervisor is evaluating whether to d. Limitations and exclusions
use internal security employees to conduct a
8. Which is the final rule of engagement that would be
penetration test. Lykke does not consider this a
conducted in a pen test?
good idea and has created a memo with several
a. Cleanup
reasons they should not be used. Which of the
b. Communication
following would NOT be part of that memo?
c. Reporting
a. The employees could have inside knowledge of the
d. Exploitation
network that would give them an advantage.
b. There may be a lack of expertise. 9. What is another name for footprinting?
c. Employees may have a reluctance to reveal a a. High-level reconnaissance
vulnerability. b. Active reconnaissance
d. They would have to stay overnight to perform the c. Modeling
test. d. Revealing

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
58 COMPTIA Security+ Guide to Network Security Fundamentals

10. When researching how an attack recently took 15. Which group is responsible for the Cloud Controls
place, Nova discovered that the threat actor, after Matrix?
penetrating the system, started looking to move a. CSA
through the network with their elevated position. b. CIS
What is the name of this technique? c. OSINT
a. Jumping d. NIST
b. Twirling 16. Tuva’s supervisor wants to share a recent audit
c. Squaring up outside the organization. Tuva warns him that this
d. Lateral movement type of audit can only be read by those within the
11. What are documents that are authored by organization. What audit does Tuva’s supervisor
technology bodies employing specialists, want to distribute?
engineers, and scientists who are experts in those a. SSAE SOC 2 Type II
areas? b. SSAE SOC 2 Type III
a. Cybersecurity feeds c. SSAE SOC 3 Type IV
b. White notebooks d. SSAE SOC 3.2 Type X
c. Blue papers 17. Which ISO contains controls for managing and
d. Requests for comments (RFCs) controlling risk?
12. Which of the following is not a general information a. ISO XRS
source that can provide valuable in-depth b. ISO 31000
information on cybersecurity? c. ISO 271101
a. Twitter d. ISO 27555
b. Conferences 18. Which premise is the foundation of threat hunting?
c. Local industry groups a. Cybercrime will only increase.
d. Vendor websites b. Threat actors have already infiltrated our network.
13. Which of the following is a standard for the c. Attacks are becoming more difficult.
handling of customer card information? d. Pivoting is more difficult to detect than ever before.
a. DRD STR 19. Which of the following can automate an incident
b. OSS XRS response?
c. RMR CDC a. SIEM
d. PCI DSS b. SOAR
14. Which of the following are developed by c. CVCC
established professional organizations or d. SOSIA
government agencies using the expertise of 20. Which of the following is NOT something that a
seasoned security professionals? SIEM can perform?
a. Legislation a. User behavior analysis
b. White papers b. Sentiment analysis
c. Regulations c. Log aggregation
d. Benchmarks d. Incident response

Hands-On Projects

Project 2-1: Exploring Common Vulnerabilities and Exposures (CVE)

Time Required: 20 minutes
Objective: Summarize the techniques used in security assessments.
Description: Vulnerability feeds are available to provide updated information to scanning software about the
latest vulnerabilities. One of the most highly regarded vulnerability feeds is the Mitre Common Vulnerabilities and
Exposures (CVE). Feeds can also be manually examined for information on the latest vulnerabilities. In this project,
you will learn more about CVE and view CVE information.

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
88 COMPTIA Security+ Guide to Network Security Fundamentals

Key Terms
adversarial artificial intelligence fileless virus replay
application program interface (API) improper input handling resource exhaustion attacks
attack injections rootkit
backdoor integer overflow attack security of the ML algorithms
bot keylogger server-side request forgery (SSRF)
buffer overflow attack logic bomb shimming
client-side request forgery malware spyware
command and control (C&C) memory leak SQL injection
cross-site request forgery (CSRF) pointer/object dereference Structured Query Language
cross-site scripting (XSS) potentially unwanted programs tainted training data for machine
cryptomalware (PUPs) learning
device driver manipulation race condition time of check/time of use
DLL injection ransomware Trojan
error handling refactoring worm
eXtensible Markup Language (XML) remote access Trojan XML injection

Review Questions
1. What word is the currently accepted term to refer b. Cryptomalware can encrypt all files on any network
to network-connected hardware devices? that is connected to the employee’s computer.
a. Host c. The organization may be forced to pay up to $500
b. Endpoint for the ransom.
c. Device d. The employee would have to wait at least an hour
d. Client before her computer could be restored.
2. Which of the following is NOT a characteristic of 5. Which type of malware relies on LOLBins?
malware? a. PUP
a. Deceive b. File-based virus
b. Launch c. Fileless virus
c. Imprison d. Bot
d. Diffusion 6. Which of the following is known as a network virus?
3. Gabriel’s sister called him about a message a. TAR
that suddenly appeared on her screen that says b. Worm
her software license has expired and she must c. Remote exploitation virus (REV)
immediately pay $500 to have it renewed before d. C&C
control of the computer will be returned to her. 7. Josh is researching the different types of attacks
What type of malware has infected her computer? that can be generated through a botnet. Which of
a. Persistent lockware the following would NOT be something distributed
b. Blocking ransomware by a botnet?
c. Cryptomalware a. LOLBins
d. Impede-ware b. Spam
4. Marius’s team leader has just texted him that c. Malware
an employee, who violated company policy by d. Ad fraud
bringing in a file on her USB flash drive, has just 8. Which of the following is NOT a means by which a
reported that her computer is suddenly locked up bot communicates with a C&C device?
with cryptomalware. Why would Marius consider a. Signing in to a website the bot herder operates
this a dangerous situation? b. Signing in to a third-party website
a. It sets a precedent by encouraging other employees c. Email
to violate company policy. d. Command sent through Twitter posts

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
 Module 3 Threats and Attacks on Endpoints 89

9. Randall’s roommate is complaining to him about all c. EXMAL

of the software that came pre-installed on his new d. SCSI
computer. He doesn’t want the software because it 15. Which type of memory vulnerability attack
slows down the computer. What type of software is this? manipulates the “return address” of the memory
a. Spyware location of a software program?
b. BOT a. Shim overflow attack
c. PUP b. Factor overflow attack
d. Keylogger c. Integer overflow attack
10. What is the difference between a Trojan and a RAT? d. Buffer overflow attack
a. There is no difference.
16. What race condition can result in a NULL pointer/
b. A RAT gives the attacker unauthorized remote
object dereference?
access to the victim’s computer.
a. Conflict race condition
c. A Trojan can carry malware while a RAT cannot.
b. Value-based race condition
d. A RAT can infect only a smartphone and not a
c. Thread race condition
computer.
d. Time of check/time of use race condition
11. Which of these would NOT be considered the result
17. Which of the following attacks targets the external
of a logic bomb?
software component that is a repository of both
a. Send an email to Rowan’s inbox each Monday morning
code and data?
with the agenda of that week’s department meeting.
a. Application program interface (API) attack
b. If the company’s stock price drops below $50,
b. Device driver manipulation attack
then credit Oscar’s retirement account with one
c. Dynamic-link library (DLL) injection attack
additional year of retirement credit.
d. OS REG attack
c. Erase the hard drives of all the servers 90 days after
Alfredo’s name is removed from the list of current 18. What term refers to changing the design of existing
employees. code?
d. Delete all human resource records regarding a. Library manipulation
Augustine one month after he leaves the company. b. Shimming
12. Which of the following attacks is based on a c. Refactoring
website accepting user input without sanitizing it? d. Design driver manipulation
a. RSS 19. Which of the following is technology that imitates
b. XSS human abilities?
c. SQLS a. AI
d. SSXRS b. ML
13. Which of the following attacks is based on c. RC
the principle that when a user is currently d. XLS
authenticated on a website and then loads another 20. Which statement regarding a keylogger is
webpage, the new page inherits the identity and NOT true?
privileges of the first website? a. Software keyloggers can be designed to send
a. SSFR captured information automatically back to the
b. DLLS attacker through the Internet.
c. CSRF b. Hardware keyloggers are installed between the
d. DRCR keyboard connector and computer keyboard
14. Which of the following manipulates the trusting USB port.
relationship between web servers? c. Software keyloggers are generally easy to detect.
a. SSRF d. Keyloggers can be used to capture passwords,
b. CSRF credit card numbers, or personal information.

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
120 COMPTIA Security+ Guide to Network Security Fundamentals

Key Terms
antimalware disabling unnecessary open ports provisioning
antivirus (AV) and services public information sharing centers
application whitelisting/ dynamic code analysis quality assurance (QA)
blacklisting elasticity quarantine
automated courses of action endpoint detection and response registry
Automated Indicator Sharing (EDR) sandbox
(AIS) file and code repositories scalability
auto-update fuzzing secure coding practices and
binary hardware root of trust techniques
blacklisting host intrusion detection system secure cookie
boot attestation (HIDS) server-side execution and
client-side execution and host intrusion prevention system validation
validation (HIPS) software diversity
closed source HTTP Response Headers staging stage
code reuse of third-party libraries indicator of compromise (IOC) static code analysis
and SDKs integrity measurement stored procedure
code signing manual peer reviews Structured Threat Information
compilers Measured Boot Expression (STIX)
continuous delivery memory management testing stage
continuous deployment normalization third-party updates
continuous integration obfuscation/camouflaged code threat map
continuous monitoring open source Trusted Automated Exchange
continuous validation OWASP (Open Web Application of Intelligence Information
dark web Security Project) (TAXII)
data exposure predictive analysis UEFI (Unified Extensible Firmware
dead code private information sharing Interface)
deprovisioning centers version control
development stage production stage vulnerability database
directory traversal proper input validation whitelisting

Review Questions
1. An IOC occurs when what metric exceeds its c. TLP
normal bounds? d. PCII
a. IRR 4. Oskar has been receiving emails about critical
b. LRG threat intelligence information from a public
c. EXR information sharing center. His team leader has
d. KRI asked him to look into how the process can
2. What are the two concerns about using public be automated so that the information can feed
information sharing centers? directly into the team’s technology security. What
a. Cost and availability technology will Oskar recommend?
b. Privacy and speed a. Automated Indicator Sharing (AIS)
c. Security and privacy b. Bidirectional Security Protocol (BSP)
d. Regulatory approval and sharing c. Linefeed Access
3. Which privacy protection uses four colors d. Lightwire JSON Control
to indicate the expected sharing limitations 5. Which of the following is an application protocol
that are to be applied by recipients of the for exchanging cyberthreat intelligence over
information? HTTPS?
a. CISA a. STIX
b. FOIA b. AIP-TAR

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
 Module 4 Endpoint and Application Development Security 121

c. TAXII 12. Which stage conducts a test that will verify the
d. TCP-Over-Secure (ToP) code functions as intended?
a. Production stage
6. What are the two limitations of private information
b. Testing stage
sharing centers?
c. Staging stage
a. Access to data and participation
d. Development stage
b. Government approval and cost
c. Timing of reports and remote access 13. Which model uses a sequential design process?
d. Bandwidth and CPU a. Secure model
b. Agile model
7. Which of the following is NOT a limitation of a
c. Rigid model
threat map?
d. Waterfall model
a. Many maps claim that they show data in real
time, but most are simply a playback of previous 14. Which of the following is NOT an advantage of an
attacks. automated patch update service?
b. Because threat maps show anonymized data, it is a. Downloading patches from a local server instead of
impossible to know the identity of the attackers or using the vendor’s online update service can save
the victims. bandwidth and time because each computer does
c. They can be difficult to visualize. not have to connect to an external server.
d. Threat actors usually mask their real locations, so b. Administrators can approve updates for “detection”
what is displayed on a threat map is incorrect. only; this allows them to see which computers
8. Luka has been asked by his supervisor to monitor require the update without installing it.
the dark web for any IOCs concerning their c. Users can disable or circumvent updates just as
organization. The next week, Luca reports that they can if their computer is configured to use the
he was unable to find anything because looking vendor’s online update service.
for information on the dark web is different from d. Administrators can approve or decline updates for
using the regular web. Which of the following is client systems, force updates to install by a specific
FALSE about looking for information on the dark date, and obtain reports on what updates each
web? computer needs.
a. It is necessary to use Tor or IP2. 15. What type of analysis is heuristic monitoring based on?
b. Dark web search engines are identical to regular a. Dynamic analysis
search engines. b. Static analysis
c. Dark web merchants open and close their sites c. Code analysis
without warning. d. Input analysis
d. The naming structure is different on the dark web. 16. Which of these is a list of preapproved
9. Which of the following is NOT an improvement of applications?
UEFI over BIOS? a. Greenlist
a. Stronger boot security b. Redlist
b. Networking functionality in UEFI c. Blacklist
c. Access larger hard drives d. Whitelist
d. Support of USB 3.0 17. What is the advantage of a secure cookie?
10. Which boot security mode sends information on a. It cannot be stored on the local computer without
the boot process to a remote server? the user’s express permission.
a. UEFI Native Mode b. It is sent to the server over HTTPS.
b. Secure Boot c. It is analyzed by AV before it is transmitted.
c. Trusted Boot d. It only exists in RAM and is deleted once the web
d. Measured Boot browser is closed.
11. Which of the following is NOT an important OS 18. Which of the following tries to detect and stop an
security configuration? attack?
a. Employing least functionality a. HIDS
b. Disabling default accounts b. HIPS
c. Disabling unnecessary services c. RDE
d. Restricting patch management d. SOMA

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
122 COMPTIA Security+ Guide to Network Security Fundamentals

19. What does Windows 10 Tamper Protection 20. Which of the following is FALSE about a quarantine
do? process?
a. Limits access to the registry. a. It holds a suspicious application until the user gives
b. Prevents any updates to the registry until the approval.
user approves the update. b. It can send a sanitized version of the attachment.
c. Compresses and locks the registry. c. It can send a URL to the document that is on a
d. Creates a secure backup copy of the restricted computer.
registry. d. It is most often used with email attachments.

Hands-On Projects

If you are concerned about installing any of the software in these projects on your regular
Caution computer, you can instead install the software in the Windows in the Microsoft Sandbox or
a virtual machine created in the Module 1 Hands-On Projects. Software installed within the
virtual machine will not impact the host computer.

Project 4-1: Using the Microsoft Online Security Bulletins

Time Required: 20 minutes
Objective: Explain different threat actors, vectors, and intelligence sources.
Description: Microsoft has made its security bulletins available in a searchable online database. All security
professionals need to be familiar with using this database. In this project, you will explore the online database.

1. Open your web browser and enter the URL portal.msrc.microsoft.com/en-us/. (The location of content on the
Internet may change without warning. If you are no longer able to access the program through this URL, use a
search engine to search for “Microsoft Security Response Center.”)
2. Click Read the Security Update Guide FAQ.
3. Click Expand all to read through the information.
4. Click the link www.icasi.org/cvrf/ (or enter it into another tab in your browser). What is the Common
Vulnerability Reporting Framework (CVRF)? How is it used?
5. Return to the Microsoft Security Update Guide and then the MSRC main page.
6. Click the Go to the Security Update Guide button.
7. If no security updates appear, adjust the From date to the first day of the previous month.
8. Scroll through the list of security updates.
9. Click the first link under Article.
10. Read through this information.
11. Now return to the previous page and select another article to read.
12. How useful is this information? Is it presented in a format that is helpful?
13. Now click the CVE link under Details and read this information. Note the detail of this information.
14. Read the information under Exploitability Assessment (if the exploit you selected does not list an Exploitability
Assessment, then select another that does include the assessment). What does this mean? Open another tab on
your web browser, and search for Microsoft Exploitability Index. Read through the description that you find
and keep this tab open.
15. Return to the Microsoft Security Update Guide and view the Exploitability Assessment. How serious is this
security vulnerability?
16. How important is this information to a security professional? How easy is this online database to use?
17. Now compare the Microsoft database with Apple’s. Enter the URL support.apple.com/en-us/HT201222. (The
location of content on the Internet may change without warning. If you are no longer able to access the program
through the above URL, use a search engine to search for “Apple Security Updates.”)
18. Scroll down through the list of Apple security updates. How does this list compare with the updates from Microsoft?
19. Select a recent event under Name and information link.

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
148 COMPTIA Security+ Guide to Network Security Fundamentals

Review Questions
1. Akira is explaining to his team members the themselves from competitors if all versions
security constraints that have made it a challenge of Android start to look the same through
for protecting a new embedded system. Which updates.
of the following would Akira NOT include as a b. Because many of the OEMs have modified Android,
constraint? they are reluctant to distribute updates that could
a. Authentication potentially conflict with their changes.
b. Cost c. Wireless carriers are reluctant to provide firmware
c. Power OTA updates because of the bandwidth the updates
d. Availability consume on their wireless networks.
2. Agape has been asked to experiment with different d. Because OEMs want to sell as many devices as
hardware to create a controller for a new device possible, they have no financial incentive to update
on the factory floor. She needs a credit-card-sized mobile devices that users would then continue to
motherboard that has a microcontroller instead of a use indefinitely.
microprocessor. Which would be the best solution? 6. What is the process of identifying the geographical
a. Arduino location of a mobile device?
b. Raspberry Pi a. Geotracking
c. SoC b. Geolocation
d. FPGA c. GeoID
3. Hakaku needs a tool with a single management d. Geomonitoring
interface that provides capabilities for managing 7. Which of these is used to send SMS text messages
and securing mobile devices, applications, and to selected users or groups of users?
content. Which tool would be the best solution? a. Pull notification services
a. MCCM b. Replay notification distribution (RND)
b. MDM c. Push notification services
c. UEM d. MAM mass SMS
d. MMAM 8. Enki received a request by a technician for a new
4. In her job interview, Xiu asks about the company subnotebook computer. The technician noted that
policy regarding smartphones. She is told that he wanted USB OTG support and asked Enki’s
employees may choose from a limited list of advice regarding it. Which of the following would
approved devices but that she must pay for Enki NOT tell him?
the device herself; however, the company will a. A device connected via USB OTG can function as a
provide her with a monthly stipend. Which type of peripheral for external media access.
enterprise deployment model does this company b. A device connected via USB OTG can function as
support? a host.
a. CYOD c. USB OTG is only available for connecting Android
b. COPE devices to a subnotebook.
c. BYOD d. Connecting a mobile device to an infected
d. Corporate owned computer using USB OTG could allow malware to
5. Aoi has been asked to provide research regarding be sent to that device.
adding a new class of Android smartphones to a list 9. Banko’s sister has just downloaded and installed
of approved devices. One of the considerations is an app that allows her to circumvent the built-in
how frequently the smartphones receive firmware limitations on her Android smartphone. What is
OTA updates. Which of the following reasons this called?
would Aoi NOT list in her report as a factor in the a. Rooting
frequency of Android firmware OTA updates? b. Sideloading
a. OEMs are hesitant to distribute Google updates c. Jailbreaking
because it limits their ability to differentiate d. Ducking

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
 Module 5 Mobile, Embedded, and Specialized Device Security 149

10. Which of the following technologies can convert a 15. Which of these is NOT a security feature for
texting app into a live chat platform? locating a lost or stolen mobile device?
a. MMS a. Remote lockout
b. QR b. Last known good configuration
c. SMS c. Alarm
d. RCS d. Thief picture
11. What prevents a mobile device from being 16. What enforces the location in which an app can
used until the user enters the correct function by tracking the location of the mobile
passcode? device?
a. Swipe identifier (SW-ID) a. Location resource management
b. Screen lock b. Geofencing
c. Screen timeout c. GPS tagging
d. Touch swipe d. Graphical Management Tracking (GMT)

12. Hisoka is creating a summary document for 17. Which of these is considered the strongest type of
new employees about their options for different passcode to use on a mobile device?
mobile devices. One part of his report covers a. Password
encryption. What would Hisoka NOT include in b. PIN
his document? c. Fingerprint swipe
a. All modern versions of mobile device OS encrypt d. Draw connecting dots pattern
all user data by default. 18. Which of the following is NOT a context-aware
b. Encryption occurs when the mobile device is authentication?
locked. a. On-body detection
c. Apple uses file-based encryption to offer a higher b. Trusted places
level of security. c. Trusted devices
d. Data backed up to an Apple or Google server could d. Trusted contacts
be unlocked by a court order.
19. Which tool manages the distribution and control of
13. What does containerization do? apps?
a. It splits operating system functions only on specific a. MAM
brands of mobile devices. b. MDM
b. It places all keys in a special vault. c. MCM
c. It slows down a mobile device to half speed. d. MFM
d. It separates personal data from corporate data.
20. Which type of OS is typically found on an
14. What allows a device to be managed remotely? embedded system?
a. Mobile device management (MDM) a. SoC
b. Mobile application management (MAM) b. RTOS
c. Mobile resource management (MRM) c. OTG
d. Mobile wrapper management (MWM) d. COPE

Hands-On Projects

If you are concerned about installing any of the software in these projects on your regular
Caution computer, you can instead use the Windows Sandbox or install the software in the Windows
virtual machine created in the Module 1 Hands-On Projects. Software installed within the
virtual machine will not impact the host computer.

Copyright 2022 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.