FC0-U61 Security — 15 Questions

Question 1

A small business owner wants to protect sensitive customer data stored on a laptop that is frequently used on public Wi-Fi networks. The owner is considering implementing a security control that ensures data remains confidential even if the laptop is stolen. Which of the following is the BEST control for this scenario?

Accepted Answer

Implement full-disk encryption. Full-disk encryption (FDE) protects data at rest by encrypting the entire storage volume, typically using AES-128 or AES-256. Even if the laptop is stolen, the encrypted data remains unreadable without the decryption key, ensuring confidentiality. This directly addresses the requirement for data protection after physical theft.

Answer

Use a VPN when connected to public Wi-Fi

Answer

Install antivirus software

Answer

Require a strong password for user login

Question 2

A security analyst is reviewing user permissions and discovers that several users have been granted more privileges than necessary to perform their job functions. The analyst wants to apply the principle of least privilege. Which TWO actions should the analyst take? (Choose TWO.)

Accepted Answer

Audit current permissions to identify unnecessary privileges. Auditing current permissions (Option B) is the first step in applying least privilege because it identifies exactly which users have excessive rights. Creating RBAC groups (Option C) then allows the analyst to assign permissions based on job functions, ensuring users only have the access necessary to perform their roles. Together, these actions systematically reduce privilege levels without disrupting operations.

Answer

Grant full administrative access to a single IT administrator

Answer

Allow users to request temporary elevation of privileges for specific tasks

Answer

Remove all permissions from users and add them back only when requested

Question 3

A help desk technician receives an alert from the security monitoring system showing multiple events like the one in the exhibit. The technician is investigating a possible brute-force attack. Based on the exhibit, which of the following is the primary attack vector being used?

Accepted Answer

RDP brute-force attack. The exhibit shows repeated failed authentication attempts targeting TCP port 3389, which is the default port for Remote Desktop Protocol (RDP). A brute-force attack on RDP involves systematically trying many username/password combinations to gain unauthorized remote access to a Windows system. This matches the definition of an RDP brute-force attack.

Answer

VPN brute-force attack

Answer

SSH brute-force attack

Answer

Web application attack

Question 4

You are the IT security administrator for a mid-sized law firm that handles sensitive client data. The firm has a mix of Windows 10 workstations, a Windows Server 2019 domain controller, and a network printer. All users have standard user accounts. The senior partner recently received a phishing email that appeared to be from a known client, requesting that he click a link to review a document. He clicked the link and entered his domain credentials on a fake login page. Shortly after, the firm's file server began encrypting files and displaying a ransom note. The incident response team isolated the infected server and restored files from backup. However, the senior partner now reports that he cannot access the file server from his workstation. He receives an 'Access Denied' message. You check his account in Active Directory and find that his account is not locked out and the password is correct. The file server is back online and accessible by other users. You verify that the senior partner's workstation has network connectivity and can ping the file server. Which of the following is the MOST likely cause of the access issue?

Accepted Answer

The senior partner's password was changed during incident response, and his workstation has cached old credentials. The senior partner's password was likely changed during the incident response process to prevent further unauthorized access using his compromised credentials. When a password is changed in Active Directory, the user's workstation still caches the old credentials (NTLM hash) until the user logs off and back on. Since the partner has not logged off, his workstation continues to present the old, invalid credentials to the file server, resulting in an 'Access Denied' error despite the account being active and the password being correct.

Answer

The senior partner's account was disabled by the automatic containment script

Answer

The ransomware modified the file server's permissions to deny access to the senior partner's account

Answer

The senior partner's workstation IP address was blacklisted on the file server

Question 5

Which TWO of the following are examples of social engineering attacks?

Accepted Answer

Tailgating. Tailgating (option C) is a social engineering attack where an unauthorized person physically follows an authorized individual into a restricted area, bypassing access controls such as card readers or biometric scanners. This exploits human courtesy or inattention rather than technical vulnerabilities, making it a classic social engineering technique.

Answer

Adware

Answer

Spoofing

Answer

Shoulder surfing

Question 6

Refer to the exhibit. A security analyst reviews the NTFS permissions on the C:\Shared folder. Which user or group has the ability to delete files created by other users?

Accepted Answer

Users. The 'Users' group in Windows NTFS has the 'Modify' permission on the C:\Shared folder by default, which includes the 'Delete Subfolders and Files' advanced permission. This allows members of the Users group to delete files created by other users, even if they are not the owner of those files. The 'Delete' permission alone only allows deletion of one's own files, but 'Delete Subfolders and Files' overrides that restriction for the container.

Answer

No user or group

Answer

Admin

Answer

Everyone

Question 7

You are the IT administrator for a small accounting firm with 25 employees. The firm uses a Windows Server 2019 domain controller, a file server, and an email server running Microsoft Exchange. Each employee has a company-issued laptop running Windows 10. The firm recently experienced a ransomware attack that encrypted all files on the file server. The attacker demanded a ransom in Bitcoin. The firm restored the files from a backup that was taken the previous night. However, the CEO is concerned about future attacks and wants to implement additional security measures. The firm has a limited budget and cannot afford a full security suite. Which of the following is the BEST course of action to reduce the risk of another ransomware infection?

Accepted Answer

Implement application whitelisting on all workstations.. Application whitelisting prevents any unauthorized executable, script, or installer from running, which would block ransomware even if it reaches the system via email or web download. This is the most effective single control on a limited budget because it stops unknown malware at the execution point, regardless of patch status or user behavior.

Answer

Ensure all systems are patched monthly.

Answer

Deploy an email spam filter to block phishing emails.

Answer

Conduct annual security awareness training for all employees.

Question 8

Drag and drop the steps to shut down a Windows 10 computer properly into the correct order.

Question 9

Match each troubleshooting step to its order in the CompTIA A+ methodology.

Question 10

A user wants to ensure data confidentiality. Which action is most appropriate?

Accepted Answer

Encrypt files. Encrypting files using algorithms like AES-256 ensures that even if unauthorized users gain access to the data, they cannot read it without the decryption key. This directly addresses the goal of data confidentiality by transforming plaintext into ciphertext that is unreadable without the proper key.

Answer

Change password

Answer

Share with everyone

Answer

Delete files

Question 11

Which of the following is an example of a strong password?

Accepted Answer

Cr@zy8#s. Option B (Cr@zy8#s) is correct because it meets all strong password criteria: it is at least 8 characters long, includes uppercase and lowercase letters, a digit, and special characters (@ and #). This complexity makes it resistant to brute-force attacks and dictionary attacks, as it increases the entropy and does not contain common words or sequential patterns.

Answer

123456

Answer

abc123

Answer

password

Question 12

A company wants to prevent unauthorized physical access to its server room. Which control is best?

Accepted Answer

Biometric lock. A biometric lock is the best control for preventing unauthorized physical access to a server room because it authenticates individuals based on unique physiological traits (e.g., fingerprint, iris scan), directly securing the physical entry point. Unlike logical or data-level controls, it addresses the physical security domain by restricting who can enter the room, not what data they can access.

Answer

Firewall

Answer

Antivirus

Answer

Encryption

Question 13

An employee receives an email from 'IT Support' asking for his password due to 'system maintenance'. This is an example of:

Accepted Answer

Phishing. Phishing is a social engineering attack where an attacker masquerades as a trusted entity (here, 'IT Support') to trick the victim into revealing sensitive information, such as a password. The email requesting credentials under the pretext of 'system maintenance' is a classic phishing technique, often executed via email (spear phishing if targeted). This directly matches the definition of phishing as an attempt to acquire sensitive data through deceptive electronic communication.

Answer

Baiting

Answer

Tailgating

Answer

Pretexting

Question 14

A small business wants to secure its wireless network. Which configuration provides the strongest encryption?

Accepted Answer

WPA3. WPA3 (Wi-Fi Protected Access 3) is the latest wireless security standard, introduced in 2018, which provides the strongest encryption through mandatory use of 192-bit AES encryption in WPA3-Enterprise and 128-bit AES in WPA3-Personal, along with Simultaneous Authentication of Equals (SAE) to replace the vulnerable Pre-Shared Key (PSK) exchange used in WPA2. This makes it resistant to offline dictionary attacks and provides forward secrecy, ensuring that even if a password is compromised, past sessions remain secure.

Answer

WPA

Answer

WEP

Answer

WPA2

Question 15

After a ransomware attack, which step should be taken FIRST in the incident response process?

Accepted Answer

Disconnect affected systems from network. The first step in incident response after a ransomware attack is to contain the threat by disconnecting affected systems from the network. This prevents the ransomware from encrypting additional files on other systems and stops lateral movement, which is critical because ransomware often uses network shares and SMB protocols to spread. Immediate isolation preserves forensic evidence and limits the scope of the incident before any other actions are taken.

Answer

Notify law enforcement

Answer

Restore from backup

Answer

Pay the ransom