153 free CompTIA Security+ SY0-701 practice questions from the CertStash pack of 611, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 153 free here, all 611 in the pack, and each step includes the one before it.
Get all 611 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?
Show answer and explanation
Correct answer: C. Organized crime
Organized crime groups have the resources, capability, and profit motive to be hired by foreign governments for sophisticated cyberattacks on critical infrastructure. They operate as professional entities with established business relationships and can be contracted for high-value operations. Hacktivists are ideologically motivated rather than mercenary, whistleblowers leak information rather than attack systems, and unskilled attackers lack the sophistication required for critical infrastructure targeting.
Why the other options are wrong
- A. Hacktivists are ideologically motivated, not hired for profit by governments.
- B. Whistleblowers disclose information rather than conduct attacks.
- D. Unskilled attackers lack the sophistication to target critical systems effectively.
Question 2
Which of the following is used to add extra complexity before using a one-way data transformation algorithm?
Show answer and explanation
Correct answer: D. Salting
Salting adds random data to input before applying a one-way hash function, increasing complexity and preventing rainbow table attacks. It is specifically designed to add extra complexity before hashing. Key stretching is a related but distinct technique that applies hashing multiple times, data masking obscures sensitive data visibility, and steganography hides information within other media.
Why the other options are wrong
- A. Key stretching applies the algorithm repeatedly, not adding complexity before transformation.
- B. Data masking obscures data visibility rather than adding cryptographic complexity.
- C. Steganography hides information within media, unrelated to hash algorithms.
Question 3
An employee clicked a link in an email from a payment website that asked the employee to update contact information. The employee entered the log-in information but received a “page not found” error message. Which of the following types of social engineering attacks occurred?
Show answer and explanation
Correct answer: D. Phishing
This scenario describes a classic phishing attack where an employee received a deceptive email from what appeared to be a payment website, clicked a link, and entered credentials on a fraudulent page. The 'page not found' error is typical when the phishing site has captured the credentials. Brand impersonation is the technique used but phishing is the attack type; pretexting involves creating false scenarios verbally; typosquatting involves domain name mimicry.
Why the other options are wrong
- A. Brand impersonation is the technique used within the phishing attack, not the attack type itself.
- B. Pretexting typically involves direct communication and building false relationships, not fake websites.
- C. Typosquatting involves slightly misspelled domain names, not exact impersonation in emails.
Question 4
An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will only be allowed from one device with the IP address 10.50.10.25. Which of the following firewall ACLs will accomplish this goal?
Show answer and explanation
Correct answer: D. Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53
ACLs are processed top-to-bottom with first match wins. Option D permits DNS traffic only from 10.50.10.25 to any destination on port 53, then denies all other outbound DNS traffic. This correctly restricts DNS to the single authorized device. Options A and C deny the authorized device or permit then deny the same traffic illogically. Option B reverses source/destination incorrectly.
Why the other options are wrong
- A. This denies the authorized device (10.50.10.25) after permitting all others, opposite of the requirement.
- B. This reverses source and destination in the first line, allowing all devices to send to 10.50.10.25.
- C. This permits all outbound DNS first, making the second deny statement unreachable.
Question 5
A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to maintain. The company prefers to use domain credentials to access new SaaS applications. Which of the following methods would allow this functionality?
Show answer and explanation
Correct answer: A. SSO
Single Sign-On (SSO) allows employees to use a single set of credentials (domain credentials) to authenticate to multiple applications, eliminating the need to maintain separate credentials for each SaaS application. LEAP and PEAP are wireless authentication protocols, not identity management solutions; MFA adds authentication factors but doesn't reduce credential management.
Why the other options are wrong
- B. LEAP is a wireless authentication protocol, not applicable to SaaS credential management.
- C. MFA adds authentication factors but doesn't reduce the number of credential sets required.
- D. PEAP is a wireless authentication protocol, not a SaaS credential management solution.
Question 6
Which of the following scenarios describes a possible business email compromise attack?
Show answer and explanation
Correct answer: C. A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account.
Business Email Compromise (BEC) attacks target employees with authority or access by impersonating executives or trusted contacts to request sensitive actions. Option C describes a classic BEC scenario where someone impersonating an HR director requests cloud administrator credentials from a service desk employee. Option A is gift card phishing, option B is ransomware, and option D is standard phishing to the email portal.
Why the other options are wrong
- A. Gift card requests represent basic phishing, not the sophisticated impersonation characteristic of BEC.
- B. Email attachments causing ransomware describes malware delivery, not BEC social engineering.
- D. Phishing links to company portals are standard phishing, not the account compromise targeting of BEC.
Question 7
A company prevented direct access from the database administrators’ workstations to the network segment that contains database servers. Which of the following should a database administrator use to access the database servers?
Show answer and explanation
Correct answer: A. Jump server
A jump server (bastion host) is a hardened, monitored intermediary system that allows administrators to access restricted network segments without direct connectivity. It enforces access control and logging for administrative activities. RADIUS is an authentication protocol, HSM is for key management, and load balancers distribute traffic, none addressing the access restriction requirement.
Why the other options are wrong
- B. RADIUS is an authentication protocol, not a mechanism for accessing restricted network segments.
- C. HSM (Hardware Security Module) manages cryptographic keys, not administrative access routing.
- D. Load balancers distribute network traffic, not provide restricted access for administrators.
Question 8
An organization’s internet-facing website was compromised when an attacker exploited a buffer overflow. Which of the following should the organization deploy to best protect against similar attacks in the future?
Show answer and explanation
Correct answer: B. WAF
A Web Application Firewall (WAF) is specifically designed to protect web applications by analyzing HTTP/HTTPS traffic and detecting/blocking attacks like buffer overflows, SQL injection, and XSS at the application layer. NGFW operates at network layer, TLS provides encryption, and SD-WAN manages network connectivity; none specifically protect against application-level exploits.
Why the other options are wrong
- A. NGFW protects at the network layer and cannot detect application-level buffer overflow exploits.
- C. TLS provides encryption in transit but cannot prevent buffer overflow exploitation.
- D. SD-WAN manages network routing and connectivity, not application security threats.
Question 9
An administrator notices that several users are logging in from suspicious IP addresses. After speaking with the users, the administrator determines that the employees were not logging in from those IP addresses and resets the affected users’ passwords. Which of the following should the administrator implement to prevent this type of attack from succeeding in the future?
Show answer and explanation
Correct answer: A. Multifactor authentication
Multifactor authentication (MFA) would prevent unauthorized access even if credentials are compromised, since attackers would need a second authentication factor (such as a code from the user's phone) that only the legitimate user possesses. This directly addresses the scenario where passwords were stolen and used from suspicious locations.
Why the other options are wrong
- B. Permissions assignment controls what authenticated users can do, not who can authenticate.
- C. Access management is too broad and doesn't specifically prevent credential-based attacks.
- D. Password complexity alone doesn't prevent compromised passwords from being used by attackers.
Question 10
An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following social engineering techniques are being attempted? (Choose two.)
Show answer and explanation
Correct answer: C, E. Impersonation; Smishing
Impersonation (C) is occurring because someone is pretending to be the payroll department, and smishing (E) is the specific technique of conducting phishing attacks via SMS text messages. These two elements combine to describe this attack scenario.
Why the other options are wrong
- A. Typosquatting involves creating fake websites with similar URLs, not text message impersonation.
- B. Phishing is the broader category, but smishing is the specific technique used for text-based phishing.
- D. Vishing is voice-based phishing, not text message-based.
- F. Misinformation spreads false information, but this attack is specifically attempting credential theft through impersonation.
What people say about the full SY0-701 pack 5.0 from 11
Honestly the best prep resource I found. Had my exam rescheduled last minute and ended up with only a few days to prepare. Did two passes of the dump and still managed to pass. Honestly surprised.
Cleared it! Third time sitting this exam. Used different resources the first two times. This time I used this dump and passed
Solid dump. Worth every cent. A few questions have answers that all look correct. The real exam is the same. Read carefully and pick the best answer, not the most correct one in isolation.
Question 11
Which of the following allows for the attribution of messages to individuals?
Show answer and explanation
Correct answer: B. Non-repudiation
Non-repudiation is the security property that ensures a person cannot deny having sent a message or performed an action. Through digital signatures and other cryptographic mechanisms, non-repudiation attributes messages to specific individuals and proves they originated from that person. Authentication verifies identity but doesn't prevent denial, access logs record activity but aren't a security principle, and adaptive identity manages identity context but doesn't prevent repudiation.
Why the other options are wrong
- A. Adaptive identity manages identity verification based on context, not message attribution.
- C. Authentication verifies who someone is but doesn't prevent them from denying they sent a message.
- D. Access logs record activity but are not a security principle that ensures message attribution or prevents denial.
Question 12
A recent penetration test identified that an attacker could flood the MAC address table of network switches. Which of the following would best mitigate this type of attack?
Show answer and explanation
Correct answer: B. Port security
Port security is a switch feature that limits and controls MAC addresses allowed on specific ports. It prevents MAC address table flooding attacks by restricting the number of MAC addresses that can be learned on a port and taking action when the limit is exceeded, making it the best mitigation for this attack.
Why the other options are wrong
- A. A load balancer distributes traffic across multiple servers and does not prevent MAC table flooding.
- C. An IPS monitors traffic patterns but is not the primary defense against MAC table flooding at the switch level.
- D. An NGFW focuses on application-layer filtering and threats, not MAC layer attacks.
Question 13
Which of the following provides the details about the terms of a test with a third-party penetration tester?
Show answer and explanation
Correct answer: A. Rules of engagement
Rules of engagement specifically document the terms, scope, timeline, authorized targets, and limitations of a penetration testing engagement with a third-party tester. This document defines what the tester can and cannot do during the assessment.
Why the other options are wrong
- B. Supply chain analysis reviews vendor procurement processes, not testing engagement terms.
- C. A right to audit clause grants audit permissions but doesn't detail specific test terms and conditions.
- D. Due diligence is a broader assessment process, not a specific document detailing engagement terms.
Question 14
Which of the following would best explain why a security analyst is running daily vulnerability scans on all corporate endpoints?
Show answer and explanation
Correct answer: A. To track the status of patching installations
Daily vulnerability scans on corporate endpoints are primarily used to track the status of patching installations and ensure systems remain secure as patches are deployed. By scanning regularly, analysts can verify which patches have been successfully applied and identify systems that still require updates, making it an essential component of patch management and compliance tracking.
Why the other options are wrong
- B. Finding shadow IT cloud deployments requires different detection methods like network traffic analysis and cloud API monitoring, not endpoint vulnerability scans.
- C. Hardware inventory tracking typically uses asset management tools and CMDB systems rather than vulnerability scanning.
- D. Hunting for active attackers requires behavioral analysis, log analysis, and threat hunting methodologies beyond standard vulnerability scanning.
Question 15
Which of the following should a security administrator adhere to when setting up a new set of firewall rules?
Show answer and explanation
Correct answer: D. Change management procedure
A change management procedure should be adhered to when setting up new firewall rules to ensure changes are documented, reviewed, approved, tested, and implemented in a controlled manner that minimizes disruption and security risks. This process prevents unauthorized or untested changes from affecting network security. A disaster recovery plan addresses recovery after incidents, incident response procedures handle active security events, and business continuity plans ensure operations continue during disruptions.
Why the other options are wrong
- A. A disaster recovery plan addresses recovery procedures after major incidents occur.
- B. Incident response procedures address how to handle active security incidents, not routine configuration changes.
- C. A business continuity plan ensures operations continue during disruptions, not specific to firewall rule implementation.
Question 16
A company is reviewing options to enforce user logins after several account takeovers. The following conditions must be met as part of the solution: • Allow employees to work remotely or from assigned offices around the world. • Provide a seamless login experience. • Limit the amount of equipment required. Which of the following best meets these conditions?
Show answer and explanation
Correct answer: A. Trusted devices
Trusted devices allow employees to work remotely from anywhere globally while maintaining security through device recognition rather than physical hardware. This provides seamless login experience since authenticated devices are recognized automatically, requires minimal additional equipment compared to smart cards, and works across different locations without geographic restrictions.
Why the other options are wrong
- B. Geotagging restricts login by location, which conflicts with the requirement to work from anywhere around the world.
- C. Smart cards require physical hardware that is difficult to manage for global distributed teams and adds equipment requirements.
- D. Time-based logins do not provide meaningful security enhancement and don't address account takeover prevention.
Question 17
A systems administrator notices that the research and development department is not using the company VPN when accessing various company-related services and systems. Which of the following scenarios describes this activity?
Show answer and explanation
Correct answer: D. Shadow IT
Shadow IT describes the use of unauthorized or unmanaged IT resources and services outside official IT channels. The R&D department bypassing the company VPN to access company services represents unsanctioned technology use that circumvents established security controls and IT governance.
Why the other options are wrong
- A. Espionage involves stealing secrets for external parties, not simply bypassing internal security controls.
- B. Data exfiltration is the unauthorized removal of data, which may result from shadow IT but is not the activity itself.
- C. Nation-state attacks are sophisticated threats by state actors, not departmental use of unauthorized access methods.
Question 18
A company wants to reduce the time and expense associated with code deployment. Which of the following technologies should the company utilize?
Show answer and explanation
Correct answer: A. Serverless architecture
Serverless architecture (such as AWS Lambda, Azure Functions) reduces deployment time and expense by eliminating the need to manage underlying infrastructure, provision servers, or handle scalability. The cloud provider manages all operational aspects, allowing developers to focus solely on code deployment and execution. This directly addresses the company's goal of reducing both time and cost.
Why the other options are wrong
- B. Thin clients reduce client-side resource needs but don't address code deployment efficiency or expense.
- C. Private cloud still requires infrastructure management and deployment processes, not reducing deployment time/expense as much as serverless.
- D. Virtual machines require provisioning, configuration, and management overhead, still incurring deployment time and expense.
Question 19
Which of the following practices would be best to prevent an insider from introducing malicious code into a company's development process?
Show answer and explanation
Correct answer: D. Peer review and approval
Peer review and approval processes ensure that code changes are examined by other developers before integration, providing a human control to detect and prevent malicious code insertion by insiders. This multi-person authorization prevents a single compromised developer from introducing malicious code undetected. Code scanning finds vulnerabilities, open-source component usage relates to third-party dependencies, and QA testing may not catch intentional malicious logic designed to evade detection.
Why the other options are wrong
- A. Code scanning detects vulnerabilities but may miss intentional malicious logic designed to hide.
- B. Open-source component usage relates to dependency management, not insider code introduction.
- C. QA testing validates functionality but may not detect intentionally hidden malicious code.
Question 20
Which of the following can be used to identify potential attacker activities without affecting production servers?
Show answer and explanation
Correct answer: A. Honeypot
A honeypot is a decoy system designed to attract and detect attacker activities without affecting production systems. It logs all interactions with the honeypot, allowing security teams to identify potential attacker behavior and techniques while keeping actual production systems unimpacted.
Why the other options are wrong
- B. Video surveillance monitors physical access but does not specifically identify attacker activities on systems.
- C. Zero Trust is an access control framework, not a tool for identifying attacker activities without affecting production.
- D. Geofencing restricts access based on location but does not identify or detect attacker activities on systems.
Question 21
An administrator has identified and fingerprinted specific files that will generate an alert if an attempt is made to email these files outside of the organization. Which of the following best describes the tool the administrator is using?
Show answer and explanation
Correct answer: A. DLP
DLP (Data Loss Prevention) is specifically designed to fingerprint sensitive files and generate alerts when attempts are made to exfiltrate them via email or other channels. This capability of identifying specific files by content fingerprinting and controlling their movement is a core DLP function. SNMP traps are for network device monitoring and alerts. SCAP is for configuration and vulnerability scanning. IPS focuses on blocking malicious network activity, not file-specific exfiltration prevention.
Why the other options are wrong
- B. SNMP traps are for network device monitoring, not file fingerprinting and exfiltration alerts
- C. SCAP is for configuration compliance and vulnerability assessment, not file DLP
- D. IPS detects malicious activity but doesn't fingerprint specific files for exfiltration control
Question 22
After an audit, an administrator discovers all users have access to confidential data on a file server. Which of the following should the administrator use to restrict access to the data quickly?
Show answer and explanation
Correct answer: D. Access control lists
Access control lists (ACLs) are the direct mechanism for controlling file and resource permissions. ACLs restrict who can access specific files and folders by specifying exactly which users and groups have permission to access resources. This provides immediate, granular control over file server access. While Group Policy can enforce ACLs enterprise-wide, ACLs are the specific tool for restricting access to data. Content filtering and data loss prevention address different security concerns and are not the primary tools for access restriction.
Why the other options are wrong
- A. Group Policy is an enterprise deployment tool, not the direct access control mechanism.
- B. Content filtering restricts content types, not file access permissions.
- C. Data loss prevention monitors and prevents data exfiltration, not access control.
Question 23
A security consultant needs secure, remote access to a client environment. Which of the following should the security consultant most likely use to gain access?
Show answer and explanation
Correct answer: C. IPSec
IPSec is a cryptographic protocol suite used to secure Internet Protocol communications through authentication and encryption. It is the standard choice for establishing secure remote access connections for consultants and remote workers. EAP is an authentication framework, DHCP assigns IP addresses, and NAT translates addresses, none provide the end-to-end encryption and security needed for remote access.
Why the other options are wrong
- A. EAP is an authentication method, not a secure remote access protocol.
- B. DHCP is used for IP address assignment, not secure remote connections.
- D. NAT translates IP addresses but provides no encryption or authentication for secure access.
Question 24
Which of the following phases of an incident response involves generating reports?
Show answer and explanation
Correct answer: C. Lessons learned
The Lessons Learned phase is the final phase of incident response where teams analyze what occurred, document findings, and generate reports on the incident, response effectiveness, and recommendations for improvement. Report generation is a primary activity of this phase.
Why the other options are wrong
- A. Recovery focuses on restoring systems to normal operations, not generating reports.
- B. Preparation involves readiness activities before an incident occurs.
- D. Containment focuses on stopping the spread of an active incident.
Question 25
An IT manager informs the entire help desk staff that only the IT manager and the help desk lead will have access to the administrator console of the help desk software. Which of the following security techniques is the IT manager setting up?
Show answer and explanation
Correct answer: D. Least privilege
The IT manager is implementing the principle of least privilege by restricting administrator console access to only the IT manager and help desk lead, the minimum number of individuals who require this level of access to perform their job duties. This limits potential damage from unauthorized access or misuse. Hardening involves securing systems through multiple methods, employee monitoring tracks user activities, and configuration enforcement ensures systems maintain desired settings.
Why the other options are wrong
- A. Hardening is a broader concept involving multiple security measures beyond access restrictions.
- B. Employee monitoring tracks and records user activities rather than restricting access.
- C. Configuration enforcement ensures systems maintain desired security settings, not about limiting who can access tools.
Question 26
Which of the following should a security operations center use to improve its incident response procedure?
Show answer and explanation
Correct answer: A. Playbooks
Playbooks are step-by-step guides that document specific procedures and actions to take during incident response. They provide clear, actionable instructions for SOC teams to follow when specific incident types occur, directly improving response efficiency and consistency. Playbooks translate frameworks and standards into operational procedures that teams can execute.
Why the other options are wrong
- B. Frameworks provide overall structures and guidance but are not the detailed procedural documents used directly during incident response.
- C. Baselines establish baseline configurations for systems, not incident response procedures.
- D. Benchmarks are standards for comparison and measurement, not operational guides for improving incident response.
Question 27
A company has begun labeling all laptops with asset inventory stickers and associating them with employee IDs. Which of the following security benefits do these actions provide? (Choose two.)
Show answer and explanation
Correct answer: A, F. If a security incident occurs on the device, the correct employee can be notified; Company data can be accounted for when the employee leaves the organization.
Asset inventory stickers with employee ID associations enable two key security functions: notifying the correct employee when their device experiences a security incident (option A), and accounting for company data when an employee leaves the organization (option F). These directly support incident response and data accountability in the asset lifecycle.
Why the other options are wrong
- B. User awareness training is sent to employees, not devices; the mapping doesn't enable this benefit.
- C. MFA token configuration uses identity management systems, not asset inventory stickers.
- D. User-based firewall policies rely on identity/authentication systems, not physical asset labels.
- E. Penetration testing target selection uses network reconnaissance and scoping, not asset inventory stickers.
Question 28
Which of the following must be considered when designing a high-availability network? (Choose two).
Show answer and explanation
Correct answer: A, D. Ease of recovery; Responsiveness
When designing a high-availability network, ease of recovery (A) is essential because systems must be restored quickly to minimize downtime. Responsiveness (D) is critical because HA networks must respond rapidly to failures and maintain service continuity. Physical isolation relates to security segmentation rather than availability design, ability to patch is an operational concern not a core HA design principle, attack surface is a security consideration, and extensible authentication is an identity management feature, none directly address the core availability requirements.
Why the other options are wrong
- B. Ability to patch is an operational concern but not a core design consideration for high availability.
- C. Physical isolation relates to security segmentation, not HA network design principles.
- E. Attack surface is a security metric, not a design consideration for high availability.
- F. Extensible authentication is an identity management feature unrelated to HA design.
Question 29
A client asked a security company to provide a document outlining the project, the cost, and the completion time frame. Which of the following documents should the company provide to the client?
Show answer and explanation
Correct answer: D. SOW
A Statement of Work (SOW) is the appropriate document to outline project scope, deliverables, costs, and completion timeframes. It establishes the specific agreement between the security company and client for a defined engagement, making it the correct choice for this scenario.
Why the other options are wrong
- A. Master Service Agreement (MSA) covers general terms and conditions for ongoing relationships, not specific project details.
- B. Service Level Agreement (SLA) defines performance metrics and uptime guarantees, not project scope and cost.
- C. Business Partnership Agreement (BPA) establishes long-term partnership terms, not individual project parameters.
Question 30
An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of the following would be most relevant for the analyst to evaluate?
Show answer and explanation
Correct answer: B. Subject role
In the Zero Trust model in the SY0-701 objectives, the control plane holds adaptive identity, threat scope reduction, policy-driven access control, the policy administrator and the policy engine. The data plane is where the subject or system, implicit trust zones and the policy enforcement point sit. Evaluating Zero Trust in the data plane therefore means looking at the subject requesting access, which is the subject role.
Why the other options are wrong
- A. Secured zones is not the data plane item named in the objectives (they name implicit trust zones), and the item that identifies who or what is requesting access is the subject.
- C. Adaptive identity is a control plane element, not a data plane element.
- D. Threat scope reduction is a control plane element, not a data plane element.
Question 31
Which of the following security concepts is the best reason for permissions on a human resources fileshare to follow the principle of least privilege?
Show answer and explanation
Correct answer: C. Confidentiality
The principle of least privilege restricts user access to only the minimum permissions necessary to perform their job functions. For a human resources fileshare containing sensitive employee data, this directly protects confidentiality by preventing unauthorized users from accessing sensitive information. While integrity, availability, and non-repudiation are security concepts, confidentiality is the primary concern when restricting access to sensitive HR data.
Why the other options are wrong
- A. Integrity relates to data accuracy and modification, not access restriction.
- B. Availability concerns system uptime and accessibility, not data access control.
- D. Non-repudiation ensures accountability for actions, not data confidentiality.
Question 32
Which of the following should a systems administrator use to ensure an easy deployment of resources within the cloud provider?
Show answer and explanation
Correct answer: B. Infrastructure as code
Infrastructure as Code (IaC) enables administrators to define and deploy cloud resources using code, templates, and automation tools, making deployment easy, repeatable, and scalable. SaaS is an application delivery model, IoT involves connected devices, and SDN relates to network management, none directly address easy resource deployment within cloud environments.
Why the other options are wrong
- A. SaaS is a software delivery model, not a deployment methodology for cloud resources.
- C. IoT refers to connected devices and sensors, not cloud resource deployment.
- D. SDN manages network behavior, not general cloud resource deployment.
Question 33
An administrator is installing an LDAP browser tool in order to view objects in the corporate LDAP directory. Secure connections to the LDAP server are required. When the browser connects to the server, certificate errors are being displayed, and then the connection is terminated. Which of the following is the most likely solution?
Show answer and explanation
Correct answer: B. The administrator needs to install the server certificate into the local truststore.
Certificate errors during secure LDAP connection indicate the server's certificate is not trusted by the client. Installing the server certificate into the local truststore will establish trust and allow the secure connection to complete successfully. This is the standard solution for certificate validation errors.
Why the other options are wrong
- A. SANs are already supported in modern browsers and this wouldn't resolve certificate validation errors.
- C. Port access for LDAPS is not the issue; the connection is being established but rejected due to certificate validation.
- D. Increasing TLS version on the RA would not resolve trust issues with the server certificate itself.
Question 34
The Chief Information Security Officer (CISO) has determined the company is non-compliant with local data privacy regulations. The CISO needs to justify the budget request for more resources. Which of the following should the CISO present to the board as the direct consequence of non-compliance?
Show answer and explanation
Correct answer: A. Fines
Fines are the direct financial consequences imposed by regulatory bodies for non-compliance with data privacy regulations. They represent immediate, measurable financial impact that directly justifies budget requests. Fines are specific, quantifiable penalties mandated by law, making them the strongest justification for resource allocation.
Why the other options are wrong
- B. Reputational damage is a consequential effect but is indirect and harder to quantify for budget justification.
- C. Sanctions are regulatory consequences but are less common and specific than fines for data privacy violations.
- D. Contractual implications are consequences but are secondary to the direct penalties imposed by regulators.
Question 35
A company’s legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries. Which of the following is the most effective way to limit this access?
Show answer and explanation
Correct answer: C. Geolocation policy
A geolocation policy directly restricts access based on geographic location, preventing users in high-risk countries from accessing the documents. This is the most effective and straightforward method to enforce location-based access restrictions. Data masking obscures data content but doesn't prevent access, encryption protects data in transit/rest but doesn't restrict who can decrypt it, and data sovereignty regulations are compliance frameworks rather than access control mechanisms.
Why the other options are wrong
- A. Data masking obscures sensitive content but does not prevent access from restricted locations.
- B. Encryption protects data confidentiality but does not inherently restrict access by geography.
- D. Regulations provide compliance requirements but are not technical controls that enforce access restrictions.
Question 36
A company hired an external consultant to assist with required system upgrades to a critical business application. A systems administrator needs to secure the consultant's access without sharing passwords to critical systems. Which of the following solutions should most likely be utilized?
Show answer and explanation
Correct answer: E. PAM software
PAM (Privileged Access Management) software is the ideal solution for granting secure temporary access to critical systems without sharing passwords. PAM provides credential management, session recording, access logging, and just-in-time privilege elevation. It allows the consultant to access systems through controlled sessions while maintaining security and audit trails, perfectly addressing the requirement to secure access without sharing credentials.
Why the other options are wrong
- A. TACACS+ is an authentication protocol but doesn't provide the credential management and privileged access control needed.
- B. SAML is a federation and SSO protocol for authentication, not specifically for managing privileged access without sharing passwords.
- C. SSO provides unified authentication but doesn't address the secure delegation of privileged access to external consultants.
- D. RBAC defines what users can do after authentication but doesn't solve the problem of securely granting temporary privileged access without password sharing.
Question 37
Which of the following is a feature of a next-generation SIEM system?
Show answer and explanation
Correct answer: B. Automated response actions
Next-generation SIEM systems include automated response actions that can automatically execute predefined actions (such as isolating systems, blocking IPs, or terminating sessions) when specific threats are detected. This automated response capability is a defining feature of modern SIEM solutions, enabling faster threat mitigation without requiring manual human intervention.
Why the other options are wrong
- A. Virus signatures are traditional antivirus features, not a defining characteristic of next-generation SIEM.
- C. Security agent deployment is a function of endpoint management or security orchestration, not SIEM.
- D. Vulnerability scanning is a separate security tool function, not a core next-generation SIEM feature.
Question 38
A company is decommissioning its physical servers and replacing them with an architecture that will reduce the number of individual operating systems. Which of the following strategies should the company use to achieve this security requirement?
Show answer and explanation
Correct answer: B. Containerization
Containerization is the strategy that allows multiple applications and services to run in isolated containers on fewer operating systems, significantly reducing the number of individual OS instances required. Containers are lightweight, portable, and share the host OS kernel, enabling high density application deployment on minimal infrastructure.
Why the other options are wrong
- A. Microservices is an architectural pattern, not a deployment technology that reduces the number of operating systems.
- C. Virtualization creates multiple full operating systems, which does not reduce the number of individual OS instances, it may increase them.
- D. Infrastructure as code is a management approach that automates provisioning but does not inherently reduce the number of operating systems.
Question 39
Which of the following is the most common data loss path for an air-gapped network?
Show answer and explanation
Correct answer: D. Removable devices
Removable devices (USB drives, external hard drives, SD cards) represent the most common data exfiltration path for air-gapped networks because they physically bridge the gap between isolated and connected systems. An employee can easily copy sensitive data to removable media and transport it off the network. This is why strict removable media policies are critical for maintaining air-gap integrity.
Why the other options are wrong
- A. A bastion host is an intentional connection point, not a data loss vector for properly managed air-gaps.
- B. Unsecured Bluetooth would require proximity and specific device pairing, making it less practical than removable media.
- C. An unpatched OS is a vulnerability for malware execution but not the primary data loss path from an air-gapped network.
Question 40
A company wants to verify that the software the company is deploying came from the vendor the company purchased the software from. Which of the following is the best way for the company to confirm this information?
Show answer and explanation
Correct answer: A. Validate the code signature.
Code signing validation is the best method to verify that software came from the intended vendor. Digital signatures cryptographically prove the software's origin and integrity using the vendor's private key, ensuring authenticity and that the code has not been tampered with after release.
Why the other options are wrong
- B. Sandbox execution tests behavior but does not verify the software's origin or vendor authenticity.
- C. Searching for ASCII strings provides information about software contents but does not prove vendor identity.
- D. Hashing verifies file integrity but cannot confirm the software came from the specific vendor without a trusted hash database.
Question 41
An organization recently updated its security policy to include the following statement: Regular expressions are included in source code to remove special characters such as $, |, ;. &, `, and ? from variables set by forms in a web application. Which of the following best explains the security technique the organization adopted by making this addition to the policy?
Show answer and explanation
Correct answer: C. Input validation
Input validation is the security technique being described, using regular expressions to filter and remove potentially dangerous special characters from form input variables. This prevents attackers from injecting malicious code or commands through special characters that could be used in attacks like SQL injection or command injection. The other options describe different security activities unrelated to filtering user input.
Why the other options are wrong
- A. Identifying embedded keys is about finding hardcoded credentials, not about filtering special characters from input.
- B. Code debugging is about finding and fixing software bugs, not implementing security filtering controls.
- D. Static code analysis examines code for vulnerabilities but is different from implementing input validation rules in policy.
Question 42
Which of the following most impacts an administrator's ability to address CVEs discovered on a server?
Show answer and explanation
Correct answer: B. Patch availability
Patch availability is the primary factor that determines whether an administrator can actually address a discovered CVE. Without an available patch from the vendor, the administrator cannot remediate the vulnerability regardless of other factors. Rescanning verifies the vulnerability but doesn't fix it. Organizational impact and risk tolerance influence prioritization of patching efforts but don't determine whether a patch can be applied at all.
Why the other options are wrong
- A. Rescanning requirements verify vulnerabilities but don't enable remediation
- C. Organizational impact influences prioritization but not the ability to patch
- D. Risk tolerance affects remediation decisions but not the existence of patches
Question 43
The management team notices that new accounts that are set up manually do not always have correct access or permissions. Which of the following automation techniques should a systems administrator use to streamline account creation?
Show answer and explanation
Correct answer: D. User provisioning script
A user provisioning script automates the account creation process, ensuring that new accounts are created with correct access and permissions consistently. This directly addresses the problem of manual account setup errors by standardizing the configuration and applying predefined permission templates. Guard rail scripts restrict user actions, ticketing workflows manage request processes, and escalation scripts handle approval chains, none of these specifically automate account creation with proper permissions.
Why the other options are wrong
- A. Guard rail scripts constrain or limit user actions rather than automate account creation with proper permissions.
- B. Ticketing workflow manages the request process but does not automate the technical account creation and permission assignment.
- C. Escalation scripts handle approval routing and notifications, not the actual account creation and permission configuration.
Question 44
Which of the following describes an executive team that is meeting in a board room and testing the company's incident response plan?
Show answer and explanation
Correct answer: C. Tabletop exercise
A tabletop exercise is a discussion-based assessment where participants (including executives) walk through an incident response scenario in a controlled meeting environment. It tests the plan without actually implementing it, allowing teams to identify gaps and improve procedures. The executive team meeting in a board room to test the incident response plan is the classic definition of a tabletop exercise.
Why the other options are wrong
- A. Continuity of operations refers to maintaining business functions during disruptions, not a specific testing methodology.
- B. Capacity planning involves determining resource requirements, not testing incident response plans.
- D. Parallel processing runs systems simultaneously but does not describe a meeting-based testing scenario.
Question 45
A security administrator notices numerous unused, non-compliant desktops are connected to the network. Which of the following actions would the administrator most likely recommend to the management team?
Show answer and explanation
Correct answer: B. Decommissioning
Decommissioning is the most appropriate action for unused, non-compliant desktops. These systems pose a security risk because they cannot be updated or maintained, making them vulnerable to exploits. Removing them from the network eliminates the attack surface they represent. While isolation, patching, and monitoring might temporarily mitigate risk, decommissioning permanently removes non-functional, liability-creating assets.
Why the other options are wrong
- A. Monitoring doesn't solve the compliance issue or reduce the risk of non-compliant systems.
- C. Patching unused systems that may not be updatable doesn't address fundamental non-compliance.
- D. Isolating unused desktops leaves them on the network as potential liabilities; decommissioning is the proper lifecycle action.
Question 46
Which of the following alert types is the most likely to be ignored over time?
Show answer and explanation
Correct answer: C. False positive
False positives are the most likely to be ignored over time due to alert fatigue. When security tools generate many alerts that turn out to be benign, analysts become desensitized and start dismissing alerts without thorough investigation. This reduces detection effectiveness as genuine threats may be overlooked among the noise of false alarms.
Why the other options are wrong
- A. True positives indicate actual security issues and should not be ignored.
- B. True negatives indicate no threat present, so ignoring them is appropriate behavior.
- D. False negatives involve missed detections, but analysts cannot ignore what they don't see.
Question 47
A company wants to implement MFA. Which of the following enables the additional factor while using a smart card?
Show answer and explanation
Correct answer: A. PIN
When implementing MFA with a smart card as the first factor, a PIN (Personal Identification Number) serves as the second authentication factor. The smart card itself (something you have) is one factor, and the PIN (something you know) is the additional factor. Together they satisfy the MFA requirement of two different authentication types.
Why the other options are wrong
- B. A hardware token is itself a physical factor similar to a smart card, not an additional factor to use with it.
- C. User ID is typically username/identification, not an authentication factor, it identifies but doesn't authenticate.
- D. SMS sends a one-time code but requires a phone; it's not the enabling factor specifically when using a smart card.
Question 48
A systems administrator wants to prevent users from being able to access data based on their responsibilities. The administrator also wants to apply the required access structure via a simplified format. Which of the following should the administrator apply to the site recovery resource group?
Show answer and explanation
Correct answer: A. RBAC
Role-Based Access Control (RBAC) is the access management approach that prevents users from accessing data based on their responsibilities and job roles. It applies access permissions based on assigned roles in a simplified, scalable format, making it ideal for managing access to resource groups like site recovery systems where permissions should align with user responsibilities.
Why the other options are wrong
- B. ACLs (Access Control Lists) specify individual object permissions but are more granular and less role-oriented.
- C. SAML is a federated authentication protocol, not an access control model.
- D. GPO (Group Policy Object) is a Windows management tool for enforcing policies but isn't primarily an access control framework.
Question 49
Which of the following is a hardware-specific vulnerability?
Show answer and explanation
Correct answer: A. Firmware version
Firmware version is hardware-specific because firmware is the low-level software programmed into hardware devices that controls their operation. Outdated or vulnerable firmware versions represent hardware-level security weaknesses. Buffer overflow, SQL injection, and cross-site scripting are all software-level vulnerabilities that can exist across different platforms and are not specific to hardware.
Why the other options are wrong
- B. Buffer overflow is a software coding vulnerability, not hardware-specific.
- C. SQL injection is a database/application-level vulnerability, not hardware-specific.
- D. Cross-site scripting is a web application vulnerability, not hardware-specific.
Question 50
An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?
Show answer and explanation
Correct answer: C. Impersonating
The attacker is pretending to be the CEO to pressure the employee into buying gift cards, which is impersonation. The target is an ordinary employee, not an executive, so it is not whaling.
Why the other options are wrong
- A. Smishing uses SMS text messages, but this attack happens over a phone call.
- B. Disinformation is the spread of false information to shape opinion, not a direct request for a purchase.
- D. Whaling targets senior executives as victims, whereas here the attacker poses as an executive to fool an employee.
Question 51
A systems administrator works for a local hospital and needs to ensure patient data is protected and secure. Which of the following data classifications should be used to secure patient data?
Show answer and explanation
Correct answer: C. Sensitive
Patient data in a hospital setting, such as Protected Health Information (PHI), should be classified as Sensitive. Sensitive data classification indicates information that requires strong protections and controlled access, which is the appropriate level for healthcare data subject to regulations like HIPAA.
Why the other options are wrong
- A. Private is a less stringent classification than Sensitive and does not adequately reflect the regulatory requirements of patient data.
- B. Critical typically refers to systems and operations essential for business continuity, not a primary data classification for patient information.
- D. Public indicates data with no restriction on access or disclosure, which is completely inappropriate for patient data.
Question 52
An enterprise has been experiencing attacks focused on exploiting vulnerabilities in older browser versions with well-known exploits. Which of the following security solutions should be configured to best provide the ability to monitor and block these known signature-based attacks?
Show answer and explanation
Correct answer: D. IPS
IPS (Intrusion Prevention System) is designed to actively block known signature-based attacks in real-time. Since the question specifies well-known exploits with known signatures, IPS is the appropriate choice as it can detect and prevent these attacks automatically. IDS only monitors and alerts, while ACL and DLP serve different purposes.
Why the other options are wrong
- A. ACL (Access Control Lists) control traffic flow but don't analyze payloads for known signatures.
- B. DLP (Data Loss Prevention) focuses on preventing data exfiltration, not blocking exploit traffic.
- C. IDS (Intrusion Detection System) can detect attacks but only alerts; it doesn't actively block like IPS does.
Question 53
A Chief Information Security Officer would like to conduct frequent, detailed reviews of systems and procedures to track compliance objectives. Which of the following will be the best method to achieve this objective?
Show answer and explanation
Correct answer: C. Internal auditing
Internal auditing is the process of conducting frequent, detailed reviews of systems, procedures, and controls to verify compliance with objectives and identify areas for improvement. It is continuous, detailed, and focuses specifically on tracking compliance against established standards and requirements.
Why the other options are wrong
- A. Third-party attestation provides external validation but is typically less frequent and detailed than internal audits.
- B. Penetration testing focuses on identifying vulnerabilities through simulated attacks, not tracking compliance objectives.
- D. Vulnerability scans identify technical weaknesses but do not provide the comprehensive review of systems and procedures needed for compliance tracking.
Question 54
A technician is opening ports on a firewall for a new system being deployed and supported by a SaaS provider. Which of the following is a risk in the new system?
Show answer and explanation
Correct answer: C. Supply chain vendor
A SaaS provider represents a supply chain vendor risk. When deploying systems supported by external vendors, organizations inherit risks related to the vendor's security practices, potential breaches of the vendor's infrastructure, and the vendor's access to the organization's systems and data.
Why the other options are wrong
- A. While default credentials are a risk, the question specifically asks about the risk introduced by using a SaaS provider, which is a vendor relationship.
- B. Non-segmented networks are a general network architecture risk, not specific to the SaaS provider deployment context.
- D. Vulnerable software is a general software risk but does not specifically characterize the risk introduced by the SaaS vendor relationship.
Question 55
A security analyst received a tip that sensitive proprietary information was leaked to the public. The analyst is reviewing the PCAP and notices traffic between an internal server and an external host that includes the following: ... 12:47:22.327233 PPPoE [ses 0x8122] IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto IPv6 (41), length 331) 10.5.1.1 > 52.165.16.154: IP6 (hlim E3, next-header TCP (6) paylcad length: 271) 2001:67c:2158:a019::ace.53104 > 2001:0:5ef5:79fd:380c:dddd:a601:24fa.13788: Flags [P.], cksum 0xd7ee (correct), seq 97:348, ack 102, win 16444, length 251 ... Which of the following was most likely used to exfiltrate the data?
Show answer and explanation
Correct answer: A. Encapsulation
The PCAP shows IPv6 traffic encapsulated within IPv4 (proto IPv6 (41)), which is IPv6-in-IPv4 tunneling. This encapsulation technique allows an attacker to hide IPv6 traffic within standard IPv4 packets to bypass security controls and exfiltrate data to an external host without detection. The unusual protocol combination and external destination indicate deliberate use of encapsulation for data exfiltration.
Why the other options are wrong
- B. MAC address spoofing would not be visible in the IP layer packet analysis shown and would not facilitate exfiltration to external hosts.
- C. Steganography hides data within other media; there is no indication of hidden data within the payload itself.
- D. The presence of encryption or lack thereof doesn't explain the exfiltration method; the data is being actively sent out.
- E. Sniffing via on-path position captures traffic but doesn't explain how data was exfiltrated from the internal server.
Question 56
An IT manager is increasing the security capabilities of an organization after a data classification initiative determined that sensitive data could be exfiltrated from the environment. Which of the following solutions would mitigate the risk?
Show answer and explanation
Correct answer: C. DLP
Data Loss Prevention (DLP) solutions monitor, detect, and block unauthorized attempts to exfiltrate sensitive data from an organization's environment. DLP directly addresses the risk of sensitive data being removed from the network.
Why the other options are wrong
- A. XDR (Extended Detection and Response) is for detecting and responding to advanced threats, not preventing data exfiltration.
- B. SPF (Sender Policy Framework) is an email authentication protocol, not relevant to data exfiltration prevention.
- D. DMARC is an email authentication standard, not a data exfiltration prevention tool.
Question 57
An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period. Which of the following data policies is the administrator carrying out?
Show answer and explanation
Correct answer: B. Retention
Retention policy defines how long data must be kept based on legal, regulatory, and business requirements. The scenario explicitly describes archiving customer transaction information for the proper time period, which is the definition of data retention. Compromise refers to security breaches, analysis involves data examination, transfer relates to data movement, and inventory catalogs data assets, none address time-based archival requirements.
Why the other options are wrong
- A. Compromise relates to security breaches, not data archival periods.
- C. Analysis involves examining data, not determining archival timeframes.
- D. Transfer involves moving data between systems, not retention duration.
- E. Inventory catalogs what data exists, not how long to keep it.
Question 58
Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?
Show answer and explanation
Correct answer: A. Preparation
The Preparation phase is when an organization establishes roles, responsibilities, tools, and procedures before incidents occur. This includes defining who does what during incident response. This foundational work happens before any incident is detected.
Why the other options are wrong
- B. Recovery is the phase focused on restoring systems to normal operation, not reviewing roles.
- C. Lessons learned occurs after the incident to review what happened, not during preparation.
- D. Analysis is when the incident itself is being investigated and analyzed, not when roles are initially defined.
Question 59
An IT manager is putting together a documented plan describing how the organization will keep operating in the event of a global incident. Which of the following plans is the IT manager creating?
Show answer and explanation
Correct answer: A. Business continuity
Business continuity planning describes how an organization will maintain operations during and after a global incident or disruption. It focuses on keeping the business running with minimal interruption. While disaster recovery is related, it specifically addresses recovery after an incident; business continuity is the broader plan for ongoing operations during emergencies.
Why the other options are wrong
- B. Physical security addresses building access and protection of physical assets, not operational continuity.
- C. Change management governs how modifications to systems and processes are implemented, not emergency operations.
- D. Disaster recovery focuses on restoring systems after failure, not maintaining ongoing operations during an incident.
Question 60
Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII?
Show answer and explanation
Correct answer: D. DLP
Data Loss Prevention (DLP) tools are specifically designed to detect and prevent sensitive data from being transmitted outside the organization, including through email. DLP can identify personally identifiable information (PII) patterns and block or alert on emails containing such data. SCAP is for compliance assessment, NetFlow is for network traffic analysis, and antivirus focuses on malware, none of which are specifically designed to detect accidental PII transmission.
Why the other options are wrong
- A. SCAP is a compliance framework for security configuration, not for detecting data in emails.
- B. NetFlow analyzes network traffic patterns but is not designed to detect PII in email communications.
- C. Antivirus detects malicious software, not sensitive data patterns in emails.
Question 61
Employees located off-site must have access to company resources in order to complete their assigned tasks. These employees utilize a solution that allows remote access without interception concerns. Which of the following best describes this solution?
Show answer and explanation
Correct answer: C. VPN
A VPN (Virtual Private Network) provides secure remote access to company resources by encrypting all traffic between the user and the company network, preventing interception. It is the standard solution for allowing off-site employees secure access to internal resources.
Why the other options are wrong
- A. A proxy server forwards requests but does not provide the encryption and security needed for safe remote access.
- B. An NGFW protects internal networks but is not the primary solution for remote employee access.
- D. A security zone is a network segmentation concept, not a remote access solution.
Question 62
A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users. Which of the following would be a good use case for this task?
Show answer and explanation
Correct answer: B. Orchestration
Orchestration is the automated coordination and execution of multiple related tasks across systems to accomplish complex workflows. Creating a script to automate account creation for multiple users is a classic orchestration use case, as it automates repetitive tasks and reduces human error.
Why the other options are wrong
- A. Off-the-shelf software refers to pre-built applications, not custom scripting for automation.
- C. Baseline refers to a standard configuration or security starting point, not task automation.
- D. Policy enforcement is about ensuring compliance with rules, not automating routine administrative tasks.
Question 63
To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed. Which of the following best describe these types of controls? (Choose two.)
Show answer and explanation
Correct answer: B, F. Deterrent; Detective
The CCTV system is a detective control because it records and identifies security incidents after they occur through video footage. The posted signs about being filmed serve as a deterrent control by discouraging malicious behavior through the threat of being caught on camera. Together, these controls address both the prevention of incidents through deterrence and the identification of incidents through detection.
Why the other options are wrong
- A. Preventive controls stop incidents before they occur; neither CCTV nor warning signs prevent unauthorized access.
- C. Corrective controls fix damage after an incident; these controls don't restore systems or correct damage.
- D. Directive controls guide or mandate behavior; while signs provide information, they are primarily deterrents rather than directives.
- E. Compensating controls provide alternative security when primary controls fail; these are primary controls, not compensating measures.
Question 64
A software development team asked a security administrator to recommend techniques that should be used to reduce the chances of the software being reverse engineered. Which of the following should the security administrator recommend?
Show answer and explanation
Correct answer: B. Performing code obfuscation
Code obfuscation deliberately makes source code difficult to understand and analyze, directly preventing reverse engineering by obscuring logic, variable names, and program flow. This is the primary technique used to protect against reverse engineering attacks. Digital signatures verify authenticity but don't prevent analysis, library restrictions don't prevent reverse engineering, and compile flags optimize but don't obfuscate code.
Why the other options are wrong
- A. Digital signing verifies code authenticity and integrity but does not prevent reverse engineering.
- C. Limiting third-party libraries doesn't address reverse engineering vulnerability; attackers can reverse engineer either way.
- D. Compile flags may optimize performance but don't obfuscate code or prevent reverse engineering.
Question 65
A hosting provider needs to prove that its security controls have been in place over the last six months and have sufficiently protected customer data. Which of the following would provide the best proof that the hosting provider has met the requirements?
Show answer and explanation
Correct answer: B. SOC 2 Type 2 report
A SOC 2 Type 2 report provides audit evidence that security controls have been implemented and operating effectively over a specific period (typically six months or more). Type 2 specifically demonstrates control effectiveness over time, which directly proves that controls were in place and functioning to protect customer data.
Why the other options are wrong
- A. NIST CSF is a framework for developing controls, not an attestation report proving their historical effectiveness.
- C. CIS Top 20 compliance reports assess current compliance status but don't provide third-party attestation of control effectiveness over time.
- D. Vulnerability reports identify weaknesses but don't prove historical control implementation and effectiveness.
Question 66
Which of the following describes the process of concealing code or text inside a graphical image?
Show answer and explanation
Correct answer: D. Steganography
Steganography is the practice of hiding information (text, code, messages) within other data, most commonly within graphical images. The hidden data is embedded in a way that is not obvious to an observer. This is distinct from encryption, which makes data unreadable, or hashing, which creates a unique fingerprint. Steganography aims for concealment rather than scrambling.
Why the other options are wrong
- A. Symmetric encryption scrambles data so it's unreadable without a key, rather than hiding it within another medium.
- B. Hashing creates a one-way fingerprint of data for integrity verification, not concealment within images.
- C. Data masking obscures sensitive data in databases or files, not specifically hiding content within images.
Question 67
A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting. Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability?
Show answer and explanation
Correct answer: C. Input validation
Input validation prevents cross-site scripting (XSS) by filtering, sanitizing, or rejecting malicious script input before it's processed by the application. This is the fundamental defense against XSS vulnerabilities in web forms, ensuring user-supplied data cannot execute malicious code.
Why the other options are wrong
- A. Secure cookies protect session tokens but don't prevent XSS injection in form fields.
- B. Version control manages code changes but doesn't prevent XSS vulnerabilities.
- D. Code signing verifies code authenticity but doesn't validate user input to prevent XSS.
Question 68
A security analyst scans a company's public network and discovers a host is running a remote desktop that can be used to access the production network. Which of the following changes should the security analyst recommend?
Show answer and explanation
Correct answer: B. Setting up a VPN and placing the jump server inside the firewall
Setting up a VPN with a jump server behind the firewall is the best practice for securing remote access to production networks. This creates a hardened entry point and adds network segmentation. Simply changing ports is security through obscurity, proxies don't protect the production network from compromise, and domain joining with longer passwords don't address the fundamental exposure of RDP on public networks.
Why the other options are wrong
- A. Port obfuscation through non-standard ports is security through obscurity and doesn't adequately protect from determined attackers.
- C. A proxy for web connections doesn't address the primary security concern of exposed RDP access.
- D. Domain joining and password length increase are general hardening steps but don't eliminate the core vulnerability of public RDP exposure.
Question 69
A security analyst recently read a report about a flaw in several of the organization's printer models that causes credentials to be sent over the network in cleartext, regardless of the encryption settings. Which of the following would be best to use to validate this finding?
Show answer and explanation
Correct answer: A. Wireshark
Wireshark is a network packet analyzer that captures and displays network traffic at a detailed level, allowing verification that credentials are indeed being sent in cleartext over the network. This directly validates the reported vulnerability by inspecting the actual network packets. Netcat is a network utility but not designed for detailed packet inspection; Nessus is a vulnerability scanner but may not capture actual cleartext transmission; Nmap performs port scanning and service discovery but doesn't analyze packet contents.
Why the other options are wrong
- B. Netcat is a networking utility but not designed to inspect detailed packet contents for credential cleartext.
- C. Nessus scans for vulnerabilities but doesn't directly capture and display cleartext credential transmission.
- D. Nmap identifies open ports and services but does not analyze packet contents for cleartext data.
Question 70
Which of the following security measures is required when using a cloud-based platform for IoT management?
Show answer and explanation
Correct answer: A. Encrypted connection
Encrypted connections are the fundamental security requirement for IoT devices connecting to cloud-based management platforms. This protects data in transit from interception and is essential for securing communication between IoT devices and cloud infrastructure, making it a non-negotiable baseline security measure.
Why the other options are wrong
- B. Federated identity is an advanced authentication mechanism that is not universally required for basic IoT cloud management.
- C. Firewalls are network security tools but not specifically required at the platform level for IoT management.
- D. Single sign-on is an authentication convenience feature, not a fundamental security requirement for IoT platforms.
Question 71
Which of the following is the best way to consistently determine on a daily basis whether security settings on servers have been modified?
Show answer and explanation
Correct answer: A. Automation
Automation is the best approach for consistently determining daily whether security settings have been modified because it can continuously monitor, scan, and report on configuration changes without human intervention. Automated tools can compare current settings against baselines and alert when deviations occur. A compliance checklist requires manual effort, attestation is a confirmation process, and manual audits are not scalable for daily consistency.
Why the other options are wrong
- B. A compliance checklist is a static tool that requires manual execution and is not suitable for consistent daily monitoring.
- C. Attestation is a formal acknowledgment but does not actively detect configuration modifications.
- D. Manual audits are labor-intensive and cannot provide the consistent daily monitoring needed for this purpose.
Question 72
A legacy device is being decommissioned and is no longer receiving updates or patches. Which of the following describes this scenario?
Show answer and explanation
Correct answer: D. End of life
End of life (EOL) describes when a device is no longer receiving updates, patches, or support from the manufacturer or vendor. A legacy device being decommissioned that no longer receives updates is at the end of its life cycle. This is the standard industry terminology for this scenario.
Why the other options are wrong
- A. End of business refers to a company ceasing operations, not a device's support status.
- B. End of testing refers to completion of quality assurance phases during development, not device decommissioning.
- C. End of support is related but less specific; EOL encompasses the full lifecycle end including hardware obsolescence.
Question 73
Which of the following is considered a preventive control?
Show answer and explanation
Correct answer: D. Segregation of duties
Segregation of duties is a preventive control that stops errors or fraud before they occur by ensuring no single person can complete a critical transaction alone. Configuration auditing, log correlation, and incident alerts are all detective controls that identify issues after they happen.
Why the other options are wrong
- A. Configuration auditing detects unauthorized changes after they occur, making it detective.
- B. Log correlation identifies suspicious patterns after events have been logged, making it detective.
- C. Incident alerts notify of problems already occurring, making them reactive/detective controls.
Question 74
Which of the following is the best way to secure an on-site data center against intrusion from an insider?
Show answer and explanation
Correct answer: B. Access badge
Access badges are the best control against insider intrusion because they authenticate and authorize individuals before granting entry, creating accountability through logged access records. While bollards prevent vehicle ramming, motion sensors detect movement, and video surveillance records events, only access badges actively control who can enter the data center and provide proof of identity.
Why the other options are wrong
- A. Bollards prevent vehicle intrusion but do not control personnel access.
- C. Motion sensors detect movement but do not prevent unauthorized access.
- D. Video surveillance records intrusions but does not prevent them from occurring.
Question 75
Which of the following is used to validate a certificate when it is presented to a user?
Show answer and explanation
Correct answer: A. OCSP
OCSP (Online Certificate Status Protocol) is used to validate whether a digital certificate is still valid when it is presented to a user by checking the certificate's revocation status in real-time with a certificate authority.
Why the other options are wrong
- B. CSR (Certificate Signing Request) is used to request a certificate, not to validate one.
- C. CA (Certificate Authority) is an entity that issues certificates but is not itself the validation mechanism.
- D. CRC (Cyclic Redundancy Check) is used for data integrity in transmission, not certificate validation.
Question 76
A multinational bank hosts several servers in its data center. These servers run a business-critical application used by customers to access their account information. Which of the following should the bank use to ensure accessibility during peak usage times?
Show answer and explanation
Correct answer: A. Load balancer
A load balancer distributes incoming traffic across multiple servers, ensuring that no single server becomes overwhelmed during peak usage times, directly addressing accessibility during high demand. Cloud backups provide recovery but not real-time availability; geographic dispersal addresses disaster recovery but not peak load management; disk multipathing addresses storage redundancy, not web traffic distribution.
Why the other options are wrong
- B. Cloud backups ensure data recovery but do not help handle peak usage traffic.
- C. Geographic dispersal is for disaster recovery and redundancy, not peak load distribution.
- D. Disk multipathing provides storage redundancy but does not address web server capacity during peak times.
Question 77
After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security team initiate a legal hold in response to the lawsuit. Which of the following describes the action the security team will most likely be required to take?
Show answer and explanation
Correct answer: B. Retain any communications related to the security breach until further notice.
A legal hold requires preservation of all relevant evidence and communications related to the litigation. In this case, the company must retain any communications related to the security breach and the incident response until the legal matter is resolved. This is broader than just emails between specific parties and includes all relevant documentation, communications, logs, and evidence pertaining to the breach itself.
Why the other options are wrong
- A. A 30-day retention is too limited; legal holds extend until the litigation is resolved, and it's not limited to customer communications.
- C. Internal security team communications are relevant but represent only a subset of what must be retained.
- D. The requirement is indefinite duration until further notice, but it's specifically for communications related to the breach, not all customer emails.
Question 78
A company that is located in an area prone to hurricanes is developing a disaster recovery plan and looking at site considerations that allow the company to immediately continue operations. Which of the following is the best type of site for this company?
Show answer and explanation
Correct answer: D. Hot
A hot site is a fully equipped, operational backup facility that is constantly synchronized with the primary site and allows immediate failover with zero downtime. For a hurricane-prone area requiring immediate continuation of operations, this is the only appropriate choice among the options.
Why the other options are wrong
- A. A cold site has no equipment or data and requires significant time to become operational.
- B. Tertiary is not a standard disaster recovery site classification.
- C. A warm site has some equipment and periodic data synchronization but requires hours to become fully operational.
Question 79
A security officer is implementing a security awareness program and has placed security-themed posters around the building and assigned online user training. Which of the following will the security officer most likely implement?
Show answer and explanation
Correct answer: C. Phishing campaign
A phishing campaign is a practical security awareness training tool that tests employee response to social engineering attacks. Combined with posters and online training, it demonstrates real-world threats and measures user compliance. The other options are security controls, not awareness program components.
Why the other options are wrong
- A. Password policy is an administrative control, not part of awareness training implementation.
- B. Access badges are physical security controls, not awareness program elements.
- D. Risk assessment is an evaluation methodology, not an awareness program activity.
Question 80
A company is expanding its threat surface program and allowing individuals to security test the company’s internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?
Show answer and explanation
Correct answer: B. Bug bounty
A bug bounty program compensates external researchers and security professionals for discovering and reporting vulnerabilities in a company's systems. This crowdsourced approach expands the scope of security testing beyond traditional methods. Open-source intelligence involves gathering public information, red team exercises simulate adversarial attacks in a controlled manner, and penetration testing is typically conducted by hired professionals under contract rather than a public compensation program.
Why the other options are wrong
- A. Open-source intelligence involves collecting and analyzing publicly available information, not testing systems.
- C. Red team exercises are internal or contracted adversarial simulations, not crowdsourced public programs.
- D. Penetration testing is typically contracted work, not a public compensation-based program for outside researchers.
Question 81
Which of the following is the best reason an organization should enforce a data classification policy to help protect its most sensitive information?
Show answer and explanation
Correct answer: C. The organization will have the ability to create security requirements based on classification levels.
Data classification enables organizations to create differentiated security requirements and controls based on sensitivity levels, ensuring appropriate protection mechanisms for each classification tier. While end users benefit from awareness and access levels may be created, the fundamental purpose of classification policy is to establish risk-based security requirements that match the value and sensitivity of data.
Why the other options are wrong
- A. User awareness of classification is a benefit but not the primary purpose of the policy.
- B. Access levels are a result, but classification itself is about determining what controls are needed.
- D. Security analysts' ability to see classifications is a tool benefit, not the primary purpose.
Question 82
A security team is addressing a risk associated with the attack surface of the organization's web application over port 443. Currently, no advanced network security capabilities are in place. Which of the following would be best to set up? (Choose two.)
Show answer and explanation
Correct answer: A, E. NIDS; WAF
NIDS (A) provides network-level detection of malicious traffic on port 443, monitoring for attack patterns. WAF (E) is specifically designed to protect web applications by filtering and monitoring HTTP/HTTPS traffic for application-layer attacks. Both address the web application attack surface, NIDS provides network detection while WAF provides application-layer protection. These two complementary controls directly address the stated concern.
Why the other options are wrong
- B. Honeypots are deceptive tools for threat research, not primary defenses for production attack surfaces.
- C. Certificate revocation lists manage certificate validity, not application attack surface protection.
- D. HIPS (host-based) protects individual endpoints but doesn't address network-level web application threats.
- F. SIEM is for log aggregation and analysis, not a preventive control for web application attacks.
Question 83
A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the following best describes this policy?
Show answer and explanation
Correct answer: B. Sanitization
Sanitization is the process of securely wiping, erasing, or overwriting data on storage devices before they are decommissioned or recycled. This policy ensures that sensitive data cannot be recovered from hard drives that are sent to recycling, which is exactly what the scenario describes.
Why the other options are wrong
- A. Enumeration is the process of discovering and listing systems and assets, not related to secure data removal.
- C. Destruction involves physically destroying the media itself, which is more extreme than sanitization and would prevent recycling.
- D. Inventory is the process of tracking and cataloging assets, not related to secure data removal.
Question 84
Which of the following most likely describes why a security engineer would configure all outbound emails to use S/MIME digital signatures?
Show answer and explanation
Correct answer: D. To ensure non-repudiation
S/MIME digital signatures provide non-repudiation, meaning the sender cannot deny having sent the email because their private key created the signature. This cryptographic proof establishes authenticity and prevents senders from denying responsibility for messages they signed.
Why the other options are wrong
- A. While compliance may be achieved through signatures, non-repudiation is the primary security purpose.
- B. Digital signatures do not affect email delivery rates.
- C. Signatures authenticate the sender but do not directly block phishing attacks; email filtering addresses that.
Question 85
Which of the following is a common data removal option for companies that want to wipe sensitive data from hard drives in a repeatable manner but allow the hard drives to be reused?
Show answer and explanation
Correct answer: A. Sanitization
Sanitization is the process of securely removing sensitive data from storage media while maintaining the ability to reuse the hardware. It overwrites data in a repeatable manner using standards like DOD 5220.22-M, making recovery impossible while preserving drive functionality. This distinguishes it from degaussing (which destroys the drive) and simple formatting (which doesn't securely erase data).
Why the other options are wrong
- B. Formatting does not securely erase data; deleted files can be recovered with forensic tools.
- C. Degaussing destroys the hard drive with magnetic fields, making it unreusable for future purposes.
- D. Defragmentation is a performance optimization technique unrelated to data removal.
Question 86
A security team has been alerted to a flood of incoming emails that have various subject lines and are addressed to multiple email inboxes. Each email contains a URL shortener link that is redirecting to a dead domain. Which of the following is the best step for the security team to take?
Show answer and explanation
Correct answer: D. Block the URL shortener domain in the web proxy.
Blocking the URL shortener domain at the web proxy prevents access to the malicious links at the source, stopping the threat before users can click them. This is the most efficient and effective control that addresses the root vector of attack. Creating subject line blocklists is ineffective due to varied subject lines, DNS sinkholes don't address email delivery, and mass quarantine without targeting the specific threat vector is inefficient.
Why the other options are wrong
- A. Subject lines vary in the attack, making blocklisting ineffective.
- B. A DNS sinkhole doesn't prevent emails from being sent or accessed via web proxy.
- C. Quarantining all emails is an overreaction and doesn't address the specific threat vector of the URL shortener.
Question 87
A company must ensure sensitive data at rest is rendered unreadable. Which of the following will the company most likely use?
Show answer and explanation
Correct answer: C. Encryption
Encryption is the standard method for rendering sensitive data at rest unreadable. It converts plaintext data into ciphertext using cryptographic algorithms, ensuring that only those with the proper decryption key can access the original data. This is the most direct and widely accepted approach for protecting data confidentiality.
Why the other options are wrong
- A. Hashing is irreversible and used for integrity verification, not for rendering data readable again.
- B. Tokenization replaces sensitive data with tokens but doesn't inherently render data unreadable in the same way encryption does.
- D. Segmentation is a network security strategy that isolates systems but doesn't directly protect data at rest.
Question 88
A company wants to ensure that the software it develops will not be tampered with after the final version is completed. Which of the following should the company most likely use?
Show answer and explanation
Correct answer: A. Hashing
Hashing creates a unique fingerprint of software that can be compared later to detect any tampering or changes. If the software is modified after release, its hash will change, immediately revealing tampering. This ensures integrity verification without preventing use of the software, unlike encryption which would prevent execution.
Why the other options are wrong
- B. Encryption protects data confidentiality but doesn't detect tampering and would prevent the software from running.
- C. Baselines establish reference points for comparison but are a framework, not a technical method for detecting tampering.
- D. Tokenization replaces sensitive data with tokens and is unrelated to detecting software tampering.
Question 89
A manager receives an email that contains a link to receive a refund. After hovering over the link, the manager notices that the domain's URL points to a suspicious link. Which of the following security practices helped the manager to identify the attack?
Show answer and explanation
Correct answer: A. End user training
End user training enabled the manager to recognize phishing indicators by teaching users to verify URLs and look for suspicious links. The manager's ability to hover over and inspect the link domain demonstrates security awareness training in action. This is a direct result of education on recognizing phishing attacks.
Why the other options are wrong
- B. Policy review addresses organizational rules but doesn't explain the manager's ability to inspect and identify the suspicious URL.
- C. URL scanning is a technical tool, but the scenario describes manual user inspection, not automated scanning.
- D. Plain text email is a technical characteristic; user training is what allowed the manager to identify the malicious intent.
Question 90
Which of the following risk management strategies should an enterprise adopt first if a legacy application is critical to business operations and there are preventative controls that are not yet implemented?
Show answer and explanation
Correct answer: A. Mitigate
When a critical business application has known vulnerabilities and preventative controls are available but not yet implemented, mitigation is the appropriate first strategy. Mitigation involves implementing controls to reduce the risk to an acceptable level. This is more proactive than accepting risk, more practical than avoidance (which would require shutting down a critical system), and should precede transfer strategies. Implementing the available preventative controls directly addresses the risk.
Why the other options are wrong
- B. Accepting risk without implementing available controls is irresponsible when preventative measures exist.
- C. Transferring risk through insurance is secondary to implementing available technical controls.
- D. Avoidance would require decommissioning a critical system, which is not viable.
Question 91
A security analyst at an organization observed several user logins from outside the organization's network. The analyst determined that these logins were not performed by individuals within the organization. Which of the following recommendations would reduce the likelihood of future attacks? (Choose two.)
Show answer and explanation
Correct answer: B, D. Conditional access policies; Implementation of additional authentication factors
Conditional access policies (B) can restrict logins based on geographic location, device compliance, and risk factors, directly preventing unauthorized external logins. Implementation of additional authentication factors (D) such as MFA makes it significantly harder for attackers to gain access even with compromised credentials. Together, these provide both preventive controls (preventing unauthorized access) and detective controls (requiring stronger authentication).
Why the other options are wrong
- A. Disciplinary actions don't prevent future attacks; these logins weren't from actual users within the organization.
- C. More regular account audits detect issues after the fact but don't prevent unauthorized access from occurring.
- E. Content filtering is irrelevant to preventing unauthorized user logins from external networks.
- F. Reviewing permissions doesn't prevent attackers from logging in with compromised credentials in the first place.
Question 92
Which of the following describes effective change management procedures?
Show answer and explanation
Correct answer: B. Having a backout plan when a patch fails
Having a backout plan (rollback procedure) when a patch fails is a critical component of effective change management, ensuring that failed deployments can be quickly reversed with minimal impact. Approving changes after deployment violates proper change control procedures. Using a spreadsheet for tracking is outdated and ineffective compared to proper change management systems. Automatic bypass of change control for security updates circumvents the change management process and introduces risk.
Why the other options are wrong
- A. Approving changes after deployment violates change control procedures
- C. Manual spreadsheet tracking is inefficient and lacks proper change control
- D. Bypassing change control for security updates defeats the purpose of change management
Question 93
A security investigation revealed that malicious software was installed on a server using a server administrator's credentials. During the investigation, the server administrator explained that Telnet was regularly used to log in. Which of the following most likely occurred?
Show answer and explanation
Correct answer: B. A packet capture tool was used to steal the password.
Telnet transmits all traffic, including credentials, in cleartext over the network. A packet capture tool can easily intercept and extract the administrator's password from the network traffic. This is the classic vulnerability of Telnet and the most likely attack vector given the context of regular Telnet use.
Why the other options are wrong
- A. Spraying attacks require knowledge of valid usernames and don't apply to a specific known administrator account.
- C. A RAT would not be necessary when credentials can be easily captured from Telnet traffic.
- D. Dictionary attacks require login attempts which would be detectable; passive packet capture is more stealthy and likely.
Question 94
A company's marketing department collects, modifies, and stores sensitive customer data. The infrastructure team is responsible for securing the data while in transit and at rest. Which of the following data roles describes the customer?
Show answer and explanation
Correct answer: C. Subject
The customer is the data subject, the individual whose personal information is being collected, modified, and stored. In data protection terminology, the subject is the person whose data is being processed, regardless of which department collects it or which department secures it.
Why the other options are wrong
- A. Processor is the entity that processes data on behalf of the owner (the marketing department in this case).
- B. Custodian is the entity responsible for safeguarding the data (the infrastructure team in this case).
- D. Owner is typically the organization or the individual with legal rights over the data; here the organization owns the customer data.
Question 95
Which of the following physical controls can be used to both detect and deter? (Choose two.)
Show answer and explanation
Correct answer: A, D. Lighting; Sensor
Lighting can both detect intruders through visibility and deter them by eliminating shadows and concealment. Sensors can both detect unauthorized access through triggering alarms and deter through visible notification. Fencing deters but primarily contains rather than detects; signage only deters; bollards only deter; locks only control access but do not detect.
Why the other options are wrong
- B. Fencing primarily deters and contains but does not actively detect intrusions.
- C. Signage only deters potential intruders; it does not detect anything.
- E. Bollards deter vehicle access but do not detect unauthorized presence.
- F. Locks control access but do not independently detect unauthorized attempts.
Question 96
A newly identified network access vulnerability has been found in the OS of legacy IoT devices. Which of the following would best mitigate this vulnerability quickly?
Show answer and explanation
Correct answer: C. Segmentation
Network segmentation is the best quick mitigation for a vulnerability in legacy IoT devices that cannot be patched. By isolating the vulnerable devices to a restricted network segment, the organization prevents attackers from accessing them via the primary network. This can be implemented immediately without waiting for patches, replacements, or device updates. Patching may not be available for legacy devices, replacement takes time, and insurance addresses financial risk but not the vulnerability itself.
Why the other options are wrong
- A. Insurance addresses financial risk, not vulnerability mitigation.
- B. Patching may not be available for legacy devices with unpatched OS vulnerabilities.
- D. Replacement takes considerable time and cost, not a quick mitigation.
Question 97
A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of the following should the administrator do first?
Show answer and explanation
Correct answer: C. Apply classifications to the data.
Before implementing DLP rules and blocks, the administrator must first classify sensitive customer data so the system knows what to protect. Classification establishes the foundation for all subsequent DLP policies, without knowing what data is sensitive, blocking cannot be properly targeted. Blocking websites, email attachments, or removing permissions without first identifying sensitive data would be ineffective and could disrupt legitimate business operations.
Why the other options are wrong
- A. Blocking cloud storage without data classification may harm business operations.
- B. Creating blocking rules requires knowing which data is sensitive first.
- D. Removing all permissions is premature without understanding data sensitivity levels.
Question 98
A security administrator needs to create firewall rules for the following protocols: RTP, SIP, H.323. and SRTP. Which of the following does this rule set support?
Show answer and explanation
Correct answer: B. VoIP
RTP (Real-time Transport Protocol), SIP (Session Initiation Protocol), H.323, and SRTP (Secure Real-time Transport Protocol) are all protocols used for Voice over IP (VoIP) communication. SIP and H.323 handle call signaling and setup, while RTP and SRTP transport the actual voice data (encrypted in SRTP's case). These protocols are the foundational technologies for VoIP systems.
Why the other options are wrong
- A. RTOS (Real-Time Operating System) is not related to these communication protocols.
- C. SoC (System-on-Chip) is a hardware architecture concept, not related to these protocols.
- D. HVAC (Heating, Ventilation, Air Conditioning) is a building management system unrelated to VoIP.
Question 99
Which of the following best describes the risk present after controls and mitigating factors have been applied?
Show answer and explanation
Correct answer: A. Residual
Residual risk is the risk that remains after controls and mitigating factors have been applied. It represents the actual risk level an organization faces after implementing security measures. This is distinct from inherent risk (risk before controls) and avoided risk (completely eliminated). Operational risk refers to risks from business operations, not control effectiveness.
Why the other options are wrong
- B. Avoided risk means the risk was completely eliminated or not pursued; residual risk is what remains despite controls.
- C. Inherent risk is the original risk before any controls are applied, not after.
- D. Operational risk relates to risks from day-to-day operations, not the outcome of applying controls.
Question 100
During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user's intranet account? (Choose two.)
Show answer and explanation
Correct answer: A, C. Federation; Password complexity
Password complexity (C) directly addresses the password requirements described (ten characters, numbers, letters, and special characters). Federation (A) describes the concept of using one intranet profile to grant access to multiple company-owned websites without separate authentication, enabling single sign-on across systems. Together, these concepts safeguard the intranet account through strong passwords while enabling streamlined multi-site access.
Why the other options are wrong
- B. Identity proofing verifies a user's real identity during onboarding but isn't about granting access to multiple sites.
- D. Default password changes refer to forcing initial password modification, not the ongoing access management concept.
- E. Password managers store credentials but don't directly address federation or multi-site access.
- F. Open authentication (OAuth) is an authorization protocol but less commonly used for this intranet federation scenario.
Question 101
An auditor discovered multiple insecure ports on some servers. Other servers were found to have legacy protocols enabled. Which of the following tools did the auditor use to discover these issues?
Show answer and explanation
Correct answer: A. Nessus
Nessus is a comprehensive vulnerability scanner that identifies open ports and insecure protocols running on servers. It performs active scanning to detect security configuration issues, including enabled legacy protocols and exposed insecure ports, making it the appropriate tool for this type of audit.
Why the other options are wrong
- B. curl is a command-line tool for transferring data, not for vulnerability scanning.
- C. Wireshark is a packet analyzer for capturing and inspecting network traffic, not for port/protocol discovery.
- D. netcat is a simple networking utility for connections, not a comprehensive vulnerability assessment tool.
Question 102
Which of the following methods to secure credit card data is best to use when a requirement is to see only the last four numbers on a credit card?
Show answer and explanation
Correct answer: C. Masking
Masking is the appropriate technique when the requirement is to display only specific data elements (like the last four digits of a credit card) while obscuring the rest. Masking hides sensitive portions of data while keeping other parts visible for operational purposes, making it ideal for this use case.
Why the other options are wrong
- A. Encryption secures data but doesn't allow selective visibility of specific digits without decryption.
- B. Hashing is one-way and irreversible, preventing display of the last four digits.
- D. Tokenization replaces data with surrogates but doesn't preserve visible portions like the last four digits in the intended way.
Question 103
A user downloaded software from an online forum. After the user installed the software, the security team observed external network traffic connecting to the user's computer on an uncommon port. Which of the following is the most likely explanation of this unauthorized connection?
Show answer and explanation
Correct answer: D. The software contained a backdoor.
A backdoor is a hidden entry point installed by malware that allows attackers to remotely access and control a compromised system. External network traffic connecting to the user's computer on an uncommon port after software installation is the classic indicator of a backdoor establishing command-and-control communication. Keyloggers don't establish incoming connections, ransomware focuses on encryption not remote access, and fileless viruses don't require traditional installation.
Why the other options are wrong
- A. Keyloggers capture keyboard input but typically don't initiate external network connections to the infected machine.
- B. Ransomware encrypts files and extorts users; it doesn't characteristically establish inbound remote access connections.
- C. Fileless viruses run in memory without installation and don't match the download-then-connection pattern described.
Question 104
The Chief Information Security Officer (CISO) at a large company would like to gain an understanding of how the company's security policies compare to the requirements imposed by external regulators. Which of the following should the CISO use?
Show answer and explanation
Correct answer: B. Internal audit
An internal audit is the appropriate tool for comparing company security policies against external regulatory requirements. Internal audits systematically review controls and policies against established standards and regulations, providing the CISO with a comprehensive understanding of compliance gaps.
Why the other options are wrong
- A. A penetration test identifies vulnerabilities through active exploitation but does not assess policy compliance.
- C. Attestation is a formal statement of compliance but does not provide the analysis needed to understand policy gaps.
- D. An external examination could provide an outside perspective but an internal audit is the standard approach for this policy comparison work.
Question 105
A security administrator is reissuing a former employee's laptop. Which of the following is the best combination of data handling activities for the administrator to perform? (Choose two.)
Show answer and explanation
Correct answer: B, E. Certification; Sanitization
When reissuing a former employee's laptop, the administrator should perform Sanitization (secure data removal/wiping) and Certification (documenting that the device has been properly cleaned and is safe to reissue). These ensure data confidentiality and provide proof of proper handling.
Why the other options are wrong
- A. Data retention is inappropriate when reissuing a device; data should be removed.
- C. Destruction applies when devices are being decommissioned, not reissued.
- D. Classification organizes data sensitivity levels but doesn't handle the reissue requirement.
- F. Enumeration documents assets but is not a data handling activity for device reissuance.
Question 106
After conducting a vulnerability scan, a systems administrator notices that one of the identified vulnerabilities is not present on the systems that were scanned. Which of the following describes this example?
Show answer and explanation
Correct answer: A. False positive
A false positive occurs when a vulnerability scanner reports a vulnerability that does not actually exist on the scanned systems. The vulnerability was identified by the scan but is not present in reality, making this a false positive result.
Why the other options are wrong
- B. A false negative is when a real vulnerability exists but the scanner fails to detect it.
- C. A true positive is when a vulnerability is correctly identified and actually exists.
- D. A true negative is when the scanner correctly identifies that a vulnerability does not exist.
Question 107
Which of the following describes a security alerting and monitoring tool that collects system, application, and network logs from multiple sources in a centralized system?
Show answer and explanation
Correct answer: A. SIEM
SIEM (Security Information and Event Management) is the primary tool that collects, aggregates, and analyzes logs from multiple sources (systems, applications, networks) in a centralized location. It provides alerting, monitoring, and correlation capabilities essential for comprehensive security monitoring and incident response.
Why the other options are wrong
- B. DLP (Data Loss Prevention) focuses on preventing data exfiltration, not log collection and monitoring.
- C. IDS (Intrusion Detection System) detects network attacks but doesn't centralize logs from all sources.
- D. SNMP (Simple Network Management Protocol) is used for network device management, not security log aggregation.
Question 108
Which of the following security controls is most likely being used when a critical legacy server is segmented into a private network?
Show answer and explanation
Correct answer: C. Compensating
Network segmentation of a legacy server is a compensating control, an alternative security measure implemented because the legacy system cannot be easily updated or patched to meet modern security standards. It compensates for the system's inherent vulnerabilities by isolating it from general network access.
Why the other options are wrong
- A. A deterrent control discourages attacks; segmentation doesn't deter threats.
- B. A corrective control remediates damage after an incident; segmentation prevents incidents.
- D. A preventive control stops incidents before they occur, but compensating controls are specifically chosen when preventive measures aren't feasible.
Question 109
A client demands at least 99.99% uptime from a service provider's hosted security services. Which of the following documents includes the information the service provider should return to the client?
Show answer and explanation
Correct answer: D. SLA
An SLA (Service Level Agreement) is the document that specifies measurable performance metrics and uptime guarantees between a service provider and client. It defines the specific service levels, including availability percentages like 99.99% uptime, along with remedies if those levels are not met. This is the standard contractual document for defining such technical requirements.
Why the other options are wrong
- A. MOA (Memorandum of Agreement) is a general agreement but does not typically contain specific technical performance metrics.
- B. SOW (Statement of Work) describes the work to be performed but not the ongoing service level guarantees.
- C. MOU (Memorandum of Understanding) is a preliminary agreement and lacks the binding technical specifications of an SLA.
Question 110
After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in order to close an invoice. Which of the following topics did the user recognize from the training?
Show answer and explanation
Correct answer: C. Social engineering
Social engineering is the manipulation of people into divulging confidential information through deception and trust exploitation. The scenario describes an attacker impersonating an executive and requesting sensitive information via phone call, which is a classic social engineering tactic. Insider threats involve current employees, email phishing uses email, and whaling specifically targets high-level executives (though this applies to any employee), making social engineering the broadest and most accurate answer.
Why the other options are wrong
- A. Insider threat refers to harm from current employees, not external impersonation attacks.
- B. Email phishing uses email, whereas this attack occurred via phone call.
- D. Whaling targets senior executives specifically; this call targeted a general employee.
Question 111
An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?
Show answer and explanation
Correct answer: D. Compensating controls
Compensating controls are alternative safeguards implemented when standard security measures cannot be applied. Disabling unneeded services and placing a firewall in front of a legacy system that cannot be updated or patched represents compensating controls, alternative security measures to reduce risk when the system itself cannot be fully secured.
Why the other options are wrong
- A. Exception refers to accepting risk temporarily, not implementing alternative controls.
- B. Segmentation isolates systems but doesn't specifically describe compensating for legacy system limitations with firewalls.
- C. Risk transfer involves shifting risk to another party through insurance or outsourcing, not implementing additional security controls.
Question 112
A newly appointed board member with cybersecurity knowledge wants the board of directors to receive a quarterly report detailing the number of incidents that impacted the organization. The systems administrator is creating a way to present the data to the board of directors. Which of the following should the systems administrator use?
Show answer and explanation
Correct answer: D. Dashboard
A dashboard is the appropriate tool for presenting quarterly incident metrics to executive leadership. It provides visual, digestible summaries of key performance indicators, exactly what a board of directors needs for strategic decision-making, whereas the other options are technical data sources unsuitable for executive reporting.
Why the other options are wrong
- A. Packet captures are granular technical data, not executive summaries.
- B. Vulnerability scans show vulnerabilities, not incident counts.
- C. Metadata is raw technical information, not a presentation format for board reporting.
Question 113
The CIRT is reviewing an incident that involved a human resources recruiter exfiltrating sensitive company data. The CIRT found that the recruiter was able to use HTTP over port 53 to upload documents to a web server. Which of the following security infrastructure devices could have identified and blocked this activity?
Show answer and explanation
Correct answer: B. NGFW utilizing application inspection
An NGFW (Next-Generation Firewall) utilizing application inspection can identify and block HTTP traffic over port 53 because it performs deep packet inspection and understands application protocols, recognizing that HTTP should not be running on the DNS port (53). This anomalous protocol-port combination violates normal network behavior. A WAF focuses on HTTP/HTTPS web application attacks. A UTM threat feed is signature-based and less likely to catch protocol anomalies. SD-WAN with IPSec is for network segmentation and encryption, not protocol anomaly detection.
Why the other options are wrong
- A. WAF is designed for web application attacks, not protocol-port anomalies
- C. UTM threat feeds detect known threats but not necessarily protocol misuse patterns
- D. SD-WAN with IPSec encrypts traffic but doesn't inspect for protocol anomalies
Question 114
A systems administrator is looking for a low-cost application-hosting solution that is cloud-based. Which of the following meets these requirements?
Show answer and explanation
Correct answer: A. Serverless framework
A serverless framework is a cloud-based application hosting solution that offers low cost because users pay only for actual code execution without provisioning or managing servers. This directly meets both requirements: it is cloud-based and cost-effective. Type 1 hypervisor is physical virtualization infrastructure (not cloud-hosted), SD-WAN and SDN are network technologies used for network management, not application hosting.
Why the other options are wrong
- B. Type 1 hypervisors run directly on hardware and require on-premises infrastructure; they are not cloud-based solutions.
- C. SD-WAN (Software-Defined WAN) manages wide-area networks, not application hosting.
- D. SDN (Software-Defined Networking) is a networking architecture approach; it does not provide application hosting capabilities.
Question 115
Which of the following agreement types defines the time frame in which a vendor needs to respond?
Show answer and explanation
Correct answer: B. SLA
A Service Level Agreement (SLA) is a contract that defines the expected service levels, including response times and resolution times. It specifically establishes the time frame within which a vendor must respond to issues and resolve them. SLAs are the standard tool for documenting these response and resolution commitments.
Why the other options are wrong
- A. A Statement of Work (SOW) describes what work will be performed, not response time commitments.
- C. A Memorandum of Agreement (MOA) outlines general understandings but doesn't specify response time frames.
- D. A Memorandum of Understanding (MOU) is a preliminary agreement indicating intent, not a binding contract with specific response times.
Question 116
A malicious update was distributed to a common software platform and disabled services at many organizations. Which of the following best describes this type of vulnerability?
Show answer and explanation
Correct answer: D. Supply chain
A malicious update distributed through a legitimate software platform represents a supply chain attack, where the attacker compromises a trusted vendor to distribute malware to multiple organizations downstream. This affects the security of all organizations using that platform.
Why the other options are wrong
- A. DDoS attacks target availability through traffic flooding, not software updates.
- B. Rogue employees are individuals acting maliciously within an organization, not external supply chain compromises.
- C. Insider threat requires a person within the target organization, whereas this originates from a software vendor.
Question 117
A company is working with a vendor to perform a penetration test. Which of the following includes an estimate about the number of hours required to complete the engagement?
Show answer and explanation
Correct answer: A. SOW
A Statement of Work (SOW) is a document that defines the scope, objectives, deliverables, timeline, and estimated hours/effort required for a project or engagement, including penetration testing. The SOW explicitly includes labor estimates and duration. A BPA (Blanket Purchase Agreement) is a procurement tool, an SLA (Service Level Agreement) defines service standards, and an NDA (Non-Disclosure Agreement) protects confidential information, none include effort estimates.
Why the other options are wrong
- B. BPA is a purchasing agreement framework, not an engagement specification document.
- C. SLA defines service performance standards and response times, not project effort estimates.
- D. NDA protects confidentiality but does not include engagement hour estimates.
Question 118
Which of the following vulnerabilities is exploited when an attacker overwrites a register with a malicious address?
Show answer and explanation
Correct answer: C. Buffer overflow
A buffer overflow occurs when an attacker writes more data into a buffer than it can hold, causing the excess data to overwrite adjacent memory locations, including registers and return addresses. This allows an attacker to inject malicious code or redirect program execution to a malicious address. This is the classic definition and exploitation method of buffer overflow vulnerabilities.
Why the other options are wrong
- A. VM escape involves breaking out of virtual machine isolation, not overwriting registers with malicious addresses.
- B. SQL injection manipulates database queries through unsanitized input, not register manipulation.
- D. Race conditions exploit timing gaps in concurrent processes, not register overwrites.
Question 119
An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device. Which of the following best describes the user’s activity?
Show answer and explanation
Correct answer: D. Insider threat
An insider threat describes malicious or negligent activity by an authorized user with access to organizational systems and data. The scenario of a user logging in remotely after hours and copying large amounts of customer data to a personal device is a classic example of insider threat behavior, unauthorized data exfiltration by someone with legitimate credentials. This is not penetration testing, phishing, or an external audit.
Why the other options are wrong
- A. Penetration testing is authorized security testing, not unauthorized data copying by employees.
- B. Phishing is a social engineering attack targeting users, not the exfiltration of data by an authenticated user.
- C. An external audit is a legitimate, authorized review process, not unauthorized after-hours data copying.
Question 120
An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take? (Choose two.)
Show answer and explanation
Correct answer: A, C. Disable default accounts; Remove unnecessary services.
Server hardening involves reducing the attack surface by disabling default accounts (which are commonly targeted and known) and removing unnecessary services (which eliminates potential vulnerabilities). Both steps directly reduce security exposure. Adding to inventory, documenting passwords, sending logs to SIEM, and domain joining are important post-hardening or operational tasks but are not hardening steps themselves.
Why the other options are wrong
- B. Asset inventory tracking is a management function, not a hardening activity.
- D. Documenting default passwords is a security risk and violates hardening principles.
- E. Sending logs to SIEM is a monitoring and detection activity, not a hardening step.
- F. Joining the domain is a configuration step, not a hardening activity.
Question 121
A security practitioner completes a vulnerability assessment on a company’s network and finds several vulnerabilities, which the operations team remediates. Which of the following should be done next?
Show answer and explanation
Correct answer: C. Rescan the network.
After remediation efforts are completed, rescanning the network is the essential next step to verify that vulnerabilities have been successfully fixed and to ensure the remediation was effective. This validates that the security controls are working and closes the loop on the vulnerability management process. A report would come after verification, and a penetration test is a more advanced assessment typically done separately.
Why the other options are wrong
- A. An audit is a compliance check, not necessarily the next step after remediation verification.
- B. A penetration test is typically scheduled separately and is not the immediate next step after vulnerability remediation.
- D. A report should be submitted after verifying that remediation was successful through rescanning.
Question 122
A security analyst is investigating a workstation that is suspected of outbound communication to a command-and-control server. During the investigation, the analyst discovered that logs on the endpoint were deleted. Which of the following logs would the analyst most likely look at next?
Show answer and explanation
Correct answer: B. Firewall
When endpoint logs have been deleted, a firewall log is the next best source to investigate outbound command-and-control communications. Firewall logs maintain network traffic records on external devices and are not under the compromised endpoint's control, making them resistant to local deletion.
Why the other options are wrong
- A. IPS (Intrusion Prevention System) logs may be helpful but are less reliable than firewall logs for this scenario.
- C. ACL (Access Control List) logs relate to access permissions, not network traffic patterns.
- D. Windows security logs are on the endpoint itself and were already deleted by the attacker.
Question 123
Which of the following describes the maximum allowance of accepted risk?
Show answer and explanation
Correct answer: D. Risk threshold
Risk threshold describes the maximum level or amount of risk that an organization is willing to accept. It represents the boundary between acceptable and unacceptable risk levels and is used to determine when risk mitigation actions must be taken.
Why the other options are wrong
- A. Risk indicator is a metric or signal that suggests the presence or level of risk but does not define maximum acceptance.
- B. Risk level is a general classification of risk severity but is not specifically the maximum acceptable amount.
- C. Risk score is a numerical rating of risk but does not define the maximum acceptable threshold.
Question 124
Which of the following would help ensure a security analyst is able to accurately measure the overall risk to an organization when a new vulnerability is disclosed?
Show answer and explanation
Correct answer: A. A full inventory of all hardware and software
A full inventory of all hardware and software is essential to accurately measure organizational risk when a vulnerability is disclosed. Without knowing what systems and applications are deployed throughout the organization, the analyst cannot determine exposure scope, affected assets, or overall risk impact.
Why the other options are wrong
- B. System classification helps prioritize but doesn't tell you what systems exist to assess exposure.
- C. System owners help with notification but don't provide the asset inventory needed for risk measurement.
- D. Third-party assessments are external perspectives but don't replace the need for internal asset inventory.
Question 125
A systems administrator notices that one of the systems critical for processing customer transactions is running an end-of-life operating system. Which of the following techniques would increase enterprise security?
Show answer and explanation
Correct answer: B. Placing the system in an isolated VLAN
Placing an end-of-life system in an isolated VLAN increases enterprise security by limiting network access and containing potential compromises. This network segmentation prevents lateral movement and limits exposure to modern threats that the unpatched system cannot defend against, while maintaining availability of critical transaction processing.
Why the other options are wrong
- A. HIDS monitoring detects intrusions but does not prevent them; an end-of-life system remains vulnerable regardless.
- C. Decommissioning may not be feasible if the system is critical for customer transactions.
- D. Drive encryption protects data at rest but does not prevent exploitation of the unpatched operating system vulnerabilities.
Question 126
A user would like to install software and features that are not available with a smartphone's default software. Which of the following would allow the user to install unauthorized software and enable new features?
Show answer and explanation
Correct answer: C. Jailbreaking
Jailbreaking removes restrictions imposed by the device manufacturer, allowing installation of unauthorized software and enabling features not available in the default software. It bypasses the device's security restrictions to provide administrative access.
Why the other options are wrong
- A. SQLi is a database injection attack, not related to installing unauthorized software.
- B. Cross-site scripting is a web application attack, not related to smartphone software installation.
- D. Side loading is installing apps from sources other than the official app store, but jailbreaking specifically removes OS restrictions.
Question 127
The author of a software package is concerned about bad actors repackaging and inserting malware into the software. The software download is hosted on a website, and the author exclusively controls the website's contents. Which of the following techniques would best ensure the software's integrity?
Show answer and explanation
Correct answer: B. Code signing
Code signing allows users to cryptographically verify that the software has not been modified and originates from the legitimate author. This prevents bad actors from repackaging malware-infected versions while maintaining the legitimate signature. Input validation protects against attacks but doesn't verify package integrity; secure cookies relate to web sessions; fuzzing tests for vulnerabilities but doesn't prevent tampering.
Why the other options are wrong
- A. Input validation protects applications but does not verify the integrity of the downloaded package itself.
- C. Secure cookies protect web session data but are irrelevant to software package integrity.
- D. Fuzzing identifies vulnerabilities but does not prevent or detect malware injection into repackaged software.
Question 128
Which of the following data roles is responsible for identifying risks and appropriate access to data?
Show answer and explanation
Correct answer: A. Owner
The Data Owner is responsible for identifying risks associated with their data and determining appropriate access controls and permissions. This is a fundamental responsibility of data ownership. A custodian manages and maintains data, a steward ensures quality and proper use, and a controller determines how data is processed, but the owner specifically identifies risks and defines access policies.
Why the other options are wrong
- B. Custodian manages and maintains data but does not determine access policies.
- C. Steward ensures data quality and proper use but is not responsible for identifying risks and defining access.
- D. Controller (in GDPR context) determines processing but is not the primary role for identifying access risks.
Question 129
Which of the following incident response activities ensures evidence is properly handled?
Show answer and explanation
Correct answer: B. Chain of custody
Chain of custody is the specific process that ensures evidence is properly handled, documented, and tracked throughout the incident response process. It maintains a detailed record of who collected, handled, stored, and analyzed evidence, which is critical for maintaining integrity and admissibility in legal proceedings.
Why the other options are wrong
- A. E-discovery is about locating and retrieving digital data but does not specifically ensure proper evidence handling protocols.
- C. Legal hold is a process to preserve data for litigation but does not address the chain of custody procedures.
- D. Preservation is about keeping data intact but does not specifically document the handling and custody of evidence throughout the process.
Question 130
Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included. Which of the following best describes how the controls should be set up?
Show answer and explanation
Correct answer: C. Safety controls should fail open.
Safety controls, particularly those protecting human life in data centers (such as emergency exits, fire suppression, and physical safety systems), must fail open to ensure people can always escape or that life-safety systems activate. Denying access during an emergency could endanger lives. Logical security controls and remote access should fail closed for security, but human safety takes precedence.
Why the other options are wrong
- A. Remote access points failing closed is correct security practice but doesn't address the human life consideration mentioned in the question.
- B. Logging controls failing open would lose audit trails and compromise security monitoring capabilities.
- D. While logical security controls should generally fail closed, this doesn't address the human life protection priority stated in the question.
Question 131
The local administrator account for a company's VPN appliance was unexpectedly used to log in to the remote management interface. Which of the following would have most likely prevented this from happening?
Show answer and explanation
Correct answer: B. Changing the default password
The unexpected use of the local administrator account indicates an unauthorized login, most likely because the default password remained unchanged. Changing the default password is the fundamental step to prevent unauthorized access using default credentials. This is a standard security practice for any system with pre-set credentials. If the default password had been changed to a strong, unique password, an attacker would be unable to access the account without discovering the new credentials.
Why the other options are wrong
- A. Least privilege limits user permissions but doesn't prevent unauthorized login using valid credentials.
- C. Assigning individual user IDs is good practice but doesn't prevent compromise of the administrator account itself.
- D. Reviewing logs more frequently detects intrusions after they occur but doesn't prevent unauthorized access in the first place.
Question 132
The marketing department set up its own project management software without telling the appropriate departments. Which of the following describes this scenario?
Show answer and explanation
Correct answer: A. Shadow IT
Shadow IT refers to IT systems, software, or hardware deployed and used within an organization without explicit approval from IT departments or management. The marketing department independently setting up project management software without notifying appropriate departments is the classic definition of shadow IT, unapproved technology adoption that circumvents governance.
Why the other options are wrong
- B. Insider threat is malicious activity by authorized users, but this scenario describes unauthorized deployment, not necessarily malicious intent.
- C. Data exfiltration is the unauthorized transfer of data out of an organization, which is not described in this scenario.
- D. Service disruption refers to interruption of services, not the unauthorized adoption of new software.
Question 133
A company is concerned about weather events causing damage to the server room and downtime. Which of the following should the company consider?
Show answer and explanation
Correct answer: B. Geographic dispersion
Geographic dispersion, distributing servers and infrastructure across multiple physical locations, directly mitigates the risk of weather events affecting a single server room. If one location experiences weather damage, the dispersed infrastructure remains operational at other sites. Clustering and load balancers improve availability and performance but do not protect against localized weather events, and off-site backups address data recovery but not preventing downtime.
Why the other options are wrong
- A. Clustering servers in the same location provides failover capability but does not protect against weather damage affecting the entire clustered location.
- C. Load balancers distribute traffic across servers but do not prevent downtime if all servers are in one location affected by weather.
- D. Off-site backups ensure data recovery after an incident but do not prevent server room downtime during a weather event.
Question 134
An organization wants to improve the company's security authentication method for remote employees. Given the following requirements: • Must work across SaaS and internal network applications • Must be device manufacturer agnostic • Must have offline capabilities Which of the following would be the most appropriate authentication method?
Show answer and explanation
Correct answer: D. Time-based tokens
Time-based tokens (TOTP/HOTP) meet all requirements: they work across SaaS and internal applications, are device manufacturer agnostic (any TOTP-compatible authenticator works), and function offline without network connectivity. Username/password lacks multi-factor strength, biometrics require specific hardware, and SMS requires connectivity.
Why the other options are wrong
- A. Username and password alone doesn't meet the multi-factor security requirement for remote access.
- B. Biometrics require specific device hardware, violating the manufacturer-agnostic requirement.
- C. SMS verification requires network connectivity and cannot work offline as required.
Question 135
Which of the following is used to quantitatively measure the criticality of a vulnerability?
Show answer and explanation
Correct answer: B. CVSS
CVSS (Common Vulnerability Scoring System) is a standardized framework that quantitatively measures the severity and criticality of vulnerabilities on a numerical scale, allowing organizations to prioritize remediation efforts based on objective metrics.
Why the other options are wrong
- A. CVE (Common Vulnerabilities and Exposures) is an identifier for vulnerabilities, not a measurement system for criticality.
- C. CIA (Confidentiality, Integrity, Availability) is a security model, not a quantitative measurement scale.
- D. CERT is an organization that issues security advisories but is not itself a quantitative measurement system.
Question 136
Which of the following best practices gives administrators a set period to perform changes to an operational system to ensure availability and minimize business impacts?
Show answer and explanation
Correct answer: B. Scheduled downtime
Scheduled downtime is the best practice that designates a specific period when administrators can perform system changes while minimizing business impact. This pre-planned window allows the organization to prepare, notify stakeholders, and reduce disruption to operations.
Why the other options are wrong
- A. Impact analysis assesses risks but does not provide the scheduled period for performing changes.
- C. Backout plan defines how to revert changes if problems occur but doesn't schedule the change window.
- D. Change management boards approve changes but do not establish the specific scheduled period for execution.
Question 137
Which of the following security concepts is accomplished with the installation of a RADIUS server?
Show answer and explanation
Correct answer: B. AAA
RADIUS (Remote Authentication Dial-In User Service) is a network protocol that implements the AAA security concept: Authentication (verifying user identity), Authorization (determining what resources the user can access), and Accounting (logging and tracking user activities). RADIUS is a foundational AAA server technology.
Why the other options are wrong
- A. CIA refers to Confidentiality, Integrity, and Availability, security properties, not directly implemented by RADIUS.
- C. ACL (Access Control List) is a security mechanism for controlling resource access, not specifically what RADIUS implements.
- D. PEM (Privacy Enhanced Mail) is a file format for cryptographic keys and certificates, unrelated to RADIUS functionality.
Question 138
In order to strengthen a password and prevent a hacker from cracking it, a random string of 36 characters was added to the password. Which of the following best describes this technique?
Show answer and explanation
Correct answer: D. Salting
Salting is the technique of adding a random string of characters to a password before hashing to prevent rainbow table attacks and ensure identical passwords produce different hashes. The 36-character random string added to the password is a salt, which strengthens password security by making precomputed hash attacks ineffective.
Why the other options are wrong
- A. Key stretching applies hash functions iteratively, not by appending a random string.
- B. Tokenization replaces sensitive data with non-sensitive tokens, not related to password strengthening.
- C. Data masking obscures sensitive data in displays, not a password security technique.
Question 139
A threat actor was able to use a username and password to log in to a stolen company mobile device. Which of the following provides the best solution to increase mobile data security on all employees' company mobile devices?
Show answer and explanation
Correct answer: B. Full disk encryption
Full disk encryption protects the data at rest on a lost or stolen company device: with the storage encrypted, the data cannot be read by removing the drive or bypassing the operating system, and it can be applied to every employee device. Of the four options it is the control that protects the data itself. It does not stop someone who already holds valid credentials, because once the user signs in the data is decrypted, so strong authentication and remote wipe still matter alongside it.
Why the other options are wrong
- A. Application management controls which apps can run but doesn't prevent data access from stolen devices.
- C. Remote wipe only helps after the device is reported stolen; it doesn't prevent initial unauthorized access.
- D. Containerization isolates and can encrypt enterprise data inside a managed container, but by itself it does not secure the rest of the device or the data outside the container.
Question 140
Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The message stated: “I’m in an airport right now with no access to email. I need you to buy gift cards for employee recognition awards. Please send the gift cards to following email address.” Which of the following are the best responses to this situation? (Choose two).
Show answer and explanation
Correct answer: B, C. Add a smishing exercise to the annual company training; Issue a general email warning to the company.
Adding a smishing exercise to annual training (B) educates employees to recognize and avoid similar attacks in the future, and issuing a general email warning (C) alerts the entire organization to the threat and prevents others from falling victim. These are appropriate immediate and long-term preventive measures for this smishing attack.
Why the other options are wrong
- A. Canceling gift cards doesn't address the root cause or prevent future attacks.
- D. Changing the CEO's phone number is reactive but doesn't prevent impersonation attacks since attackers can spoof numbers.
- E. A forensic investigation on the CEO's phone won't prevent future smishing attacks against employees.
- F. Mobile device management helps secure devices but doesn't specifically address or prevent smishing social engineering attacks.
Question 141
While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?
Show answer and explanation
Correct answer: B. Testing the policy in a non-production environment before enabling the policy in the production network
Testing the policy in a non-production environment first would have identified the issue before it impacted production servers. This preventive approach catches unintended consequences before they affect business operations. While documentation and change management are important, they don't prevent the issue from occurring. Including an "allow any" policy would defeat the security purpose of the deny rule. Disabling IPS signatures is a security risk and doesn't address the underlying ACL logic problem.
Why the other options are wrong
- A. Change management documentation doesn't prevent the policy from causing server unreachability.
- C. Disabling IPS signatures reduces security and does not address the ACL configuration issue.
- D. Adding an "allow any" above "deny any" defeats the security purpose of implementing the deny rule.
Question 142
A technician is deploying a new security camera. Which of the following should the technician do?
Show answer and explanation
Correct answer: D. Conduct a site survey.
A site survey is the fundamental first step before deploying security cameras, determining optimal camera placement, coverage areas, lighting conditions, network access points, and infrastructure requirements. This planning phase ensures effective deployment. While VLAN configuration, vulnerability scanning, and port disabling may follow, the site survey must occur first to inform all other deployment decisions.
Why the other options are wrong
- A. VLAN configuration is an implementation detail that follows site survey planning.
- B. Vulnerability scanning applies to IT systems, not primarily to camera hardware selection and placement.
- C. Disabling unnecessary ports is a hardening step that follows initial deployment and site planning.
Question 143
An organization completed a project to deploy SSO across all business applications last year. Recently, the finance department selected a new cloud-based accounting software vendor. Which of the following should most likely be configured during the new software deployment?
Show answer and explanation
Correct answer: B. SAML
SAML (Security Assertion Markup Language) is the standard protocol for federating Single Sign-On across business applications and cloud services. Since the organization already deployed SSO, the new cloud-based accounting software should be configured to use SAML to integrate seamlessly with the existing SSO infrastructure.
Why the other options are wrong
- A. RADIUS is primarily used for network access authentication, not cloud application SSO integration.
- C. EAP is used for wireless and PPP authentication, not for cloud application federation.
- D. OpenID is an authentication protocol but SAML is the enterprise standard for SSO federation across multiple applications.
Question 144
Which of the following best describes a use case for a DNS sinkhole?
Show answer and explanation
Correct answer: C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.
A DNS sinkhole is a security control that intercepts DNS requests for known-malicious domains and redirects them to a controlled IP address (often a local honeypot or monitoring server). This captures traffic destined for malicious domains, preventing users from reaching them and allowing security teams to monitor and analyze attack attempts. It's a defensive monitoring technique against known threats.
Why the other options are wrong
- A. DNS sinkholes are security defensive tools; attackers don't view them as valuable resources for reconnaissance.
- B. DNS sinkholes redirect away from malicious sites, not toward them; they protect employees rather than deceive them.
- D. DNS sinkholes target known-malicious domains, not act as honeypots to attract attackers to company networks.
Question 145
Which of the following is the most likely to be included as an element of communication in a security awareness program?
Show answer and explanation
Correct answer: A. Reporting phishing attempts or other suspicious activities
Reporting phishing attempts and suspicious activities is a core communication element of security awareness programs. It encourages employees to recognize threats and report them to security teams, creating a human firewall. This is fundamental to awareness training and incident reporting procedures.
Why the other options are wrong
- B. Detecting insider threats via anomalous behavior is a technical detection capability, not a communication element of awareness training.
- C. Verifying wire transfer information is a specific control procedure, not part of general security awareness communication.
- D. Social engineering by third parties is a testing activity, not an element of communication within the awareness program itself.
Question 146
A company is required to perform a risk assessment on an annual basis. Which of the following types of risk assessments does this requirement describe?
Show answer and explanation
Correct answer: C. Recurring
A recurring risk assessment is one that occurs at regular, scheduled intervals. The requirement to perform risk assessments on an annual basis describes a recurring pattern, it happens every year as part of regular organizational procedures. This is distinct from one-time, ad hoc, or continuous assessments, which have different scheduling patterns.
Why the other options are wrong
- A. Continuous refers to ongoing real-time monitoring, not annual scheduling.
- B. Ad hoc implies unplanned, irregular assessments as needed.
- D. One-time describes a single assessment event, not an annual requirement.
Question 147
A security engineer is implementing FDE for all laptops in an organization. Which of the following are the most important for the engineer to consider as part of the planning process? (Choose two.)
Show answer and explanation
Correct answer: A, B. Key escrow; TPM presence
When implementing FDE, the engineer must consider TPM (Trusted Platform Module) presence for secure key storage and integration with the encryption system. Key escrow is critical for ensuring encrypted data can be recovered if users forget passphrases or leave the organization. These two elements directly support the practical deployment and management of FDE systems.
Why the other options are wrong
- C. Digital signatures are for authentication and non-repudiation, not FDE implementation.
- D. Data tokenization is a separate data protection technique, not relevant to FDE planning.
- E. Public key management relates to PKI systems, not the core FDE implementation concerns.
- F. Certificate authority linking is a PKI concept, not essential to FDE planning.
Question 148
A security team is setting up a new environment for hosting the organization's on-premises software application as a cloud-based service. Which of the following should the team ensure is in place in order for the organization to follow security best practices?
Show answer and explanation
Correct answer: A. Virtualization and isolation of resources
Virtualization and isolation of resources is fundamental to cloud security best practices, ensuring that on-premises applications deployed as cloud services are properly separated and protected from other tenants and resources. This is the foundational security control that enables secure multi-tenancy and resource protection in cloud environments.
Why the other options are wrong
- B. Network segmentation is important but is a supporting practice rather than the primary best practice for cloud deployment.
- C. Data encryption is important but applies across deployment models and is not specific to cloud-based services.
- D. Strong authentication is important but is one component of security rather than the overarching best practice for cloud hosting.
Question 149
A systems administrator uses a key to encrypt a message being sent to a peer in a different branch office. The peer then uses the same key to decrypt the message. Which of the following describes this example?
Show answer and explanation
Correct answer: A. Symmetric
Symmetric encryption uses the same key for both encryption and decryption. The scenario explicitly states the sender uses a key to encrypt and the peer uses the same key to decrypt, which is the fundamental characteristic of symmetric cryptography.
Why the other options are wrong
- B. Asymmetric encryption uses a public key and private key pair, not the same key for both operations.
- C. Hashing is a one-way function for integrity verification, not an encryption method.
- D. Salting is a technique used with hashing to prevent rainbow table attacks, not an encryption method.
Question 150
During a penetration test, a flaw in the internal PKI was exploited to gain domain administrator rights using specially crafted certificates. Which of the following remediation tasks should be completed as part of the cleanup phase?
Show answer and explanation
Correct answer: B. Patching the CA
After exploiting a flaw in the internal PKI to gain domain administrator rights, the primary remediation task is patching the CA (Certificate Authority). This addresses the root vulnerability that was exploited and prevents future similar attacks. Patching the CA closes the specific flaw that allowed specially crafted certificates to elevate privileges.
Why the other options are wrong
- A. Updating the CRL (Certificate Revocation List) would revoke certificates but doesn't fix the underlying PKI flaw.
- C. While password changes are good practice, they don't address the PKI vulnerability that was exploited.
- D. SOAR (Security Orchestration, Automation and Response) is a tool platform, not a remediation task for PKI flaws.
Question 151
A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attacks. Which of the following analysis elements did the company most likely use in making this decision?
Show answer and explanation
Correct answer: C. ARO
ARO (Annual Rate of Occurrence) represents how frequently an event is expected to occur per year. By reducing ransomware coverage, the company implicitly determined that ransomware attacks have a low ARO for their organization, making the insurance premium not cost-effective. MTTR measures recovery time, RTO measures recovery time objective after disaster, and MTBF measures equipment reliability, none of these directly inform decisions about insurance coverage likelihood or frequency.
Why the other options are wrong
- A. MTTR (Mean Time To Repair) measures how long repairs typically take; it is not the basis for removing insurance coverage.
- B. RTO (Recovery Time Objective) specifies the acceptable downtime after an incident; it informs recovery planning but not insurance premium decisions.
- D. MTBF (Mean Time Between Failures) measures equipment reliability intervals; it does not inform decisions about ransomware attack probability.
Question 152
Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses?
Show answer and explanation
Correct answer: A. Compensating control
A host-based firewall restricting connections to specific internal IP addresses is a compensating control, a security measure implemented to mitigate risk when standard controls are unavailable or inadequate. On a legacy Linux system where other security measures may be limited, the firewall serves as an alternative control to protect the system. This is not network segmentation (which is broader network architecture), risk transfer (which involves shifting risk to another party), or SNMP traps (which are monitoring alerts).
Why the other options are wrong
- B. Network segmentation refers to dividing a network into subnets; a single host firewall rule is not network segmentation.
- C. Transfer of risk involves shifting risk responsibility to another party, such as through insurance; a firewall implements risk mitigation, not transfer.
- D. SNMP traps are network monitoring alerts used to send notifications about network conditions; they are not related to firewall access control.
Question 153
Which of the following vulnerabilities is associated with installing software outside of a manufacturer’s approved software repository?
Show answer and explanation
Correct answer: D. Side loading
Side loading refers to installing software from sources outside the manufacturer's official repository, such as third-party app stores or directly from files. This practice bypasses the manufacturer's security reviews and vetting processes, introducing vulnerabilities and malware risks.
Why the other options are wrong
- A. Jailbreaking is the process of removing device restrictions, which may enable side loading but is not itself the vulnerability of installing from unapproved sources.
- B. Memory injection involves code being inserted into memory at runtime, not related to software installation sources.
- C. Resource reuse involves reusing computing resources with residual data, not software installation practices.
That was 153 of 611.
The full CompTIA Security+ SY0-701 pack has all 611 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 305 free as one PDF by email. Get the Half Pack →