100 Free Security+ SY0-701 Practice Questions and Answers
100 questions for the Security+ SY0-701 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A guideline offers optional advice and good practice, not a mandatory sequence of actions.
Right, B is the answer.
Why B is right
A procedure lays out the ordered, hands-on actions needed to complete one specific technical task, such as hardening a device. The other document types sit at a higher level: they say what is required or recommended, but they do not walk someone through the work.
Not this one. Try another answer.
Why C is wrong
A policy records management's rules and intent, and does not list configuration actions.
Not this one. Try another answer.
Why D is wrong
A standard sets mandatory requirements or settings, but not the order in which to carry them out.
Question 2 Play from 01:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Crisis communication planning is part of continuity or incident planning, not the impact analysis.
Not this one. Try another answer.
Why B is wrong
Restore procedures are written in disaster recovery planning once the targets are known.
Right, C is the answer.
Why C is right
A business impact analysis ranks critical business functions and works out how much downtime each one can tolerate, which is where recovery time targets come from. Notification plans, restore procedures, incident handling and risk plan reviews are produced by other planning efforts.
Not this one. Try another answer.
Why D is wrong
Incident handling playbooks belong to incident response planning.
Not this one. Try another answer.
Why E is wrong
Reviewing the risk register is a risk management task, separate from the impact analysis.
Question 3 Play from 03:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Shadow IT describes unapproved technology use inside a company, not a type of attacker with a profit goal.
Right, B is the answer.
Why B is right
Criminal groups run ransomware, fraud, theft and extortion schemes because these bring in revenue, so financial gain is their main driver. The other options are driven by other things or are not attackers at all.
Not this one. Try another answer.
Why C is wrong
Hacktivists act on political or social beliefs rather than for payment.
Not this one. Try another answer.
Why D is wrong
Insiders may act out of anger, coercion or ambition, so profit is not their defining motive.
Question 4 Play from 04:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Selling stolen data is the pattern of financially driven criminals.
Not this one. Try another answer.
Why B is wrong
Revenge is a personal motive found in disgruntled insiders, not protest groups.
Not this one. Try another answer.
Why C is wrong
Collecting secrets for a government is espionage, carried out by nation-state actors.
Right, D is the answer.
Why D is right
Hacktivists attack to push a cause, protest a decision or draw attention to an issue, so their driver is conviction rather than reward. Other attacker types are the ones motivated by money, grudges or state interests.
Question 5 Play from 06:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An access control list filters traffic or resource access and is not what a RADIUS server provides.
Not this one. Try another answer.
Why B is wrong
PEM is a text encoding for certificates and keys and has nothing to do with RADIUS.
Not this one. Try another answer.
Why C is wrong
CIA names the goals of confidentiality, integrity and availability, which are objectives rather than a service.
Right, D is the answer.
Why D is right
RADIUS centralizes three functions: it verifies who a user is, decides what that user may reach, and records what they did. Those three jobs are exactly the AAA framework. The remaining choices are a rule list, a file encoding and a set of goals, none of which RADIUS delivers.
Question 6 Play from 07:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A EULA is the license a vendor gives a customer for software, not workplace conduct rules.
Right, B is the answer.
Why B is right
An acceptable use policy tells employees how they may use company resources and what conduct is expected, including honesty and ethics. The other documents cover software licensing, partnership terms and service levels instead.
Not this one. Try another answer.
Why C is wrong
A memorandum of agreement records terms between organizations, not employee behavior rules.
Not this one. Try another answer.
Why D is wrong
A service level agreement sets performance targets for a service.
Question 7 Play from 09:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Containment stops an incident from spreading and is not an evidence handling step.
Not this one. Try another answer.
Why B is wrong
Acquisition is the act of collecting the data, and on its own it does not guarantee that the evidence stays unchanged.
Right, C is the answer.
Why C is right
Preservation covers protecting evidence from change, loss or contamination through careful handling, storage and documentation, which keeps it admissible. The other terms describe gathering, locating or isolating, not keeping the original intact.
Not this one. Try another answer.
Why D is wrong
E-discovery is about finding and producing electronic records for legal matters, not safeguarding their integrity.
Question 8 Play from 10:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A risk profile summarizes exposure at a high level and gives no response steps.
Not this one. Try another answer.
Why B is wrong
A change management policy governs how changes are approved and is not an incident aid.
Not this one. Try another answer.
Why C is wrong
A SIEM profile describes how the tool is configured, not how to respond to an alert.
Right, D is the answer.
Why D is right
A playbook gives responders a documented sequence of actions for a particular type of alert or incident, so analysts can open it and follow it during the event. The other items are governance or configuration records that analysts do not use as live guides.
Question 9 Play from 12:02
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Tokenization swaps each card number for a random token that is useless outside the payment system, so a stolen database exposes nothing valuable. It also suits payment card compliance needs. Hashing blocks later use of the number, while masking and obfuscation only hide data.
Not this one. Try another answer.
Why B is wrong
A one-way hash cannot be turned back into the card number, so legitimate payments could not use it.
Not this one. Try another answer.
Why C is wrong
Masking hides part of a value on screen but the actual data still sits in storage.
Not this one. Try another answer.
Why D is wrong
Obfuscation only makes data harder to read and gives weak protection against a determined thief.
Question 10 Play from 13:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AES-256 is a cipher used inside protocols, but by itself it is not a complete way of securing a connection.
Not this one. Try another answer.
Why B is wrong
SHA-256 is a hash function for integrity checks and does not encrypt anything.
Not this one. Try another answer.
Why C is wrong
SSL 3.0 is obsolete and has known weaknesses, so it should not be used.
Right, D is the answer.
Why D is right
TLS 1.3 is a complete protocol that negotiates keys, authenticates the server and encrypts the traffic as it moves. The older SSL version is deprecated, a hash only checks integrity, and a cipher alone is not a full transport protocol.
Show all 100 questionsShow fewer questions
Question 11 Play from 15:02
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Open-source intelligence uses publicly available material, so no internal data or systems need to be accessed. Scanning, testing and auditing all require interaction with the client's own environment or access to its internal information.
Not this one. Try another answer.
Why B is wrong
A penetration test actively probes the client's systems and needs authorized access.
Not this one. Try another answer.
Why C is wrong
Auditing configurations means reviewing internal settings that the client considers private.
Not this one. Try another answer.
Why D is wrong
Scanning sends traffic to the client's hosts, so it involves their infrastructure.
Question 12 Play from 16:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A master services agreement sets overall commercial terms for ongoing work and is not mainly about secrecy.
Not this one. Try another answer.
Why B is wrong
A memorandum of agreement records a general understanding and does not specifically restrict disclosure.
Right, C is the answer.
Why C is right
A non-disclosure agreement is a legal contract in which parties promise to keep shared confidential information from outsiders. The other agreements cover service terms, general cooperation or performance levels, not secrecy.
Not this one. Try another answer.
Why D is wrong
A service level agreement defines performance targets and remedies for a service.
Question 13 Play from 17:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A trusted platform module is a hardware chip that stores keys and does not publish certificate status.
Not this one. Try another answer.
Why B is wrong
PKI is the overall framework for certificates, not the specific list of invalid ones.
Right, C is the answer.
Why C is right
A certificate revocation list is published by the certificate authority and names certificates that are no longer to be trusted, letting clients check status before relying on one. The other options are hardware, a framework or an application form.
Not this one. Try another answer.
Why D is wrong
A certificate signing request is what a requester sends to get a certificate issued.
Question 14 Play from 19:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk transfer shifts the impact to another party, for example through insurance.
Right, B is the answer.
Why B is right
When the normal fix is not possible, other safeguards are put in place to reduce the same risk. Closing needless services and shielding the system with a firewall are such alternative safeguards, which are called compensating controls.
Not this one. Try another answer.
Why C is wrong
An exception is a documented approval to skip a requirement and adds no protection by itself.
Not this one. Try another answer.
Why D is wrong
Segmentation separates networks, but the scenario centers on offsetting the missing patch with other safeguards.
Question 15 Play from 20:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Steganography hides information inside other files and is unrelated to hashing inputs.
Not this one. Try another answer.
Why B is wrong
Data masking obscures values for display or testing and does not add randomness to hash input.
Right, C is the answer.
Why C is right
Salting mixes unique random data into each input before it is hashed, so identical passwords yield different hashes and precomputed tables stop working. Stretching repeats the hashing, masking hides displayed values, and steganography conceals data in media.
Not this one. Try another answer.
Why D is wrong
Key stretching runs the function many times to slow guessing instead of adding data beforehand.
Question 16 Play from 22:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Geographic restrictions limit where access or storage is allowed, not which laws apply.
Not this one. Try another answer.
Why B is wrong
Geographic dispersion spreads systems across sites for resilience.
Not this one. Try another answer.
Why C is wrong
Data segmentation separates data into groups for technical or access reasons.
Right, D is the answer.
Why D is right
Data sovereignty is the idea that information is governed by the laws of the place where it is held or processed, so the company must look at those jurisdictions to see which rules apply. The alternatives are about location limits, spreading copies or dividing data.
Question 17 Play from 23:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A fake account might be noticed by monitoring, but it does not naturally draw an insider looking for valuable data.
Right, B is the answer.
Why B is right
Insiders go after data that seems valuable, and employee pay records are a classic lure. A decoy file of that kind draws interest and exposes anyone who opens it. System file tweaks are things an attacker might exploit, but they do not tempt an insider in the same way.
Not this one. Try another answer.
Why C is wrong
A weak hash in the shadow file is something to crack, not bait that attracts curiosity.
Not this one. Try another answer.
Why D is wrong
A flawed scheduled job is an opening to exploit, not an appealing target for an insider.
Question 18 Play from 25:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Penetration testing is costly and slow, and it examines technical weaknesses rather than overall compliance.
Not this one. Try another answer.
Why B is wrong
A vulnerability assessment finds technical flaws but does not confirm broader obligations.
Right, C is the answer.
Why C is right
An attestation report is a formal statement from the vendor, or an assessor, confirming that it meets its commitments. It takes little time and money compared with a full examination, while still giving documented assurance.
Not this one. Try another answer.
Why D is wrong
An independent audit is thorough but takes longer and costs much more.
Question 19 Play from 26:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SMTP is used to send email and offers no remote shell.
Right, B is the answer.
Why B is right
SSH gives the same remote command-line access that Telnet did, but with encryption, so it meets the rule against insecure protocols. The other options serve different purposes such as web pages, mail, graphical desktops or device monitoring.
Not this one. Try another answer.
Why C is wrong
RDP provides a graphical desktop session and is not the usual choice for command-line administration of a web server.
Not this one. Try another answer.
Why D is wrong
HTTPS secures web traffic and does not give a terminal session.
Not this one. Try another answer.
Why E is wrong
SNMPv3 is for monitoring and managing network devices, not for logging into a server.
Question 20 Play from 28:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Integrity is about keeping data accurate and unaltered, not about who can read it.
Not this one. Try another answer.
Why B is wrong
Availability means data and systems are usable when needed.
Not this one. Try another answer.
Why C is wrong
Non-repudiation prevents people from denying their actions and does not restrict access.
Right, D is the answer.
Why D is right
Limiting access to people with a legitimate need and the right role keeps sensitive information from those who should not see it, which is confidentiality. The other principles concern accuracy, uptime and proof of actions.
Question 21 Play from 29:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access logs record activity but are records, not a principle that stops denial of a message.
Not this one. Try another answer.
Why B is wrong
Authentication confirms who someone is at login but does not stop them from later disowning a message.
Not this one. Try another answer.
Why C is wrong
Adaptive identity adjusts verification based on context and has no role in attributing messages.
Right, D is the answer.
Why D is right
Non-repudiation, usually delivered through digital signatures, ties a message to one person and stops that person from denying having sent it. Logging in proves identity at one moment, and logs just record events, so neither gives the same binding proof.
Question 22 Play from 31:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
802.1X is an enterprise authentication framework needing a backend server and credentials, which is far too heavy for this need.
Not this one. Try another answer.
Why B is wrong
A pre-shared key gives every user the same password, so paying and non-paying visitors can't be told apart.
Right, C is the answer.
Why C is right
A captive portal intercepts new wireless users and shows a web page where they must enter something, such as a receipt code, before access is granted. The other choices are encryption or enterprise login methods that cannot check a receipt.
Not this one. Try another answer.
Why D is wrong
WPA3 protects wireless traffic with encryption but doesn't ask for a receipt code.
Question 23 Play from 32:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Operating system security logs are compact and useful for later investigations and compliance.
Not this one. Try another answer.
Why B is wrong
Scan results show remediation progress over time and are small to store.
Right, C is the answer.
Why C is right
Full packet captures consume enormous amounts of storage and are mostly valuable shortly after an event, so keeping them for less time saves the most money. The other items are small and keep their value for audits and long-term trend work.
Not this one. Try another answer.
Why D is wrong
Endpoint logs are modest in size and often needed to trace activity from long ago.
Question 24 Play from 34:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Server logs are internal data and not publicly available.
Right, B is the answer.
Why B is right
Open-source intelligence means collecting information that is publicly available, such as names, roles and social media posts. A social engineering test uses exactly that kind of material to build convincing pretexts. The other tasks work with internal or captured data.
Not this one. Try another answer.
Why C is wrong
Indicators of compromise come from analyzing malware and threat data rather than public sources.
Not this one. Try another answer.
Why D is wrong
Evidence collection during an incident is based on internal systems and forensic work.
Question 25 Play from 36:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Motion sensors detect movement but do not block entry.
Not this one. Try another answer.
Why B is wrong
Cameras record what happened and may deter, but they do not stop someone from entering.
Not this one. Try another answer.
Why C is wrong
Bollards stop vehicles from reaching the building and do not control who walks in.
Right, D is the answer.
Why D is right
A badge reader checks and authorizes each person before the door opens and logs who entered, so it stops unapproved staff. Cameras and sensors only record or alert, and bollards stop vehicles rather than people.
Question 26 Play from 37:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cost matters to the business but should never outweigh keeping a life-critical service running.
Not this one. Try another answer.
Why B is wrong
A simple rollout helps developers, but it is less important than uptime during emergencies.
Right, C is the answer.
Why C is right
For an emergency reporting service, being reachable at all times matters most, since an outage could delay urgent help. Growth, price and easy rollout are useful but come second to uptime.
Not this one. Try another answer.
Why D is wrong
Scaling with demand helps, but it is secondary to the service being reachable.
Question 27 Play from 38:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Steganography hides data inside other files without encrypting it.
Not this one. Try another answer.
Why B is wrong
A digital signature proves who created data and that it was not changed, but it does not hide the contents.
Right, C is the answer.
Why C is right
Encrypting the entire drive scrambles everything stored on it, so a removed disk cannot be read without the key. The other options verify authorship, hide data or are only parts of a cryptosystem.
Not this one. Try another answer.
Why D is wrong
A private key is a component used in cryptography and does not by itself secure the stored data.
Question 28 Play from 40:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Spyware quietly watches activity and steals data and does not lock files.
Right, B is the answer.
Why B is right
Encrypting files, renaming them with a new ending and showing a payment note is the signature behavior of ransomware. The other categories do not typically produce a demand message on every machine.
Not this one. Try another answer.
Why C is wrong
A Trojan hides inside apparently useful software, but that alone does not mean files are renamed and a payment is demanded.
Not this one. Try another answer.
Why D is wrong
A virus spreads by attaching to files but does not normally show a ransom note.
Question 29 Play from 41:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Wireshark captures and inspects traffic, and does not scan servers for exposure.
Not this one. Try another answer.
Why B is wrong
netcat opens simple network connections and is not a vulnerability assessment tool.
Right, C is the answer.
Why C is right
Nessus is a vulnerability scanner that probes hosts for open ports, weak services and legacy protocols, then reports them. The other tools move or capture data and are not built to assess a whole server for exposure.
Not this one. Try another answer.
Why D is wrong
curl transfers data using URLs and does not audit hosts.
Question 30 Play from 42:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Hashing could reveal that the records changed afterward but would not stop an account with write access.
Not this one. Try another answer.
Why B is wrong
Input validation stops malformed data such as injection strings, not a user misusing legitimate access.
Right, C is the answer.
Why C is right
The abuse worked because a user outside finance had the right to alter and move funds. Restricting permissions by role, following least privilege, removes that ability. Hashing only detects tampering afterward and validation targets malformed input.
Not this one. Try another answer.
Why D is wrong
Network access lists filter traffic between hosts and do not set which users may edit records.
Question 31 Play from 44:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A business impact analysis is a working tool that should align with the policies, so it is checked afterward.
Not this one. Try another answer.
Why B is wrong
A vulnerability assessment is an implementation activity reviewed after the rules are understood.
Right, C is the answer.
Why C is right
The documented policies and procedures define what the program is supposed to do, so they are the baseline against which actual practice is later compared. The other items are activities that follow from them.
Not this one. Try another answer.
Why D is wrong
The asset inventory is reviewed after the policies that govern it are known.
Question 32 Play from 45:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A blockchain is a shared ledger and does not hide program logic.
Not this one. Try another answer.
Why B is wrong
Code signing proves who published the code and that it was unchanged, but the logic remains readable.
Right, C is the answer.
Why C is right
Obfuscation rewrites code so it still works but is very hard to read or reverse engineer, which shields the intellectual property. The other choices prove authenticity, record transactions or replace data values.
Not this one. Try another answer.
Why D is wrong
Tokenization substitutes sensitive data values and is not meant to protect source code.
Question 33 Play from 47:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Load balancers spread traffic but do nothing if every server sits in the damaged room.
Not this one. Try another answer.
Why B is wrong
Off-site backups preserve data but do not keep services running while the room is down.
Right, C is the answer.
Why C is right
Spreading systems over several distant locations means a storm at one site does not take everything offline. Clustering and balancing in one room don't help against local damage, and backups help recovery rather than avoid downtime.
Not this one. Try another answer.
Why D is wrong
Clustering inside one room gives failover for hardware faults but not for site-wide damage.
Question 34 Play from 48:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A hot site is a standby facility, but it may be in the same area and hit by the same event.
Not this one. Try another answer.
Why B is wrong
Load balancing shares traffic between servers and does not protect backup copies.
Right, C is the answer.
Why C is right
Keeping backup copies in widely separated locations means a regional disaster cannot destroy them all. The other choices cover standby facilities, traffic sharing or varied technology, none of which guarantee separation.
Not this one. Try another answer.
Why D is wrong
Platform diversity mixes different technologies and does not separate locations.
Question 35 Play from 50:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Return on investment is a financial measure and is unrelated to testing a response plan.
Right, B is the answer.
Why B is right
A tabletop exercise is a talk-through of an incident scenario that exposes gaps, so the main payoff is improving the incident response plan. Other benefits may follow, but they are not the central purpose.
Not this one. Try another answer.
Why C is wrong
Closing audit findings is a separate remediation job, not the reason for a discussion exercise.
Not this one. Try another answer.
Why D is wrong
Timing data may be noted, but a tabletop exercise isn't designed to collect repair metrics.
Question 36 Play from 51:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A hardware security module manages keys in data centers and is not a phone protection feature.
Right, B is the answer.
Why B is right
Full-disk encryption scrambles everything on the storage, so without the key or passcode the data stays unreadable even with physical possession of the device. The other options are a key store, a chip or an algorithm.
Not this one. Try another answer.
Why C is wrong
A TPM stores keys and supports encryption but is not itself the drive encryption solution.
Not this one. Try another answer.
Why D is wrong
ECC is an algorithm family and not a standalone way to protect a drive.
Question 37 Play from 53:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Rules of execution is not the recognized name for the testing agreement.
Right, B is the answer.
Why B is right
The rules of engagement are the agreed limits for a penetration test: scope, timing, permitted methods and contacts. This is the standard industry term, and the other phrases are not used that way.
Not this one. Try another answer.
Why C is wrong
Rules of acceptance deal with criteria for accepting a deliverable, not conduct during a test.
Not this one. Try another answer.
Why D is wrong
Rules of understanding is not a standard penetration testing term.
Question 38 Play from 54:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cross-site scripting is a web application flaw.
Not this one. Try another answer.
Why B is wrong
SQL injection affects databases and applications, not hardware.
Right, C is the answer.
Why C is right
Firmware is the low-level code that runs a device, so an outdated or flawed version is a weakness tied to the hardware itself. The other choices are software flaws that occur in applications across many platforms.
Not this one. Try another answer.
Why D is wrong
A buffer overflow is a programming error in software.
Question 39 Play from 55:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Secure cookies protect session data and do not stop injected commands.
Not this one. Try another answer.
Why B is wrong
Authentication confirms who a user is and does not filter malicious input.
Right, C is the answer.
Why C is right
Validating and sanitizing every value that users submit stops hostile input from being treated as commands, which addresses injection at its source. The other controls protect sessions, confirm identity or find flaws before release.
Not this one. Try another answer.
Why D is wrong
Static code analysis helps find flaws during development but doesn't protect a running application.
Question 40 Play from 57:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A load balancer distributes client traffic and is not an administrative gateway.
Not this one. Try another answer.
Why B is wrong
A hardware security module protects cryptographic keys and does not route admin access.
Not this one. Try another answer.
Why C is wrong
RADIUS handles authentication and does not give a path into a restricted segment.
Right, D is the answer.
Why D is right
A jump server is a hardened, monitored host that sits between the admin network and the restricted segment, so administrators connect through it and their activity is controlled and logged. The other tools do not provide that access path.
Question 41 Play from 58:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A collaboration platform supports team communication and does not record changes to code files.
Right, B is the answer.
Why B is right
A version control system stores every revision of the build scripts, showing who changed what and when, which gives a full audit trail of code changes. The other tools handle chat, approvals or monitoring, not tracking edits to files.
Not this one. Try another answer.
Why C is wrong
A behavioral analyzer watches how systems act and does not track code edits.
Not this one. Try another answer.
Why D is wrong
An approval ticketing system manages request workflows, but it doesn't keep line-by-line change history.
Question 42 Play from 1:00:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Steganography hides data inside other media and isn't a practical way to protect account numbers.
Right, B is the answer.
Why B is right
Tokenization substitutes sensitive values with surrogate tokens that keep the same role in applications but hold no exploitable meaning, and it is widely used in finance. The other options hide data in media, add randomness to hashes or irreversibly transform values.
Not this one. Try another answer.
Why C is wrong
Salting adds random data to hash input and does not substitute stored values.
Not this one. Try another answer.
Why D is wrong
Hashing is irreversible, so applications can't recover the original value when they need it.
Question 43 Play from 1:01:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Hashing turns a value into a fixed digest and is unsuitable when staff need to see part of the number.
Right, B is the answer.
Why B is right
Masking replaces part of a value, for example with asterisks, so the log still shows a recognizable format without exposing the full number. It is the usual technique for hiding sensitive fields in logs and displays.
Not this one. Try another answer.
Why C is wrong
Tokenization swaps values for tokens within payment systems, but it is not the typical way to hide digits in log files.
Not this one. Try another answer.
Why D is wrong
Obfuscation is a general term for making something unclear and is less specific than masking.
Question 44 Play from 1:02:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Firewall rules for web traffic are layered on after the system is hardened.
Not this one. Try another answer.
Why B is wrong
Intrusion detection is configured once the server is secured and running.
Right, C is the answer.
Why C is right
Hardening the host removes needless services and accounts and sets a secure baseline, so it comes before layering other protections on top. Firewall rules, detection and the ongoing patch routine build on that foundation.
Not this one. Try another answer.
Why D is wrong
Patching is an ongoing routine, and hardening is the foundation step that comes before it.
Question 45 Play from 1:04:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An on-path attack intercepts communications between two parties and doesn't involve registering a lookalike domain.
Not this one. Try another answer.
Why B is wrong
A watering-hole attack compromises a site that victims already visit.
Not this one. Try another answer.
Why C is wrong
Brand impersonation is a broader category, and this scenario specifically hinges on a misspelled address.
Right, D is the answer.
Why D is right
Typosquatting means registering a domain that is a slight misspelling or lookalike of a real one so that visitors land on it by mistake. The other attacks involve intercepting traffic, infecting a trusted site or posing as a brand in general.
Question 46 Play from 1:05:47
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Actually switching operations to the recovery site proves that systems start, data is usable and services run, which no discussion can show. Generator checks, planning meetings and encryption specifications each cover just a small part.
Not this one. Try another answer.
Why B is wrong
A discussion-only exercise reviews plans but doesn't prove the systems or data work.
Not this one. Try another answer.
Why C is wrong
Writing encryption requirements addresses protection, not whether the site can take over.
Not this one. Try another answer.
Why D is wrong
Generator tests confirm backup power only and say nothing about data or application recovery.
Question 47 Play from 1:07:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The kernel release is a technical setting that can be handled in container environments.
Right, B is the answer.
Why B is right
Containers work best with small, modular components that can be isolated and updated independently. A large single-block application loses most of those benefits when it is simply placed in a container. The other factors can be managed within a container setup.
Not this one. Try another answer.
Why C is wrong
Patch timing is not a blocker, and containers can actually simplify updates.
Not this one. Try another answer.
Why D is wrong
Compliance requirements can be met through container configuration and policy.
Question 48 Play from 1:09:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Removing duplicates is a technical tidy-up task, not the officer's main purpose.
Not this one. Try another answer.
Why B is wrong
Retention limits come from law and policy, and an inventory does not extend them.
Not this one. Try another answer.
Why C is wrong
Storage management is an operations matter rather than a privacy responsibility.
Right, D is the answer.
Why D is right
Knowing what data exists and where it is stored lets the organization understand how serious a breach would be and who would be affected, which supports compliance and risk work. The other choices are IT housekeeping or even contrary to privacy goals.
Question 49 Play from 1:10:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Directive controls instruct or guide behavior, such as through policy, and don't measure anything.
Not this one. Try another answer.
Why B is wrong
Corrective controls repair damage after an incident and do not count entries.
Right, C is the answer.
Why C is right
Counting and observing entries is monitoring after the fact, which is what detective controls do. The data collected can later guide preventive controls, but gathering it is itself a detective activity.
Not this one. Try another answer.
Why D is wrong
Preventive controls block unwanted access before it happens and do not report on traffic.
Question 50 Play from 1:11:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Failover is a system switch to standby equipment, not a discussion exercise.
Right, B is the answer.
Why B is right
A tabletop exercise has the team discuss a made-up incident step by step, revealing gaps in the response process and training people at the same time. The other choices are technical operations, not training exercises.
Not this one. Try another answer.
Why C is wrong
Recovery is the operational work of restoring services, not a process improvement exercise.
Not this one. Try another answer.
Why D is wrong
Replication copies data between systems and is not an exercise at all.
Question 51 Play from 1:13:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Nation-states pursue geopolitical aims and espionage and have no interest in celebrity site pranks.
Not this one. Try another answer.
Why B is wrong
Insiders have privileged access and would more likely target valuable internal assets.
Right, C is the answer.
Why C is right
Defacing a well-known site needs little skill and is mostly about notoriety or bragging, which fits an unskilled attacker. The other actors pursue profit, state goals or have trusted access they would use for more valuable ends.
Not this one. Try another answer.
Why D is wrong
Organized crime seeks financial gain, not publicity from defacement.
Question 52 Play from 1:14:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Organized crime is driven by profit.
Not this one. Try another answer.
Why B is wrong
Insiders can have many motives, such as revenge or coercion, but beliefs do not define them.
Not this one. Try another answer.
Why C is wrong
Nation-states act on geopolitical and security interests.
Right, D is the answer.
Why D is right
Hacktivists attack to promote a cause or protest what they see as wrong, so belief is their defining motivation. Other attacker types are primarily driven by money, state goals or varied personal reasons.
Question 53 Play from 1:16:00
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A backout plan sets out how to return to the previous safe state if the change causes trouble, and it is prepared before the change is made. Restarting and maintenance happen during or after implementation, and board sign-off is not part of normal change checks.
Not this one. Try another answer.
Why B is wrong
Restarting a service is an operational action carried out during implementation, not a pre-change check.
Not this one. Try another answer.
Why C is wrong
Maintenance is a general activity that takes place after the change is in place.
Not this one. Try another answer.
Why D is wrong
Board reviews are a governance matter and not a routine change-management step.
Question 54 Play from 1:17:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A warm site recovers faster but costs more than a two-day target demands.
Right, B is the answer.
Why B is right
A cold site is the cheapest option, being mostly empty space that must be equipped before use, and two days of recovery time makes that acceptable. More active sites cost more than this requirement justifies.
Not this one. Try another answer.
Why C is wrong
A hot site is fully ready and expensive, which is unnecessary here.
Not this one. Try another answer.
Why D is wrong
A site mirrored in real time is the costliest choice and far exceeds the stated need.
Question 55 Play from 1:18:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Database logs track queries and transactions, not outbound connections to attackers.
Right, B is one of the answers.
Why B is right
Firewall and network traffic records show which internal machines connected to the malicious server, so they point straight to the infected host. The other logs describe logins, data access, application events or address assignments.
Not this one. Try another answer.
Why C is wrong
DHCP logs show which address was assigned but not who talked to the control server.
Not this one. Try another answer.
Why D is wrong
Application logs record events inside software, not network connections.
Not this one. Try another answer.
Why E is wrong
Authentication logs capture sign-in activity rather than outbound communication patterns.
Right, F is one of the answers.
Why F is right
Firewall and network traffic records show which internal machines connected to the malicious server, so they point straight to the infected host. The other logs describe logins, data access, application events or address assignments.
Question 56 Play from 1:20:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A memorandum of understanding is a preliminary statement of intent without detailed technical terms.
Right, B is the answer.
Why B is right
A service level agreement lists measurable commitments, such as availability percentages, and the remedies if they are missed. The other documents describe general understandings or the scope of work rather than performance guarantees.
Not this one. Try another answer.
Why C is wrong
A memorandum of agreement records a general arrangement and doesn't normally list uptime metrics.
Not this one. Try another answer.
Why D is wrong
A statement of work defines the tasks to be done, not ongoing service level guarantees.
Question 57 Play from 1:21:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Brute force repeatedly guesses passwords or keys, which isn't what the request shows.
Not this one. Try another answer.
Why B is wrong
Credential replay reuses captured login data and doesn't manipulate file paths.
Not this one. Try another answer.
Why C is wrong
Privilege escalation raises account rights and does not involve climbing directories.
Right, D is the answer.
Why D is right
Chaining parent-directory sequences to climb out of the web root and read system files is a directory traversal attack. It abuses weak input handling to reach files that should not be served.
Question 58 Play from 1:23:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Operational describes function, not a classification level.
Right, B is one of the answers.
Why B is right
Government project files for a critical system are sensitive, so they would be labeled with the higher classification levels, confidential and restricted. Public does not fit, and operational and urgent are not classification levels at all.
Not this one. Try another answer.
Why C is wrong
Public would allow anyone to see the data, which is wrong for government work.
Not this one. Try another answer.
Why D is wrong
Private usually refers to personal information and does not match project data.
Right, E is one of the answers.
Why E is right
Government project files for a critical system are sensitive, so they would be labeled with the higher classification levels, confidential and restricted. Public does not fit, and operational and urgent are not classification levels at all.
Not this one. Try another answer.
Why F is wrong
Urgent describes priority and not how sensitive the data is.
Question 59 Play from 1:24:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Corrective controls fix or restore systems after an incident.
Not this one. Try another answer.
Why B is wrong
Compensating controls stand in when the primary control cannot be used.
Not this one. Try another answer.
Why C is wrong
Preventive controls act before an event to stop it.
Right, D is the answer.
Why D is right
Examining logs to find out what already happened is a detective activity, because it identifies and documents events after they occur. It does not stop the event or repair damage.
Question 60 Play from 1:26:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A phishing campaign is a deceptive message aimed at users, not data copying by an authorized account.
Not this one. Try another answer.
Why B is wrong
Penetration testing is authorized and scheduled, which this behavior is not.
Right, C is the answer.
Why C is right
A trusted user misusing legitimate access to take data is an insider threat. The other options would be a scam from outside, an authorized security test or a planned review, none of which match a worker quietly copying files.
Not this one. Try another answer.
Why D is wrong
An external audit is a planned, open review process, not covert file copying.
Question 61 Play from 1:27:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A flat network is a general design weakness and is not specific to using a hosted provider.
Right, B is the answer.
Why B is right
Relying on a SaaS provider means inheriting the risks of that vendor's security practices, its infrastructure and its access to company data, which is a supply chain risk. The other items are general weaknesses not tied to the vendor relationship.
Not this one. Try another answer.
Why C is wrong
Factory passwords are a risk in many systems but the scenario points to the vendor relationship.
Not this one. Try another answer.
Why D is wrong
Software flaws are a common risk but do not characterize what a hosted vendor brings.
Question 62 Play from 1:29:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tokenization replaces values with surrogates and is not the general method for making stored files unreadable.
Not this one. Try another answer.
Why B is wrong
Segmentation separates networks and doesn't protect data sitting on a disk.
Right, C is the answer.
Why C is right
Encryption turns stored data into ciphertext that only holders of the proper key can reverse, so a stolen disk reveals nothing. The other options are one-way digests, value substitution or network isolation.
Not this one. Try another answer.
Why D is wrong
Hashing is one-way and meant for integrity checks, so files could not be read again.
Question 63 Play from 1:30:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An alarm announces a break-in after it begins and doesn't block it.
Not this one. Try another answer.
Why B is wrong
Motion detectors sense movement but can't physically stop anyone.
Not this one. Try another answer.
Why C is wrong
Cameras record and deter but do not prevent entry.
Right, D is the answer.
Why D is right
Bollards are solid barriers that physically block vehicles from reaching a building, so they prevent an intrusion from happening. The other devices only watch for or announce an event once it is under way.
Question 64 Play from 1:31:44
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Feeding specially crafted characters into an input so that the database interprets them as commands is SQL injection, and it can expose data from the systems behind the form. The other choices are not injection attacks.
Not this one. Try another answer.
Why B is wrong
Resource reuse concerns how freed resources are reassigned and is not an attack on input handling.
Not this one. Try another answer.
Why C is wrong
Side loading means installing apps from outside the official store.
Not this one. Try another answer.
Why D is wrong
Target of evaluation is a Common Criteria term for the system being assessed.
Question 65 Play from 1:33:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Physical controls protect facilities and equipment, not software exploits.
Not this one. Try another answer.
Why B is wrong
Operational controls are procedures carried out by people and not a technical stopgap.
Right, C is the answer.
Why C is right
With no patch available, an alternative safeguard is added to offset the weakness, which is a compensating control. The other types are about buildings, human procedures or spotting events after the fact.
Not this one. Try another answer.
Why D is wrong
Detective controls spot events but do not reduce exposure ahead of time.
Question 66 Play from 1:34:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A buffer overflow is a memory corruption flaw in running code, not an installation route.
Not this one. Try another answer.
Why B is wrong
Cross-site scripting injects scripts into web pages and has nothing to do with app installation.
Right, C is the answer.
Why C is right
Side loading is installing software outside the sanctioned app store, which skips the vetting and checks that store performs. Jailbreaking removes operating system limits more broadly, and the other two are code flaws.
Not this one. Try another answer.
Why D is wrong
Jailbreaking strips system restrictions to gain elevated control and is not specifically about install sources.
Question 67 Play from 1:35:48
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
The old data has to be wiped, which is sanitization, and the wipe should be documented as complete, which is certification. Keeping, destroying or sorting the data would not make the machine safe to reissue.
Not this one. Try another answer.
Why B is wrong
Retention means keeping data, whereas the machine needs to be cleaned.
Not this one. Try another answer.
Why C is wrong
Enumeration lists items and is not a data handling action for reissuing a device.
Right, D is one of the answers.
Why D is right
The old data has to be wiped, which is sanitization, and the wipe should be documented as complete, which is certification. Keeping, destroying or sorting the data would not make the machine safe to reissue.
Not this one. Try another answer.
Why E is wrong
Destruction is for hardware that is being retired and not reused.
Not this one. Try another answer.
Why F is wrong
Classification labels data by sensitivity but doesn't remove it.
Question 68 Play from 1:37:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk tolerance describes how much risk is acceptable and is not a step in doing the upgrade.
Right, B is the answer.
Why B is right
A maintenance window is the agreed time slot for changes such as firmware upgrades, so disruption is kept low and people are informed. The other items are a development method, a risk attitude or a certificate request.
Not this one. Try another answer.
Why C is wrong
A certificate signing request relates to getting a certificate and not to firmware.
Not this one. Try another answer.
Why D is wrong
The software development life cycle governs building software, not applying a router update.
Question 69 Play from 1:38:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Destruction is about physically ruining the hardware, which is the opposite of keeping data.
Not this one. Try another answer.
Why B is wrong
Sanitization erases data, whereas the legal team wants it preserved.
Right, C is the answer.
Why C is right
Keeping copies of data for legal reasons after the hardware is gone is retention. Destruction and sanitization remove data, and certification only documents that a process was done.
Not this one. Try another answer.
Why D is wrong
Certification provides proof that a task was completed, not the preservation of the data.
Question 70 Play from 1:40:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Industrial control systems run physical processes and not server builds.
Not this one. Try another answer.
Why B is wrong
Infrastructure as a service supplies rented resources, but does not itself standardize how servers are built.
Right, C is the answer.
Why C is right
Describing servers in code that is run automatically makes builds repeatable, standard and fast, and the definitions can be kept under version control. The other choices are a service model, device categories or industrial equipment.
Not this one. Try another answer.
Why D is wrong
The Internet of things concerns connected devices rather than managing servers.
Question 71 Play from 1:41:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Bluetooth needs proximity and pairing, and it's less practical than portable media.
Right, B is the answer.
Why B is right
On an isolated network, someone has to physically carry data across, and USB drives and similar media are the easiest way to do that. Wireless links and exposed systems are less common or contradict the isolation.
Not this one. Try another answer.
Why C is wrong
A bastion host is a controlled connection point and not a typical leak path in a true air gap.
Not this one. Try another answer.
Why D is wrong
A missing patch creates malware risk but is not the usual way data leaves.
Question 72 Play from 1:43:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A warm site needs extra setup before it can handle the load.
Not this one. Try another answer.
Why B is wrong
A cold site is mostly empty space and takes a long time to bring online.
Right, C is the answer.
Why C is right
A hot site is a fully equipped, continuously updated duplicate that can take over right away with very little data loss. Other site types need more time to prepare.
Not this one. Try another answer.
Why D is wrong
A generic recovery site does not state how ready it is for quick failover.
Question 73 Play from 1:44:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Single sign-on is a convenience for users and is not a core requirement for device traffic.
Right, B is the answer.
Why B is right
Traffic between devices and the cloud platform should be encrypted so it cannot be read or altered while travelling, which makes it the basic requirement. The other items are useful but optional or situational.
Not this one. Try another answer.
Why C is wrong
Federated identity is an advanced option and not always needed for basic device management.
Not this one. Try another answer.
Why D is wrong
A firewall is a helpful tool but isn't specifically required for the platform itself.
Question 74 Play from 1:45:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cloning cards means copying a badge's radio signal, which the consultant did not do.
Not this one. Try another answer.
Why B is wrong
Forgery involves faked credentials or documents, none of which are described.
Not this one. Try another answer.
Why C is wrong
Shoulder surfing is observing someone's screen or keypad, not following through a door.
Right, D is the answer.
Why D is right
Following an authorized person through an entrance without presenting credentials is tailgating, a common social engineering method of getting past physical controls. The others involve copying cards, faking papers or watching screens.
Question 75 Play from 1:47:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Encryption protects data in transit and does not stop traffic from particular regions.
Not this one. Try another answer.
Why B is wrong
Obfuscation hides code or data and doesn't filter traffic by origin.
Right, C is the answer.
Why C is right
Geolocation maps addresses to places, so traffic from high-risk areas can be restricted or blocked. The other options protect data or deal with legal jurisdiction, not the origin of an attack.
Not this one. Try another answer.
Why D is wrong
Data sovereignty is a legal concept about where data is held.
Question 76 Play from 1:48:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
HVAC concerns heating and cooling and does not use these protocols.
Not this one. Try another answer.
Why B is wrong
A system on a chip is a hardware design and not a communications use.
Right, C is the answer.
Why C is right
These protocols handle call setup and the carrying of voice media, which together make up Voice over IP. The remaining choices are building systems, hardware designs or operating system types.
Not this one. Try another answer.
Why D is wrong
A real-time operating system is software for time-critical devices, unrelated to these call protocols.
Question 77 Play from 1:49:49
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Steganography embeds information inside another file, often a picture, so its presence goes unnoticed. Encryption makes content unreadable but still visible, and hashing produces a fingerprint.
Not this one. Try another answer.
Why B is wrong
Data masking hides values in databases or reports, not inside images.
Not this one. Try another answer.
Why C is wrong
Symmetric encryption scrambles data with a key but doesn't hide that data exists.
Not this one. Try another answer.
Why D is wrong
Hashing produces a fixed digest for integrity checks and does not hide anything.
Question 78 Play from 1:51:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Ranking the flaw helps prioritization, but it doesn't replace the required change procedure.
Right, B is the answer.
Why B is right
Changes to production systems have to follow the organization's change management process for approvals, testing and documentation, so that policy is consulted first. The other steps either come later or belong to different processes.
Not this one. Try another answer.
Why C is wrong
Passing it to developers may happen later and is not the required first step.
Not this one. Try another answer.
Why D is wrong
The incident response plan applies to active incidents, not routine fixes.
Question 79 Play from 1:52:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Inherent risk is the level before any safeguards exist.
Right, B is the answer.
Why B is right
Residual risk is what remains after controls and other reductions have been applied. Inherent risk is the level before any controls, and the remaining terms mean other things.
Not this one. Try another answer.
Why C is wrong
Operational risk comes from day-to-day business activity and is not defined by controls.
Not this one. Try another answer.
Why D is wrong
Avoided risk means the activity was not undertaken, so no risk remains from it.
Question 80 Play from 1:53:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A hypervisor runs virtual machines and does not control who reaches internal systems.
Not this one. Try another answer.
Why B is wrong
A proxy handles application traffic on behalf of clients and is not primarily an administrative access barrier.
Not this one. Try another answer.
Why C is wrong
A remote desktop server provides sessions but does not by itself add a controlled gateway layer.
Right, D is the answer.
Why D is right
A jump server is a hardened intermediary through which administrators must connect, centralizing access control and logging for the systems behind it. The other items do not serve as that kind of gatekeeper.
Question 81 Play from 1:55:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SOAR automates security workflows and is not a catalog of attacker behavior.
Not this one. Try another answer.
Why B is wrong
CVSS rates the severity of vulnerabilities, not what attackers do.
Right, C is the answer.
Why C is right
MITRE ATT&CK catalogs adversary tactics and techniques gathered from observed attacks, which makes it the natural guide for choosing defenses. The other items are an automation platform, a scoring system and a response team.
Not this one. Try another answer.
Why D is wrong
A CSIRT is a team that handles incidents, not a reference source.
Question 82 Play from 1:56:50
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A hot site is a fully equipped facility kept in sync with the main one, so work can continue immediately after a disaster. Other options need time to set up or are not standard categories.
Not this one. Try another answer.
Why B is wrong
A warm site has some equipment but needs hours to become fully operational.
Not this one. Try another answer.
Why C is wrong
Tertiary is not a standard recovery site classification.
Not this one. Try another answer.
Why D is wrong
A cold site has no equipment or data ready, so it takes a long time to start.
Question 83 Play from 1:58:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A true positive is a real flaw that was correctly detected.
Not this one. Try another answer.
Why B is wrong
A true negative means nothing was reported and nothing was there.
Not this one. Try another answer.
Why C is wrong
A false negative means a real flaw went unreported.
Right, D is the answer.
Why D is right
A false positive is a finding the scanner reports even though the problem does not exist. The scan raised an alarm that turned out to be wrong.
Question 84 Play from 1:59:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Preparation takes place before any incident, setting up tools and procedures.
Not this one. Try another answer.
Why B is wrong
Analysis works out what happened but does not by itself limit the spread.
Not this one. Try another answer.
Why C is wrong
Recovery restores normal operations after the threat is under control.
Right, D is the answer.
Why D is right
Containment limits how far an incident can spread by isolating affected systems and cutting off the attacker, which keeps the damage and disruption small. It follows detection and analysis and comes before recovery.
Question 85 Play from 2:00:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Maintaining comes last, since there is nothing to maintain before the baseline exists and has been applied.
Right, B is the answer.
Why B is right
The baseline must first be defined, then applied to the systems, and then kept current over time. Any order that deploys before defining it has nothing to apply.
Not this one. Try another answer.
Why C is wrong
This order deploys before the baseline has been defined.
Not this one. Try another answer.
Why D is wrong
Deploying first has no defined baseline to apply.
Question 86 Play from 2:02:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
MTBF measures the average time between equipment failures, not attack frequency.
Right, B is the answer.
Why B is right
The annual rate of occurrence estimates how often an event is expected to happen each year, which helps decide whether coverage for it is worth paying for. The other values measure repair time, failure intervals or recovery targets.
Not this one. Try another answer.
Why C is wrong
MTTR measures how long a repair takes.
Not this one. Try another answer.
Why D is wrong
RTO states how quickly operations must be restored after an outage.
Question 87 Play from 2:03:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Isolating leaves useless machines in place as a liability.
Right, B is the answer.
Why B is right
Machines that nobody uses and that cannot meet requirements only add attack surface, so retiring them removes the risk for good. The other actions leave unneeded systems on the network.
Not this one. Try another answer.
Why C is wrong
Patching idle systems that may not even be updatable doesn't solve the noncompliance.
Not this one. Try another answer.
Why D is wrong
Monitoring does not fix the noncompliance or lower the risk.
Question 88 Play from 2:04:35
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Key escrow places a copy of the key with a trusted party, which then releases it to authorized parties when needed. The other choices manage certificates, encrypt data or publish information openly.
Not this one. Try another answer.
Why B is wrong
A public ledger is visible to everyone and is unsuitable for secret keys.
Not this one. Try another answer.
Why C is wrong
Public key encryption protects data but does not store keys for others to retrieve.
Not this one. Try another answer.
Why D is wrong
PKI issues and manages certificates and key pairs and is not a key storage service.
Question 89 Play from 2:05:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Each virtual machine still needs its own operating system patched.
Not this one. Try another answer.
Why B is wrong
Real-time operating systems are specialized and do not reduce patching.
Right, C is the answer.
Why C is right
Containers share a single host kernel and package their own dependencies, so fewer operating system instances need patching. Virtual machines each carry a full operating system, and the other choices do not reduce patch counts.
Not this one. Try another answer.
Why D is wrong
Microservices describe an application design style and not an operating system saving.
Question 90 Play from 2:07:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An SLA sets service performance commitments.
Not this one. Try another answer.
Why B is wrong
An MSA sets general terms for ongoing work.
Not this one. Try another answer.
Why C is wrong
A blanket purchase agreement arranges repeat purchases and doesn't restrict disclosure.
Right, D is the answer.
Why D is right
A non-disclosure agreement legally restricts what parties may share with outsiders. The other agreements cover service levels, general contract terms or purchasing arrangements.
Question 91 Play from 2:08:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A shredder physically destroys the drive, so it can't be reused.
Right, B is the answer.
Why B is right
A wiping tool overwrites the stored data so it cannot be recovered while leaving the drive working for reuse. Shredding and degaussing ruin the drive, and a retention platform is not a sanitization method.
Not this one. Try another answer.
Why C is wrong
Degaussing uses strong magnets that typically make the drive unusable.
Not this one. Try another answer.
Why D is wrong
A retention platform is for keeping data, not erasing it.
Question 92 Play from 2:09:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Network access control decides which devices may connect, not whether files change.
Not this one. Try another answer.
Why B is wrong
Whole-disk encryption protects confidentiality and does not detect modification.
Not this one. Try another answer.
Why C is wrong
User behavior analytics flags unusual activity but is not built to track file changes.
Right, D is the answer.
Why D is right
File integrity monitoring watches files for unauthorized changes and raises an alert when content or attributes differ from the known good state. The other tools protect confidentiality, control connections or look for odd user activity.
Question 93 Play from 2:11:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Segmentation separates networks and doesn't decide what individual users can do.
Not this one. Try another answer.
Why B is wrong
A baseline sets standard system settings rather than per-user access.
Right, C is the answer.
Why C is right
Least privilege grants each account just the permissions needed for its role and nothing more, which fits access to the job while limiting risk. The other measures address networks, system settings or credentials.
Not this one. Try another answer.
Why D is wrong
Changing default passwords improves login security, not permission levels.
Question 94 Play from 2:12:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SNMP traps send monitoring alerts and do not restrict connections.
Not this one. Try another answer.
Why B is wrong
A single host rule is not a division of the network into segments.
Not this one. Try another answer.
Why C is wrong
Transfer of risk shifts the impact to another party, such as an insurer.
Right, D is the answer.
Why D is right
Because the system cannot be brought up to modern standards, the local firewall acts as an alternative safeguard that reduces exposure, which makes it a compensating control. The other options do not describe what was done.
Question 95 Play from 2:13:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SD-WAN manages wide-area connectivity and does not defend applications.
Not this one. Try another answer.
Why B is wrong
TLS encrypts traffic but won't stop an exploit that is carried inside it.
Right, C is the answer.
Why C is right
A web application firewall inspects web requests and blocks attacks aimed at the application layer, including malformed inputs that try to exploit coding flaws. The other tools handle routing, encryption or general network filtering.
Not this one. Try another answer.
Why D is wrong
A next-generation firewall works mainly on network traffic and is less suited to catching application-level exploits.
Question 96 Play from 2:15:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A cyclic redundancy check detects errors in transmitted data and not certificate status.
Not this one. Try another answer.
Why B is wrong
A certificate signing request is how a certificate is requested, not validated.
Right, C is the answer.
Why C is right
The online certificate status protocol lets a client ask whether a particular certificate has been revoked, giving a quick answer on its current validity. The other choices are a checksum, a request form and the issuing authority.
Not this one. Try another answer.
Why D is wrong
A certificate authority issues certificates but is not itself the status checking method.
Question 97 Play from 2:16:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A host-based IDS monitors one machine and only detects.
Right, B is the answer.
Why B is right
A network intrusion prevention system sits in the path of traffic and actively drops malicious packets as they arrive from outside. Detection-only systems only alert, and access lists filter by simple rules.
Not this one. Try another answer.
Why C is wrong
An access list filters by static rules and cannot recognize attack patterns.
Not this one. Try another answer.
Why D is wrong
A network IDS detects and alerts but does not block.
Question 98 Play from 2:18:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A preventive control would be a broader safeguard, whereas this placement stands in for protection the old system lacks.
Right, B is the answer.
Why B is right
Old systems that cannot easily be updated are often shielded by isolating them, so the network placement offsets the weakness the server cannot fix itself, and that is a compensating control.
Not this one. Try another answer.
Why C is wrong
Deterrent controls discourage attackers and don't isolate anything.
Not this one. Try another answer.
Why D is wrong
Corrective controls fix damage after an incident.
Question 99 Play from 2:19:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Trend-based analysis looks at patterns over time rather than calculating loss values.
Not this one. Try another answer.
Why B is wrong
User-driven analysis is not a standard method for measuring risk.
Not this one. Try another answer.
Why C is wrong
Heuristic analysis relies on rules of thumb rather than numeric calculation.
Right, D is the answer.
Why D is right
Quantitative analysis assigns numeric values, such as the exposure factor, which is the share of an asset's value lost in an event. The other methods are descriptive or experience-based and do not produce those figures.
Question 100 Play from 2:20:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Monitoring may spot exploitation but leaves the flaw in place.
Not this one. Try another answer.
Why B is wrong
Retiring the server is excessive when a fix exists.
Right, C is the answer.
Why C is right
Applying the vendor's patch closes the specific weakness, so it is the direct fix. The other responses reduce exposure or retire the system but leave the flaw in place.
Not this one. Try another answer.
Why D is wrong
Segmentation limits the impact without fixing the underlying flaw.
Transcript
Play from 00:00 Question 1. An engineer is writing up the exact ordered steps that staff must follow to harden a new firewall appliance. Which type of document covers instructions like these? Here are the options. Option A. Guideline. Option B. Procedure. Option C. Policy. Option D. Standard. Pause the video now if you want time to think about the answer.
The correct answer is B. Procedure. A procedure lays out the ordered, hands-on actions needed to complete one specific technical task, such as hardening a device. The other document types sit at a higher level: they say what is required or recommended, but they do not walk someone through the work. Now, why are the other options incorrect? Option A is incorrect. A guideline offers optional advice and good practice, not a mandatory sequence of actions. Option C is incorrect. A policy records management's rules and intent, and does not list configuration actions. Option D is incorrect. A standard sets mandatory requirements or settings, but not the order in which to carry them out. Therefore, B, Procedure, is the correct answer.
Play from 01:29 Question 2. A manufacturer has begun a business impact analysis covering its plants. Which of these activities belongs to that analysis? Here are the options. Option A. Drafting how staff and the public will be notified during a crisis. Option B. Writing the steps used to restore data from backup media. Option C. Determining how long each critical system can be offline before serious harm occurs. Option D. Building the playbook for handling security incidents. Option E. Reviewing the enterprise risk register and its treatment plan. Pause the video now if you want time to think about the answer.
The correct answer is C. Determining how long each critical system can be offline before serious harm occurs. A business impact analysis ranks critical business functions and works out how much downtime each one can tolerate, which is where recovery time targets come from. Notification plans, restore procedures, incident handling and risk plan reviews are produced by other planning efforts. Now, why are the other options incorrect? Option A is incorrect. Crisis communication planning is part of continuity or incident planning, not the impact analysis. Option B is incorrect. Restore procedures are written in disaster recovery planning once the targets are known. Option D is incorrect. Incident handling playbooks belong to incident response planning. Option E is incorrect. Reviewing the risk register is a risk management task, separate from the impact analysis. Therefore, C, Determining how long each critical system can be offline before serious harm occurs, is the correct answer.
Play from 03:26 Question 3. Which type of attacker is most likely driven by the hope of making money? Here are the options. Option A. Shadow IT. Option B. Organized crime. Option C. Hacktivist. Option D. Insider threat. Pause the video now if you want time to think about the answer.
The correct answer is B. Organized crime. Criminal groups run ransomware, fraud, theft and extortion schemes because these bring in revenue, so financial gain is their main driver. The other options are driven by other things or are not attackers at all. Now, why are the other options incorrect? Option A is incorrect. Shadow IT describes unapproved technology use inside a company, not a type of attacker with a profit goal. Option C is incorrect. Hacktivists act on political or social beliefs rather than for payment. Option D is incorrect. Insiders may act out of anger, coercion or ambition, so profit is not their defining motive. Therefore, B, Organized crime, is the correct answer.
Show full transcriptShow less
Play from 04:43 Question 4. A group defaces a government website to protest a new law. What is the typical motivation of this kind of attacker? Here are the options. Option A. Money from selling stolen data. Option B. Personal revenge on an ex-employer. Option C. Gathering secrets for another country. Option D. Strong ideological or political convictions. Pause the video now if you want time to think about the answer.
The correct answer is D. Strong ideological or political convictions. Hacktivists attack to push a cause, protest a decision or draw attention to an issue, so their driver is conviction rather than reward. Other attacker types are the ones motivated by money, grudges or state interests. Now, why are the other options incorrect? Option A is incorrect. Selling stolen data is the pattern of financially driven criminals. Option B is incorrect. Revenge is a personal motive found in disgruntled insiders, not protest groups. Option C is incorrect. Collecting secrets for a government is espionage, carried out by nation-state actors. Therefore, D, Strong ideological or political convictions, is the correct answer.
Play from 06:15 Question 5. Setting up a RADIUS server in a network mainly delivers which security framework? Here are the options. Option A. ACL. Option B. PEM. Option C. CIA. Option D. AAA. Pause the video now if you want time to think about the answer.
The correct answer is D. AAA. RADIUS centralizes three functions: it verifies who a user is, decides what that user may reach, and records what they did. Those three jobs are exactly the AAA framework. The remaining choices are a rule list, a file encoding and a set of goals, none of which RADIUS delivers. Now, why are the other options incorrect? Option A is incorrect. An access control list filters traffic or resource access and is not what a RADIUS server provides. Option B is incorrect. PEM is a text encoding for certificates and keys and has nothing to do with RADIUS. Option C is incorrect. CIA names the goals of confidentiality, integrity and availability, which are objectives rather than a service. Therefore, D, AAA, is the correct answer.
Play from 07:44 Question 6. Which agreement or policy is the usual way for a company to set out expected honest and ethical conduct for staff when using its systems? Here are the options. Option A. EULA. Option B. AUP. Option C. MOA. Option D. SLA. Pause the video now if you want time to think about the answer.
The correct answer is B. AUP. An acceptable use policy tells employees how they may use company resources and what conduct is expected, including honesty and ethics. The other documents cover software licensing, partnership terms and service levels instead. Now, why are the other options incorrect? Option A is incorrect. A EULA is the license a vendor gives a customer for software, not workplace conduct rules. Option C is incorrect. A memorandum of agreement records terms between organizations, not employee behavior rules. Option D is incorrect. A service level agreement sets performance targets for a service. Therefore, B, AUP, is the correct answer.
Play from 09:06 Question 7. A forensic team must keep seized laptops unchanged so the evidence stands up in court. Which forensic element addresses keeping the evidence intact? Here are the options. Option A. Containment. Option B. Acquisition. Option C. Preservation. Option D. E-discovery. Pause the video now if you want time to think about the answer.
The correct answer is C. Preservation. Preservation covers protecting evidence from change, loss or contamination through careful handling, storage and documentation, which keeps it admissible. The other terms describe gathering, locating or isolating, not keeping the original intact. Now, why are the other options incorrect? Option A is incorrect. Containment stops an incident from spreading and is not an evidence handling step. Option B is incorrect. Acquisition is the act of collecting the data, and on its own it does not guarantee that the evidence stays unchanged. Option D is incorrect. E-discovery is about finding and producing electronic records for legal matters, not safeguarding their integrity. Therefore, C, Preservation, is the correct answer.
Play from 10:33 Question 8. Analysts in a security operations center need a quick-reference document to follow while an alert is being worked as it happens. Which is the best fit? Here are the options. Option A. Risk profile. Option B. Change management policy. Option C. SIEM profile. Option D. Playbook. Pause the video now if you want time to think about the answer.
The correct answer is D. Playbook. A playbook gives responders a documented sequence of actions for a particular type of alert or incident, so analysts can open it and follow it during the event. The other items are governance or configuration records that analysts do not use as live guides. Now, why are the other options incorrect? Option A is incorrect. A risk profile summarizes exposure at a high level and gives no response steps. Option B is incorrect. A change management policy governs how changes are approved and is not an incident aid. Option C is incorrect. A SIEM profile describes how the tool is configured, not how to respond to an alert. Therefore, D, Playbook, is the correct answer.
Play from 12:02 Question 9. A developer is designing storage for customer payment card numbers kept for pending orders. Which protection best limits the damage if the database is stolen? Here are the options. Option A. Tokenization. Option B. Hashing. Option C. Masking. Option D. Obfuscation. Pause the video now if you want time to think about the answer.
The correct answer is A. Tokenization. Tokenization swaps each card number for a random token that is useless outside the payment system, so a stolen database exposes nothing valuable. It also suits payment card compliance needs. Hashing blocks later use of the number, while masking and obfuscation only hide data. Now, why are the other options incorrect? Option B is incorrect. A one-way hash cannot be turned back into the card number, so legitimate payments could not use it. Option C is incorrect. Masking hides part of a value on screen but the actual data still sits in storage. Option D is incorrect. Obfuscation only makes data harder to read and gives weak protection against a determined thief. Therefore, A, Tokenization, is the correct answer.
Play from 13:31 Question 10. Which choice is the best way to protect information while it travels between a browser and a web server? Here are the options. Option A. AES-256. Option B. SHA-256. Option C. SSL3.0. Option D. TLS 1.3. Pause the video now if you want time to think about the answer.
The correct answer is D. TLS 1.3. TLS 1.3 is a complete protocol that negotiates keys, authenticates the server and encrypts the traffic as it moves. The older SSL version is deprecated, a hash only checks integrity, and a cipher alone is not a full transport protocol. Now, why are the other options incorrect? Option A is incorrect. AES-256 is a cipher used inside protocols, but by itself it is not a complete way of securing a connection. Option B is incorrect. SHA-256 is a hash function for integrity checks and does not encrypt anything. Option C is incorrect. SSL 3.0 is obsolete and has known weaknesses, so it should not be used. Therefore, D, TLS 1.3, is the correct answer.
Play from 15:02 Question 11. A consultant is asked to start a risk assessment but must not touch any of the client's internal data or systems. Which approach for collecting information fits? Here are the options. Option A. Open-source intelligence. Option B. Penetration testing. Option C. Configuration auditing. Option D. Network scanning. Pause the video now if you want time to think about the answer.
The correct answer is A. Open-source intelligence. Open-source intelligence uses publicly available material, so no internal data or systems need to be accessed. Scanning, testing and auditing all require interaction with the client's own environment or access to its internal information. Now, why are the other options incorrect? Option B is incorrect. A penetration test actively probes the client's systems and needs authorized access. Option C is incorrect. Auditing configurations means reviewing internal settings that the client considers private. Option D is incorrect. Scanning sends traffic to the client's hosts, so it involves their infrastructure. Therefore, A, Open-source intelligence, is the correct answer.
Play from 16:28 Question 12. Two firms are about to share trade secrets during merger talks, and each wants a signed promise that the other will not pass them to third parties. What type of agreement is this? Here are the options. Option A. MSA. Option B. MOA. Option C. NDA. Option D. SLA. Pause the video now if you want time to think about the answer.
The correct answer is C. NDA. A non-disclosure agreement is a legal contract in which parties promise to keep shared confidential information from outsiders. The other agreements cover service terms, general cooperation or performance levels, not secrecy. Now, why are the other options incorrect? Option A is incorrect. A master services agreement sets overall commercial terms for ongoing work and is not mainly about secrecy. Option B is incorrect. A memorandum of agreement records a general understanding and does not specifically restrict disclosure. Option D is incorrect. A service level agreement defines performance targets and remedies for a service. Therefore, C, NDA, is the correct answer.
Play from 17:56 Question 13. A certificate authority wants to publish a list of certificates that should no longer be trusted. What is used to do this? Here are the options. Option A. TPM. Option B. PKI. Option C. CRL. Option D. CSR. Pause the video now if you want time to think about the answer.
The correct answer is C. CRL. A certificate revocation list is published by the certificate authority and names certificates that are no longer to be trusted, letting clients check status before relying on one. The other options are hardware, a framework or an application form. Now, why are the other options incorrect? Option A is incorrect. A trusted platform module is a hardware chip that stores keys and does not publish certificate status. Option B is incorrect. PKI is the overall framework for certificates, not the specific list of invalid ones. Option D is incorrect. A certificate signing request is what a requester sends to get a certificate issued. Therefore, C, CRL, is the correct answer.
Play from 19:17 Question 14. A company switches off the services nobody needs on a business-critical legacy system and puts a firewall in front of it. How is this best described? Here are the options. Option A. Risk transfer. Option B. Compensating controls. Option C. Exception. Option D. Segmentation. Pause the video now if you want time to think about the answer.
The correct answer is B. Compensating controls. When the normal fix is not possible, other safeguards are put in place to reduce the same risk. Closing needless services and shielding the system with a firewall are such alternative safeguards, which are called compensating controls. Now, why are the other options incorrect? Option A is incorrect. Risk transfer shifts the impact to another party, for example through insurance. Option C is incorrect. An exception is a documented approval to skip a requirement and adds no protection by itself. Option D is incorrect. Segmentation separates networks, but the scenario centers on offsetting the missing patch with other safeguards. Therefore, B, Compensating controls, is the correct answer.
Play from 20:46 Question 15. Before running a password through a one-way function, a developer appends random data to it so identical passwords produce different results. What is this technique? Here are the options. Option A. Steganography. Option B. Data masking. Option C. Salting. Option D. Key stretching. Pause the video now if you want time to think about the answer.
The correct answer is C. Salting. Salting mixes unique random data into each input before it is hashed, so identical passwords yield different hashes and precomputed tables stop working. Stretching repeats the hashing, masking hides displayed values, and steganography conceals data in media. Now, why are the other options incorrect? Option A is incorrect. Steganography hides information inside other files and is unrelated to hashing inputs. Option B is incorrect. Data masking obscures values for display or testing and does not add randomness to hash input. Option D is incorrect. Key stretching runs the function many times to slow guessing instead of adding data beforehand. Therefore, C, Salting, is the correct answer.
Play from 22:15 Question 16. A multinational wants to work out which countries' laws apply to its information depending on where that information physically sits. Which concept covers this? Here are the options. Option A. Geographic restrictions. Option B. Geographic dispersion. Option C. Data segmentation. Option D. Data sovereignty. Pause the video now if you want time to think about the answer.
The correct answer is D. Data sovereignty. Data sovereignty is the idea that information is governed by the laws of the place where it is held or processed, so the company must look at those jurisdictions to see which rules apply. The alternatives are about location limits, spreading copies or dividing data. Now, why are the other options incorrect? Option A is incorrect. Geographic restrictions limit where access or storage is allowed, not which laws apply. Option B is incorrect. Geographic dispersion spreads systems across sites for resilience. Option C is incorrect. Data segmentation separates data into groups for technical or access reasons. Therefore, D, Data sovereignty, is the correct answer.
Play from 23:40 Question 17. A security team wants to set a trap that would tempt a malicious insider. Which bait would be most likely to catch their attention? Here are the options. Option A. A planted account entry that looks like an administrator. Option B. A fake spreadsheet of staff pay placed in a shared documents folder. Option C. A deliberately weak password hash planted in the shadow password file. Option D. A scheduled job on the server that has a visible flaw. Pause the video now if you want time to think about the answer.
The correct answer is B. A fake spreadsheet of staff pay placed in a shared documents folder. Insiders go after data that seems valuable, and employee pay records are a classic lure. A decoy file of that kind draws interest and exposes anyone who opens it. System file tweaks are things an attacker might exploit, but they do not tempt an insider in the same way. Now, why are the other options incorrect? Option A is incorrect. A fake account might be noticed by monitoring, but it does not naturally draw an insider looking for valuable data. Option C is incorrect. A weak hash in the shadow file is something to crack, not bait that attracts curiosity. Option D is incorrect. A flawed scheduled job is an opening to exploit, not an appealing target for an insider. Therefore, B, A fake spreadsheet of staff pay placed in a shared documents folder, is the correct answer.
Play from 25:30 Question 18. A buyer wants the quickest and cheapest way to get assurance that a vendor is meeting its security commitments. What should the buyer request? Here are the options. Option A. Penetration testing. Option B. Vulnerability assessment. Option C. Attestation report. Option D. Third-party audit. Pause the video now if you want time to think about the answer.
The correct answer is C. Attestation report. An attestation report is a formal statement from the vendor, or an assessor, confirming that it meets its commitments. It takes little time and money compared with a full examination, while still giving documented assurance. Now, why are the other options incorrect? Option A is incorrect. Penetration testing is costly and slow, and it examines technical weaknesses rather than overall compliance. Option B is incorrect. A vulnerability assessment finds technical flaws but does not confirm broader obligations. Option D is incorrect. An independent audit is thorough but takes longer and costs much more. Therefore, C, Attestation report, is the correct answer.
Play from 26:56 Question 19. A developer asks for Telnet to administer a remote web server, but company rules forbid insecure protocols. Which protocol should be set up instead? Here are the options. Option A. SMTP. Option B. SSH. Option C. RDP. Option D. HTTPS. Option E. SNMPv3. Pause the video now if you want time to think about the answer.
The correct answer is B. SSH. SSH gives the same remote command-line access that Telnet did, but with encryption, so it meets the rule against insecure protocols. The other options serve different purposes such as web pages, mail, graphical desktops or device monitoring. Now, why are the other options incorrect? Option A is incorrect. SMTP is used to send email and offers no remote shell. Option C is incorrect. RDP provides a graphical desktop session and is not the usual choice for command-line administration of a web server. Option D is incorrect. HTTPS secures web traffic and does not give a terminal session. Option E is incorrect. SNMPv3 is for monitoring and managing network devices, not for logging into a server. Therefore, B, SSH, is the correct answer.
Play from 28:32 Question 20. A firm restricts client documents so that only staff whose job role requires them can open them. Which security principle does this represent? Here are the options. Option A. Integrity. Option B. Availability. Option C. Non-repudiation. Option D. Confidentiality. Pause the video now if you want time to think about the answer.
The correct answer is D. Confidentiality. Limiting access to people with a legitimate need and the right role keeps sensitive information from those who should not see it, which is confidentiality. The other principles concern accuracy, uptime and proof of actions. Now, why are the other options incorrect? Option A is incorrect. Integrity is about keeping data accurate and unaltered, not about who can read it. Option B is incorrect. Availability means data and systems are usable when needed. Option C is incorrect. Non-repudiation prevents people from denying their actions and does not restrict access. Therefore, D, Confidentiality, is the correct answer.
Play from 29:53 Question 21. A court wants proof that a particular employee wrote and sent a contract amendment, and that the employee cannot later deny it. Which security concept supplies this? Here are the options. Option A. Access logs. Option B. Authentication. Option C. Adaptive identity. Option D. Non-repudiation. Pause the video now if you want time to think about the answer.
The correct answer is D. Non-repudiation. Non-repudiation, usually delivered through digital signatures, ties a message to one person and stops that person from denying having sent it. Logging in proves identity at one moment, and logs just record events, so neither gives the same binding proof. Now, why are the other options incorrect? Option A is incorrect. Access logs record activity but are records, not a principle that stops denial of a message. Option B is incorrect. Authentication confirms who someone is at login but does not stop them from later disowning a message. Option C is incorrect. Adaptive identity adjusts verification based on context and has no role in attributing messages. Therefore, D, Non-repudiation, is the correct answer.
Play from 31:22 Question 22. A cafe wants only paying guests to get online, by asking them to type the code printed on their receipt before the network lets them through. Which solution fits best? Here are the options. Option A. IEEE 802.1X. Option B. PSK. Option C. Captive portal. Option D. WPA3. Pause the video now if you want time to think about the answer.
The correct answer is C. Captive portal. A captive portal intercepts new wireless users and shows a web page where they must enter something, such as a receipt code, before access is granted. The other choices are encryption or enterprise login methods that cannot check a receipt. Now, why are the other options incorrect? Option A is incorrect. 802.1X is an enterprise authentication framework needing a backend server and credentials, which is far too heavy for this need. Option B is incorrect. A pre-shared key gives every user the same password, so paying and non-paying visitors can't be told apart. Option D is incorrect. WPA3 protects wireless traffic with encryption but doesn't ask for a receipt code. Therefore, C, Captive portal, is the correct answer.
Play from 32:57 Question 23. A global enterprise wants to cut the cost of keeping investigation data. Which kind of data is the best candidate for a shorter retention period because of its huge storage footprint? Here are the options. Option A. Operating system security logs. Option B. Vulnerability scan results. Option C. Full packet captures. Option D. Logs from endpoint agents. Pause the video now if you want time to think about the answer.
The correct answer is C. Full packet captures. Full packet captures consume enormous amounts of storage and are mostly valuable shortly after an event, so keeping them for less time saves the most money. The other items are small and keep their value for audits and long-term trend work. Now, why are the other options incorrect? Option A is incorrect. Operating system security logs are compact and useful for later investigations and compliance. Option B is incorrect. Scan results show remediation progress over time and are small to store. Option D is incorrect. Endpoint logs are modest in size and often needed to trace activity from long ago. Therefore, C, Full packet captures, is the correct answer.
Play from 34:27 Question 24. Which task relies on open-source intelligence? Here are the options. Option A. Studying internal server logs. Option B. Gathering public details on staff and company structure to plan a social engineering test. Option C. Producing indicators of compromise from a malware sample. Option D. Collecting proof of malicious activity during an incident. Pause the video now if you want time to think about the answer.
The correct answer is B. Gathering public details on staff and company structure to plan a social engineering test. Open-source intelligence means collecting information that is publicly available, such as names, roles and social media posts. A social engineering test uses exactly that kind of material to build convincing pretexts. The other tasks work with internal or captured data. Now, why are the other options incorrect? Option A is incorrect. Server logs are internal data and not publicly available. Option C is incorrect. Indicators of compromise come from analyzing malware and threat data rather than public sources. Option D is incorrect. Evidence collection during an incident is based on internal systems and forensic work. Therefore, B, Gathering public details on staff and company structure to plan a social engineering test, is the correct answer.
Play from 36:08 Question 25. A company worries that one of its own employees might walk into the on-premises server room without permission. Which control best addresses this? Here are the options. Option A. Motion sensor. Option B. Video surveillance. Option C. Bollards. Option D. Access badge. Pause the video now if you want time to think about the answer.
The correct answer is D. Access badge. A badge reader checks and authorizes each person before the door opens and logs who entered, so it stops unapproved staff. Cameras and sensors only record or alert, and bollards stop vehicles rather than people. Now, why are the other options incorrect? Option A is incorrect. Motion sensors detect movement but do not block entry. Option B is incorrect. Cameras record what happened and may deter, but they do not stop someone from entering. Option C is incorrect. Bollards stop vehicles from reaching the building and do not control who walks in. Therefore, D, Access badge, is the correct answer.
Play from 37:29 Question 26. A hospital network is building a public web app that people use to submit urgent medical reports. Which factor should come first when designing it? Here are the options. Option A. Low cost of development. Option B. Simple rollout. Option C. Being up and reachable whenever someone needs it. Option D. Ability to grow with demand. Pause the video now if you want time to think about the answer.
The correct answer is C. Being up and reachable whenever someone needs it. For an emergency reporting service, being reachable at all times matters most, since an outage could delay urgent help. Growth, price and easy rollout are useful but come second to uptime. Now, why are the other options incorrect? Option A is incorrect. Cost matters to the business but should never outweigh keeping a life-critical service running. Option B is incorrect. A simple rollout helps developers, but it is less important than uptime during emergencies. Option D is incorrect. Scaling with demand helps, but it is secondary to the service being reachable. Therefore, C, Being up and reachable whenever someone needs it, is the correct answer.
Play from 38:50 Question 27. Which cryptographic measure keeps stored data on a laptop drive unreadable if the drive is removed? Here are the options. Option A. Steganography. Option B. Digital signature. Option C. Whole-drive encryption. Option D. Private key. Pause the video now if you want time to think about the answer.
The correct answer is C. Whole-drive encryption. Encrypting the entire drive scrambles everything stored on it, so a removed disk cannot be read without the key. The other options verify authorship, hide data or are only parts of a cryptosystem. Now, why are the other options incorrect? Option A is incorrect. Steganography hides data inside other files without encrypting it. Option B is incorrect. A digital signature proves who created data and that it was not changed, but it does not hide the contents. Option D is incorrect. A private key is a component used in cryptography and does not by itself secure the stored data. Therefore, C, Whole-drive encryption, is the correct answer.
Play from 40:11 Question 28. Every PC and server in an office shows a payment demand, and the documents on them now carry an odd new file ending. What type of malware is most likely involved? Here are the options. Option A. Spyware. Option B. Ransomware. Option C. Trojan. Option D. Virus. Pause the video now if you want time to think about the answer.
The correct answer is B. Ransomware. Encrypting files, renaming them with a new ending and showing a payment note is the signature behavior of ransomware. The other categories do not typically produce a demand message on every machine. Now, why are the other options incorrect? Option A is incorrect. Spyware quietly watches activity and steals data and does not lock files. Option C is incorrect. A Trojan hides inside apparently useful software, but that alone does not mean files are renamed and a payment is demanded. Option D is incorrect. A virus spreads by attaching to files but does not normally show a ransom note. Therefore, B, Ransomware, is the correct answer.
Play from 41:35 Question 29. A reviewer found servers with several risky open ports and some outdated protocols still switched on. Which tool most likely revealed this? Here are the options. Option A. Wireshark. Option B. netcat. Option C. Nessus. Option D. curl. Pause the video now if you want time to think about the answer.
The correct answer is C. Nessus. Nessus is a vulnerability scanner that probes hosts for open ports, weak services and legacy protocols, then reports them. The other tools move or capture data and are not built to assess a whole server for exposure. Now, why are the other options incorrect? Option A is incorrect. Wireshark captures and inspects traffic, and does not scan servers for exposure. Option B is incorrect. netcat opens simple network connections and is not a vulnerability assessment tool. Option D is incorrect. curl transfers data using URLs and does not audit hosts. Therefore, C, Nessus, is the correct answer.
Play from 42:55 Question 30. A marketing employee with bad intentions edited financial entries and moved company money to a private account. What is the best way to protect those records in future? Here are the options. Option A. Hashing. Option B. Input validation. Option C. Limiting which accounts may change them. Option D. Network ACL entries. Pause the video now if you want time to think about the answer.
The correct answer is C. Limiting which accounts may change them. The abuse worked because a user outside finance had the right to alter and move funds. Restricting permissions by role, following least privilege, removes that ability. Hashing only detects tampering afterward and validation targets malformed input. Now, why are the other options incorrect? Option A is incorrect. Hashing could reveal that the records changed afterward but would not stop an account with write access. Option B is incorrect. Input validation stops malformed data such as injection strings, not a user misusing legitimate access. Option D is incorrect. Network access lists filter traffic between hosts and do not set which users may edit records. Therefore, C, Limiting which accounts may change them, is the correct answer.
Play from 44:30 Question 31. An internal auditor begins reviewing a company's risk management program. What should be examined first? Here are the options. Option A. Business impact analysis. Option B. Vulnerability assessment. Option C. The documented governance rules and operating steps. Option D. Asset inventory. Pause the video now if you want time to think about the answer.
The correct answer is C. The documented governance rules and operating steps. The documented policies and procedures define what the program is supposed to do, so they are the baseline against which actual practice is later compared. The other items are activities that follow from them. Now, why are the other options incorrect? Option A is incorrect. A business impact analysis is a working tool that should align with the policies, so it is checked afterward. Option B is incorrect. A vulnerability assessment is an implementation activity reviewed after the rules are understood. Option D is incorrect. The asset inventory is reviewed after the policies that govern it are known. Therefore, C, The documented governance rules and operating steps, is the correct answer.
Play from 45:55 Question 32. A software vendor is about to deliver its proprietary program to a client and wants to make it hard to copy the underlying logic. What helps most? Here are the options. Option A. Blockchain. Option B. Code signing. Option C. Obfuscation. Option D. Tokenization. Pause the video now if you want time to think about the answer.
The correct answer is C. Obfuscation. Obfuscation rewrites code so it still works but is very hard to read or reverse engineer, which shields the intellectual property. The other choices prove authenticity, record transactions or replace data values. Now, why are the other options incorrect? Option A is incorrect. A blockchain is a shared ledger and does not hide program logic. Option B is incorrect. Code signing proves who published the code and that it was unchanged, but the logic remains readable. Option D is incorrect. Tokenization substitutes sensitive data values and is not meant to protect source code. Therefore, C, Obfuscation, is the correct answer.
Play from 47:17 Question 33. A business fears that a storm could wreck its single server room and halt operations. What should it consider? Here are the options. Option A. Load balancers. Option B. Off-site backups. Option C. Geographic dispersion. Option D. Server clustering. Pause the video now if you want time to think about the answer.
The correct answer is C. Geographic dispersion. Spreading systems over several distant locations means a storm at one site does not take everything offline. Clustering and balancing in one room don't help against local damage, and backups help recovery rather than avoid downtime. Now, why are the other options incorrect? Option A is incorrect. Load balancers spread traffic but do nothing if every server sits in the damaged room. Option B is incorrect. Off-site backups preserve data but do not keep services running while the room is down. Option D is incorrect. Clustering inside one room gives failover for hardware faults but not for site-wide damage. Therefore, C, Geographic dispersion, is the correct answer.
Play from 48:41 Question 34. A firm designing a disaster recovery plan must make sure one earthquake cannot wipe out all copies of its regulated backups. What should it consider? Here are the options. Option A. Hot site. Option B. Load balancing. Option C. Geographic dispersion. Option D. Platform diversity. Pause the video now if you want time to think about the answer.
The correct answer is C. Geographic dispersion. Keeping backup copies in widely separated locations means a regional disaster cannot destroy them all. The other choices cover standby facilities, traffic sharing or varied technology, none of which guarantee separation. Now, why are the other options incorrect? Option A is incorrect. A hot site is a standby facility, but it may be in the same area and hit by the same event. Option B is incorrect. Load balancing shares traffic between servers and does not protect backup copies. Option D is incorrect. Platform diversity mixes different technologies and does not separate locations. Therefore, C, Geographic dispersion, is the correct answer.
Play from 50:10 Question 35. Why would a security team schedule a tabletop exercise? Here are the options. Option A. To figure out the return on investment. Option B. To refresh the incident response plan based on what the discussion uncovers. Option C. To fulfill an auditor's open findings. Option D. To gather measurements of how long fixes take. Pause the video now if you want time to think about the answer.
The correct answer is B. To refresh the incident response plan based on what the discussion uncovers. A tabletop exercise is a talk-through of an incident scenario that exposes gaps, so the main payoff is improving the incident response plan. Other benefits may follow, but they are not the central purpose. Now, why are the other options incorrect? Option A is incorrect. Return on investment is a financial measure and is unrelated to testing a response plan. Option C is incorrect. Closing audit findings is a separate remediation job, not the reason for a discussion exercise. Option D is incorrect. Timing data may be noted, but a tabletop exercise isn't designed to collect repair metrics. Therefore, B, To refresh the incident response plan based on what the discussion uncovers, is the correct answer.
Play from 51:44 Question 36. Employees carry company phones that could be lost. Which technology makes sure a finder cannot read the phone's stored data? Here are the options. Option A. HSM. Option B. FDE. Option C. TPM. Option D. ECC. Pause the video now if you want time to think about the answer.
The correct answer is B. FDE. Full-disk encryption scrambles everything on the storage, so without the key or passcode the data stays unreadable even with physical possession of the device. The other options are a key store, a chip or an algorithm. Now, why are the other options incorrect? Option A is incorrect. A hardware security module manages keys in data centers and is not a phone protection feature. Option C is incorrect. A TPM stores keys and supports encryption but is not itself the drive encryption solution. Option D is incorrect. ECC is an algorithm family and not a standalone way to protect a drive. Therefore, B, FDE, is the correct answer.
Play from 53:06 Question 37. Before a security consultant begins testing a client's network, a document must spell out what is allowed, the schedule and whom to contact. What is it called? Here are the options. Option A. Rules of execution. Option B. Rules of engagement. Option C. Rules of acceptance. Option D. Rules of understanding. Pause the video now if you want time to think about the answer.
The correct answer is B. Rules of engagement. The rules of engagement are the agreed limits for a penetration test: scope, timing, permitted methods and contacts. This is the standard industry term, and the other phrases are not used that way. Now, why are the other options incorrect? Option A is incorrect. Rules of execution is not the recognized name for the testing agreement. Option C is incorrect. Rules of acceptance deal with criteria for accepting a deliverable, not conduct during a test. Option D is incorrect. Rules of understanding is not a standard penetration testing term. Therefore, B, Rules of engagement, is the correct answer.
Play from 54:29 Question 38. Which of the following weaknesses is specific to hardware devices? Here are the options. Option A. Cross-site scripting. Option B. SQL injection. Option C. Out-of-date firmware. Option D. Buffer overflow. Pause the video now if you want time to think about the answer.
The correct answer is C. Out-of-date firmware. Firmware is the low-level code that runs a device, so an outdated or flawed version is a weakness tied to the hardware itself. The other choices are software flaws that occur in applications across many platforms. Now, why are the other options incorrect? Option A is incorrect. Cross-site scripting is a web application flaw. Option B is incorrect. SQL injection affects databases and applications, not hardware. Option D is incorrect. A buffer overflow is a programming error in software. Therefore, C, Out-of-date firmware, is the correct answer.
Play from 55:42 Question 39. Reviewing logs, an analyst sees that attackers have been injecting commands through web forms. Which control would best deal with this? Here are the options. Option A. Secure cookies. Option B. Authentication. Option C. Checking and filtering all submitted data. Option D. Static code analysis. Pause the video now if you want time to think about the answer.
The correct answer is C. Checking and filtering all submitted data. Validating and sanitizing every value that users submit stops hostile input from being treated as commands, which addresses injection at its source. The other controls protect sessions, confirm identity or find flaws before release. Now, why are the other options incorrect? Option A is incorrect. Secure cookies protect session data and do not stop injected commands. Option B is incorrect. Authentication confirms who a user is and does not filter malicious input. Option D is incorrect. Static code analysis helps find flaws during development but doesn't protect a running application. Therefore, C, Checking and filtering all submitted data, is the correct answer.
Play from 57:13 Question 40. A company blocks admin laptops from connecting straight to the subnet that holds its databases. How should an administrator reach those servers? Here are the options. Option A. Load balancer. Option B. HSM. Option C. RADIUS. Option D. Jump server. Pause the video now if you want time to think about the answer.
The correct answer is D. Jump server. A jump server is a hardened, monitored host that sits between the admin network and the restricted segment, so administrators connect through it and their activity is controlled and logged. The other tools do not provide that access path. Now, why are the other options incorrect? Option A is incorrect. A load balancer distributes client traffic and is not an administrative gateway. Option B is incorrect. A hardware security module protects cryptographic keys and does not route admin access. Option C is incorrect. RADIUS handles authentication and does not give a path into a restricted segment. Therefore, D, Jump server, is the correct answer.
Play from 58:36 Question 41. A cloud team keeps the scripts that build its virtual machines and wants a record of every edit to them. Which tool should it adopt? Here are the options. Option A. Collaboration platform. Option B. Version control tool. Option C. Behavioral analyzer. Option D. Ticketing system for approvals. Pause the video now if you want time to think about the answer.
The correct answer is B. Version control tool. A version control system stores every revision of the build scripts, showing who changed what and when, which gives a full audit trail of code changes. The other tools handle chat, approvals or monitoring, not tracking edits to files. Now, why are the other options incorrect? Option A is incorrect. A collaboration platform supports team communication and does not record changes to code files. Option C is incorrect. A behavioral analyzer watches how systems act and does not track code edits. Option D is incorrect. An approval ticketing system manages request workflows, but it doesn't keep line-by-line change history. Therefore, B, Version control tool, is the correct answer.
Play from 1:00:04 Question 42. A bank wants to replace account numbers in its systems with stand-in values that are useless to thieves yet still usable by applications. Which solution is commonly used? Here are the options. Option A. Steganography. Option B. Tokenization. Option C. Salting. Option D. Hashing. Pause the video now if you want time to think about the answer.
The correct answer is B. Tokenization. Tokenization substitutes sensitive values with surrogate tokens that keep the same role in applications but hold no exploitable meaning, and it is widely used in finance. The other options hide data in media, add randomness to hashes or irreversibly transform values. Now, why are the other options incorrect? Option A is incorrect. Steganography hides data inside other media and isn't a practical way to protect account numbers. Option C is incorrect. Salting adds random data to hash input and does not substitute stored values. Option D is incorrect. Hashing is irreversible, so applications can't recover the original value when they need it. Therefore, B, Tokenization, is the correct answer.
Play from 1:01:30 Question 43. A logging system accidentally writes full card numbers to its output. Which technique would hide most of the digits in those entries? Here are the options. Option A. Hashing. Option B. Masking. Option C. Tokenization. Option D. Obfuscation. Pause the video now if you want time to think about the answer.
The correct answer is B. Masking. Masking replaces part of a value, for example with asterisks, so the log still shows a recognizable format without exposing the full number. It is the usual technique for hiding sensitive fields in logs and displays. Now, why are the other options incorrect? Option A is incorrect. Hashing turns a value into a fixed digest and is unsuitable when staff need to see part of the number. Option C is incorrect. Tokenization swaps values for tokens within payment systems, but it is not the typical way to hide digits in log files. Option D is incorrect. Obfuscation is a general term for making something unclear and is less specific than masking. Therefore, B, Masking, is the correct answer.
Play from 1:02:56 Question 44. A new public web server is nearly ready for launch. Which task should the security team complete first? Here are the options. Option A. Set up web application firewall rules. Option B. Switch on network-based intrusion detection. Option C. Lock down the host's configuration. Option D. Roll out the patch management process. Pause the video now if you want time to think about the answer.
The correct answer is C. Lock down the host's configuration. Hardening the host removes needless services and accounts and sets a secure baseline, so it comes before layering other protections on top. Firewall rules, detection and the ongoing patch routine build on that foundation. Now, why are the other options incorrect? Option A is incorrect. Firewall rules for web traffic are layered on after the system is hardened. Option B is incorrect. Intrusion detection is configured once the server is secured and running. Option D is incorrect. Patching is an ongoing routine, and hardening is the foundation step that comes before it. Therefore, C, Lock down the host's configuration, is the correct answer.
Play from 1:04:22 Question 45. A retailer owns shop.example.com, and criminals register shop.examp1e.com to catch people who mistype or misread the address. What is this attack called? Here are the options. Option A. On-path. Option B. Watering-hole. Option C. Brand impersonation. Option D. Typosquatting. Pause the video now if you want time to think about the answer.
The correct answer is D. Typosquatting. Typosquatting means registering a domain that is a slight misspelling or lookalike of a real one so that visitors land on it by mistake. The other attacks involve intercepting traffic, infecting a trusted site or posing as a brand in general. Now, why are the other options incorrect? Option A is incorrect. An on-path attack intercepts communications between two parties and doesn't involve registering a lookalike domain. Option B is incorrect. A watering-hole attack compromises a site that victims already visit. Option C is incorrect. Brand impersonation is a broader category, and this scenario specifically hinges on a misspelled address. Therefore, D, Typosquatting, is the correct answer.
Play from 1:05:47 Question 46. An organization wants to confirm that its backup recovery site will really work and that its data is intact. What is the most reliable way? Here are the options. Option A. Run a live failover test to the recovery site. Option B. Hold a discussion-only exercise. Option C. Write encryption requirements for databases. Option D. Test the backup generators on a schedule. Pause the video now if you want time to think about the answer.
The correct answer is A. Run a live failover test to the recovery site. Actually switching operations to the recovery site proves that systems start, data is usable and services run, which no discussion can show. Generator checks, planning meetings and encryption specifications each cover just a small part. Now, why are the other options incorrect? Option B is incorrect. A discussion-only exercise reviews plans but doesn't prove the systems or data work. Option C is incorrect. Writing encryption requirements addresses protection, not whether the site can take over. Option D is incorrect. Generator tests confirm backup power only and say nothing about data or application recovery. Therefore, A, Run a live failover test to the recovery site, is the correct answer.
Play from 1:07:29 Question 47. A team moves its applications into containers hoping to improve security. Which characteristic of the software would most undermine that goal? Here are the options. Option A. The available kernel release. Option B. A single large codebase built as one block. Option C. The timing of vendor patches. Option D. Industry rules that apply. Pause the video now if you want time to think about the answer.
The correct answer is B. A single large codebase built as one block. Containers work best with small, modular components that can be isolated and updated independently. A large single-block application loses most of those benefits when it is simply placed in a container. The other factors can be managed within a container setup. Now, why are the other options incorrect? Option A is incorrect. The kernel release is a technical setting that can be handled in container environments. Option C is incorrect. Patch timing is not a blocker, and containers can actually simplify updates. Option D is incorrect. Compliance requirements can be met through container configuration and policy. Therefore, B, A single large codebase built as one block, is the correct answer.
Play from 1:09:03 Question 48. Why would a data protection officer build a catalog of all the personal data an organization holds and where it lives? Here are the options. Option A. To reduce duplicated records automatically. Option B. To allow records to be kept longer. Option C. To free up disk space. Option D. To gauge the consequences if a breach occurs. Pause the video now if you want time to think about the answer.
The correct answer is D. To gauge the consequences if a breach occurs. Knowing what data exists and where it is stored lets the organization understand how serious a breach would be and who would be affected, which supports compliance and risk work. The other choices are IT housekeeping or even contrary to privacy goals. Now, why are the other options incorrect? Option A is incorrect. Removing duplicates is a technical tidy-up task, not the officer's main purpose. Option B is incorrect. Retention limits come from law and policy, and an inventory does not extend them. Option C is incorrect. Storage management is an operations matter rather than a privacy responsibility. Therefore, D, To gauge the consequences if a breach occurs, is the correct answer.
Play from 1:10:33 Question 49. A facilities manager wants to count how many employees enter the building each day so access rules can be tuned. Which control type serves this need? Here are the options. Option A. Directive. Option B. Corrective. Option C. Detective. Option D. Preventive. Pause the video now if you want time to think about the answer.
The correct answer is C. Detective. Counting and observing entries is monitoring after the fact, which is what detective controls do. The data collected can later guide preventive controls, but gathering it is itself a detective activity. Now, why are the other options incorrect? Option A is incorrect. Directive controls instruct or guide behavior, such as through policy, and don't measure anything. Option B is incorrect. Corrective controls repair damage after an incident and do not count entries. Option D is incorrect. Preventive controls block unwanted access before it happens and do not report on traffic. Therefore, C, Detective, is the correct answer.
Play from 1:11:55 Question 50. Which kind of exercise can a company run to sharpen how it handles security incidents without touching live systems? Here are the options. Option A. Failover. Option B. Tabletop. Option C. Recovery. Option D. Replication. Pause the video now if you want time to think about the answer.
The correct answer is B. Tabletop. A tabletop exercise has the team discuss a made-up incident step by step, revealing gaps in the response process and training people at the same time. The other choices are technical operations, not training exercises. Now, why are the other options incorrect? Option A is incorrect. Failover is a system switch to standby equipment, not a discussion exercise. Option C is incorrect. Recovery is the operational work of restoring services, not a process improvement exercise. Option D is incorrect. Replication copies data between systems and is not an exercise at all. Therefore, B, Tabletop, is the correct answer.
Play from 1:13:13 Question 51. A teenager with little experience scrawls graffiti on a famous band's website just for attention. Which kind of threat actor does this most resemble? Here are the options. Option A. Nation-state. Option B. Insider threat. Option C. Unskilled attacker. Option D. Organized crime. Pause the video now if you want time to think about the answer.
The correct answer is C. Unskilled attacker. Defacing a well-known site needs little skill and is mostly about notoriety or bragging, which fits an unskilled attacker. The other actors pursue profit, state goals or have trusted access they would use for more valuable ends. Now, why are the other options incorrect? Option A is incorrect. Nation-states pursue geopolitical aims and espionage and have no interest in celebrity site pranks. Option B is incorrect. Insiders have privileged access and would more likely target valuable internal assets. Option D is incorrect. Organized crime seeks financial gain, not publicity from defacement. Therefore, C, Unskilled attacker, is the correct answer.
Play from 1:14:41 Question 52. Which attacker type is most likely to strike an organization because of deeply held convictions? Here are the options. Option A. Organized crime. Option B. Insider threat. Option C. Nation-state. Option D. Hacktivist. Pause the video now if you want time to think about the answer.
The correct answer is D. Hacktivist. Hacktivists attack to promote a cause or protest what they see as wrong, so belief is their defining motivation. Other attacker types are primarily driven by money, state goals or varied personal reasons. Now, why are the other options incorrect? Option A is incorrect. Organized crime is driven by profit. Option B is incorrect. Insiders can have many motives, such as revenge or coercion, but beliefs do not define them. Option C is incorrect. Nation-states act on geopolitical and security interests. Therefore, D, Hacktivist, is the correct answer.
Play from 1:16:00 Question 53. A change request affecting how a system is designed must pass several checks first to avoid creating security problems. Which of these is likely among those checks? Here are the options. Option A. A plan for reverting the change. Option B. Restarting the service. Option C. A scheduled maintenance task. Option D. A review by the board of directors. Pause the video now if you want time to think about the answer.
The correct answer is A. A plan for reverting the change. A backout plan sets out how to return to the previous safe state if the change causes trouble, and it is prepared before the change is made. Restarting and maintenance happen during or after implementation, and board sign-off is not part of normal change checks. Now, why are the other options incorrect? Option B is incorrect. Restarting a service is an operational action carried out during implementation, not a pre-change check. Option C is incorrect. Maintenance is a general activity that takes place after the change is in place. Option D is incorrect. Board reviews are a governance matter and not a routine change-management step. Therefore, A, A plan for reverting the change, is the correct answer.
Play from 1:17:33 Question 54. A firm is setting up a secondary data center. Cost is the priority, and it can live with roughly two days of downtime and data loss. Which site type is the best match? Here are the options. Option A. Warm site. Option B. Cold site. Option C. Hot site. Option D. Real-time mirrored site. Pause the video now if you want time to think about the answer.
The correct answer is B. Cold site. A cold site is the cheapest option, being mostly empty space that must be equipped before use, and two days of recovery time makes that acceptable. More active sites cost more than this requirement justifies. Now, why are the other options incorrect? Option A is incorrect. A warm site recovers faster but costs more than a two-day target demands. Option C is incorrect. A hot site is fully ready and expensive, which is unnecessary here. Option D is incorrect. A site mirrored in real time is the costliest choice and far exceeds the stated need. Therefore, B, Cold site, is the correct answer.
Play from 1:18:56 Question 55. Security staff suspect a workstation is talking to an attacker's command-and-control server. Which two log sources would best help find the infected host? (Choose two.) Here are the options. Option A. Database. Option B. Firewall. Option C. DHCP. Option D. Application. Option E. Authentication. Option F. Network traffic. Pause the video now if you want time to think about the answer.
The correct answers are B. Firewall, and F. Network traffic. Firewall and network traffic records show which internal machines connected to the malicious server, so they point straight to the infected host. The other logs describe logins, data access, application events or address assignments. Now, why are the other options incorrect? Option A is incorrect. Database logs track queries and transactions, not outbound connections to attackers. Option C is incorrect. DHCP logs show which address was assigned but not who talked to the control server. Option D is incorrect. Application logs record events inside software, not network connections. Option E is incorrect. Authentication logs capture sign-in activity rather than outbound communication patterns. Therefore, B and F are the correct answers.
Play from 1:20:35 Question 56. A customer needs its hosted security provider to guarantee 99.99 percent availability. Which document should state that commitment? Here are the options. Option A. MOU. Option B. SLA. Option C. MOA. Option D. SOW. Pause the video now if you want time to think about the answer.
The correct answer is B. SLA. A service level agreement lists measurable commitments, such as availability percentages, and the remedies if they are missed. The other documents describe general understandings or the scope of work rather than performance guarantees. Now, why are the other options incorrect? Option A is incorrect. A memorandum of understanding is a preliminary statement of intent without detailed technical terms. Option C is incorrect. A memorandum of agreement records a general arrangement and doesn't normally list uptime metrics. Option D is incorrect. A statement of work defines the tasks to be done, not ongoing service level guarantees. Therefore, B, SLA, is the correct answer.
Play from 1:21:58 Question 57. While investigating an incident, an engineer finds a web request that repeats parent-directory sequences many times to reach the system password file. Which attack does this indicate? Here are the options. Option A. Brute force. Option B. Credential replay. Option C. Privilege escalation. Option D. Directory traversal. Pause the video now if you want time to think about the answer.
The correct answer is D. Directory traversal. Chaining parent-directory sequences to climb out of the web root and read system files is a directory traversal attack. It abuses weak input handling to reach files that should not be served. Now, why are the other options incorrect? Option A is incorrect. Brute force repeatedly guesses passwords or keys, which isn't what the request shows. Option B is incorrect. Credential replay reuses captured login data and doesn't manipulate file paths. Option C is incorrect. Privilege escalation raises account rights and does not involve climbing directories. Therefore, D, Directory traversal, is the correct answer.
Play from 1:23:27 Question 58. A contractor builds a critical system for a government agency and keeps the project files on a network share. Which two classification labels would most likely apply to those files? (Choose two.) Here are the options. Option A. Operational. Option B. Restricted. Option C. Public. Option D. Private. Option E. Confidential. Option F. Urgent. Pause the video now if you want time to think about the answer.
The correct answers are B. Restricted, and E. Confidential. Government project files for a critical system are sensitive, so they would be labeled with the higher classification levels, confidential and restricted. Public does not fit, and operational and urgent are not classification levels at all. Now, why are the other options incorrect? Option A is incorrect. Operational describes function, not a classification level. Option C is incorrect. Public would allow anyone to see the data, which is wrong for government work. Option D is incorrect. Private usually refers to personal information and does not match project data. Option F is incorrect. Urgent describes priority and not how sensitive the data is. Therefore, B and E are the correct answers.
Play from 1:24:58 Question 59. Following a ransomware infection, an administrator goes through system logs to understand what happened. Which type of control is this activity? Here are the options. Option A. Corrective. Option B. Compensating. Option C. Preventive. Option D. Detective. Pause the video now if you want time to think about the answer.
The correct answer is D. Detective. Examining logs to find out what already happened is a detective activity, because it identifies and documents events after they occur. It does not stop the event or repair damage. Now, why are the other options incorrect? Option A is incorrect. Corrective controls fix or restore systems after an incident. Option B is incorrect. Compensating controls stand in when the primary control cannot be used. Option C is incorrect. Preventive controls act before an event to stop it. Therefore, D, Detective, is the correct answer.
Play from 1:26:10 Question 60. Monitoring shows an employee signing in from home at night and copying a large volume of files to a private USB drive. What best describes this? Here are the options. Option A. Phishing campaign. Option B. Penetration testing. Option C. Insider threat. Option D. External audit. Pause the video now if you want time to think about the answer.
The correct answer is C. Insider threat. A trusted user misusing legitimate access to take data is an insider threat. The other options would be a scam from outside, an authorized security test or a planned review, none of which match a worker quietly copying files. Now, why are the other options incorrect? Option A is incorrect. A phishing campaign is a deceptive message aimed at users, not data copying by an authorized account. Option B is incorrect. Penetration testing is authorized and scheduled, which this behavior is not. Option D is incorrect. An external audit is a planned, open review process, not covert file copying. Therefore, C, Insider threat, is the correct answer.
Play from 1:27:36 Question 61. A technician is opening firewall ports so a new system, which a software-as-a-service vendor will host and support, can go live. Which risk does this arrangement introduce? Here are the options. Option A. Flat network with no segments. Option B. Dependence on an outside vendor. Option C. Unchanged factory passwords. Option D. Flawed software code. Pause the video now if you want time to think about the answer.
The correct answer is B. Dependence on an outside vendor. Relying on a SaaS provider means inheriting the risks of that vendor's security practices, its infrastructure and its access to company data, which is a supply chain risk. The other items are general weaknesses not tied to the vendor relationship. Now, why are the other options incorrect? Option A is incorrect. A flat network is a general design weakness and is not specific to using a hosted provider. Option C is incorrect. Factory passwords are a risk in many systems but the scenario points to the vendor relationship. Option D is incorrect. Software flaws are a common risk but do not characterize what a hosted vendor brings. Therefore, B, Dependence on an outside vendor, is the correct answer.
Play from 1:29:07 Question 62. A firm must make sure that stored sensitive files cannot be read by anyone who obtains the disks. Which technique should it choose? Here are the options. Option A. Tokenization. Option B. Network segmentation. Option C. Encryption. Option D. Hashing. Pause the video now if you want time to think about the answer.
The correct answer is C. Encryption. Encryption turns stored data into ciphertext that only holders of the proper key can reverse, so a stolen disk reveals nothing. The other options are one-way digests, value substitution or network isolation. Now, why are the other options incorrect? Option A is incorrect. Tokenization replaces values with surrogates and is not the general method for making stored files unreadable. Option B is incorrect. Segmentation separates networks and doesn't protect data sitting on a disk. Option D is incorrect. Hashing is one-way and meant for integrity checks, so files could not be read again. Therefore, C, Encryption, is the correct answer.
Play from 1:30:32 Question 63. Which of these is an example of a physical control that stops intrusion rather than just noticing it? Here are the options. Option A. Alarm system. Option B. Motion detectors. Option C. Surveillance cameras. Option D. Bollards. Pause the video now if you want time to think about the answer.
The correct answer is D. Bollards. Bollards are solid barriers that physically block vehicles from reaching a building, so they prevent an intrusion from happening. The other devices only watch for or announce an event once it is under way. Now, why are the other options incorrect? Option A is incorrect. An alarm announces a break-in after it begins and doesn't block it. Option B is incorrect. Motion detectors sense movement but can't physically stop anyone. Option C is incorrect. Cameras record and deter but do not prevent entry. Therefore, D, Bollards, is the correct answer.
Play from 1:31:44 Question 64. A web attacker sends a form entry stuffed with unusual characters, hoping to trick the back end into returning data it should not. What is the attack? Here are the options. Option A. SQL injection. Option B. Resource reuse. Option C. Side loading. Option D. Target of evaluation. Pause the video now if you want time to think about the answer.
The correct answer is A. SQL injection. Feeding specially crafted characters into an input so that the database interprets them as commands is SQL injection, and it can expose data from the systems behind the form. The other choices are not injection attacks. Now, why are the other options incorrect? Option B is incorrect. Resource reuse concerns how freed resources are reassigned and is not an attack on input handling. Option C is incorrect. Side loading means installing apps from outside the official store. Option D is incorrect. Target of evaluation is a Common Criteria term for the system being assessed. Therefore, A, SQL injection, is the correct answer.
Play from 1:33:08 Question 65. After a warning about a zero-day exploit, an analyst puts a bastion host in front of the vulnerable systems, since no patch exists yet. What kind of control is this? Here are the options. Option A. Physical. Option B. Operational. Option C. Compensating. Option D. Detective. Pause the video now if you want time to think about the answer.
The correct answer is C. Compensating. With no patch available, an alternative safeguard is added to offset the weakness, which is a compensating control. The other types are about buildings, human procedures or spotting events after the fact. Now, why are the other options incorrect? Option A is incorrect. Physical controls protect facilities and equipment, not software exploits. Option B is incorrect. Operational controls are procedures carried out by people and not a technical stopgap. Option D is incorrect. Detective controls spot events but do not reduce exposure ahead of time. Therefore, C, Compensating, is the correct answer.
Play from 1:34:26 Question 66. Which weakness lets users put apps on a phone from places other than the official marketplace? Here are the options. Option A. Buffer overflow. Option B. Cross-site scripting. Option C. Side loading. Option D. Jailbreaking. Pause the video now if you want time to think about the answer.
The correct answer is C. Side loading. Side loading is installing software outside the sanctioned app store, which skips the vetting and checks that store performs. Jailbreaking removes operating system limits more broadly, and the other two are code flaws. Now, why are the other options incorrect? Option A is incorrect. A buffer overflow is a memory corruption flaw in running code, not an installation route. Option B is incorrect. Cross-site scripting injects scripts into web pages and has nothing to do with app installation. Option D is incorrect. Jailbreaking strips system restrictions to gain elevated control and is not specifically about install sources. Therefore, C, Side loading, is the correct answer.
Play from 1:35:48 Question 67. An IT admin must hand a departed worker's laptop to a new hire. Which two data handling actions fit best? (Choose two.) Here are the options. Option A. Certification. Option B. Retention. Option C. Enumeration. Option D. Sanitization. Option E. Destruction. Option F. Classification. Pause the video now if you want time to think about the answer.
The correct answers are A. Certification, and D. Sanitization. The old data has to be wiped, which is sanitization, and the wipe should be documented as complete, which is certification. Keeping, destroying or sorting the data would not make the machine safe to reissue. Now, why are the other options incorrect? Option B is incorrect. Retention means keeping data, whereas the machine needs to be cleaned. Option C is incorrect. Enumeration lists items and is not a data handling action for reissuing a device. Option E is incorrect. Destruction is for hardware that is being retired and not reused. Option F is incorrect. Classification labels data by sensitivity but doesn't remove it. Therefore, A and D are the correct answers.
Play from 1:37:20 Question 68. A network engineer is about to install new firmware on a core router. What should the engineer follow? Here are the options. Option A. Risk tolerance. Option B. Maintenance window. Option C. Certificate signing request. Option D. A formal process for building new applications. Pause the video now if you want time to think about the answer.
The correct answer is B. Maintenance window. A maintenance window is the agreed time slot for changes such as firmware upgrades, so disruption is kept low and people are informed. The other items are a development method, a risk attitude or a certificate request. Now, why are the other options incorrect? Option A is incorrect. Risk tolerance describes how much risk is acceptable and is not a step in doing the upgrade. Option C is incorrect. A certificate signing request relates to getting a certificate and not to firmware. Option D is incorrect. The software development life cycle governs building software, not applying a router update. Therefore, B, Maintenance window, is the correct answer.
Play from 1:38:45 Question 69. Lawyers insist that a copy of the information from every laptop be kept even after a vendor shreds and recycles the machines. Which requirement is this? Here are the options. Option A. Destruction. Option B. Sanitization. Option C. Data retention. Option D. Certification. Pause the video now if you want time to think about the answer.
The correct answer is C. Data retention. Keeping copies of data for legal reasons after the hardware is gone is retention. Destruction and sanitization remove data, and certification only documents that a process was done. Now, why are the other options incorrect? Option A is incorrect. Destruction is about physically ruining the hardware, which is the opposite of keeping data. Option B is incorrect. Sanitization erases data, whereas the legal team wants it preserved. Option D is incorrect. Certification provides proof that a task was completed, not the preservation of the data. Therefore, C, Data retention, is the correct answer.
Play from 1:40:09 Question 70. A large IT department wants server builds to be quicker, consistent and under tighter control. Which approach should it adopt? Here are the options. Option A. Industrial control systems. Option B. Infrastructure as a service. Option C. Infrastructure as code. Option D. Internet of things. Pause the video now if you want time to think about the answer.
The correct answer is C. Infrastructure as code. Describing servers in code that is run automatically makes builds repeatable, standard and fast, and the definitions can be kept under version control. The other choices are a service model, device categories or industrial equipment. Now, why are the other options incorrect? Option A is incorrect. Industrial control systems run physical processes and not server builds. Option B is incorrect. Infrastructure as a service supplies rented resources, but does not itself standardize how servers are built. Option D is incorrect. The Internet of things concerns connected devices rather than managing servers. Therefore, C, Infrastructure as code, is the correct answer.
Play from 1:41:34 Question 71. What is the most typical way data leaves a network that has no connection to the outside? Here are the options. Option A. Bluetooth with no protection. Option B. Portable storage devices. Option C. A bastion host. Option D. An operating system lacking patches. Pause the video now if you want time to think about the answer.
The correct answer is B. Portable storage devices. On an isolated network, someone has to physically carry data across, and USB drives and similar media are the easiest way to do that. Wireless links and exposed systems are less common or contradict the isolation. Now, why are the other options incorrect? Option A is incorrect. Bluetooth needs proximity and pairing, and it's less practical than portable media. Option C is incorrect. A bastion host is a controlled connection point and not a typical leak path in a true air gap. Option D is incorrect. A missing patch creates malware risk but is not the usual way data leaves. Therefore, B, Portable storage devices, is the correct answer.
Play from 1:43:00 Question 72. A reliability engineer plans for a mirror of the main facility that can take over almost instantly if the main site fails. Which site type should be considered? Here are the options. Option A. Warm site. Option B. Cold site. Option C. Hot site. Option D. Generic recovery site. Pause the video now if you want time to think about the answer.
The correct answer is C. Hot site. A hot site is a fully equipped, continuously updated duplicate that can take over right away with very little data loss. Other site types need more time to prepare. Now, why are the other options incorrect? Option A is incorrect. A warm site needs extra setup before it can handle the load. Option B is incorrect. A cold site is mostly empty space and takes a long time to bring online. Option D is incorrect. A generic recovery site does not state how ready it is for quick failover. Therefore, C, Hot site, is the correct answer.
Play from 1:44:15 Question 73. What protection should always be in place when devices are managed from a cloud IoT platform? Here are the options. Option A. Single sign-on. Option B. Protected, encrypted communications. Option C. Federated identity. Option D. Perimeter firewall. Pause the video now if you want time to think about the answer.
The correct answer is B. Protected, encrypted communications. Traffic between devices and the cloud platform should be encrypted so it cannot be read or altered while travelling, which makes it the basic requirement. The other items are useful but optional or situational. Now, why are the other options incorrect? Option A is incorrect. Single sign-on is a convenience for users and is not a core requirement for device traffic. Option C is incorrect. Federated identity is an advanced option and not always needed for basic device management. Option D is incorrect. A firewall is a helpful tool but isn't specifically required for the platform itself. Therefore, B, Protected, encrypted communications, is the correct answer.
Play from 1:45:41 Question 74. During a physical test, a consultant without a badge slips through a secured door right behind a group of staff. What technique is being used? Here are the options. Option A. Radio card duplication. Option B. Forgery. Option C. Shoulder surfing. Option D. Tailgating. Pause the video now if you want time to think about the answer.
The correct answer is D. Tailgating. Following an authorized person through an entrance without presenting credentials is tailgating, a common social engineering method of getting past physical controls. The others involve copying cards, faking papers or watching screens. Now, why are the other options incorrect? Option A is incorrect. Cloning cards means copying a badge's radio signal, which the consultant did not do. Option B is incorrect. Forgery involves faked credentials or documents, none of which are described. Option C is incorrect. Shoulder surfing is observing someone's screen or keypad, not following through a door. Therefore, D, Tailgating, is the correct answer.
Play from 1:47:04 Question 75. A company sees most hostile traffic arriving from certain countries and wants to reduce it. Which technique helps? Here are the options. Option A. Encryption. Option B. Obfuscation. Option C. IP geolocation. Option D. Data sovereignty. Pause the video now if you want time to think about the answer.
The correct answer is C. IP geolocation. Geolocation maps addresses to places, so traffic from high-risk areas can be restricted or blocked. The other options protect data or deal with legal jurisdiction, not the origin of an attack. Now, why are the other options incorrect? Option A is incorrect. Encryption protects data in transit and does not stop traffic from particular regions. Option B is incorrect. Obfuscation hides code or data and doesn't filter traffic by origin. Option D is incorrect. Data sovereignty is a legal concept about where data is held. Therefore, C, IP geolocation, is the correct answer.
Play from 1:48:22 Question 76. An administrator builds firewall rules that allow RTP, SIP, H.323 and SRTP. Which technology is this rule set meant to support? Here are the options. Option A. HVAC. Option B. System on a chip. Option C. Voice over IP. Option D. Real-time operating systems. Pause the video now if you want time to think about the answer.
The correct answer is C. Voice over IP. These protocols handle call setup and the carrying of voice media, which together make up Voice over IP. The remaining choices are building systems, hardware designs or operating system types. Now, why are the other options incorrect? Option A is incorrect. HVAC concerns heating and cooling and does not use these protocols. Option B is incorrect. A system on a chip is a hardware design and not a communications use. Option D is incorrect. A real-time operating system is software for time-critical devices, unrelated to these call protocols. Therefore, C, Voice over IP, is the correct answer.
Play from 1:49:49 Question 77. What is the technique of tucking a secret message inside a photograph so nobody suspects it is there? Here are the options. Option A. Steganography. Option B. Data masking. Option C. Symmetric encryption. Option D. Hashing. Pause the video now if you want time to think about the answer.
The correct answer is A. Steganography. Steganography embeds information inside another file, often a picture, so its presence goes unnoticed. Encryption makes content unreadable but still visible, and hashing produces a fingerprint. Now, why are the other options incorrect? Option B is incorrect. Data masking hides values in databases or reports, not inside images. Option C is incorrect. Symmetric encryption scrambles data with a key but doesn't hide that data exists. Option D is incorrect. Hashing produces a fixed digest for integrity checks and does not hide anything. Therefore, A, Steganography, is the correct answer.
Play from 1:51:09 Question 78. A team is about to fix a flaw on a live production server. What should it do beforehand? Here are the options. Option A. Run a risk assessment to rank the flaw. Option B. Look at what the change management policy requires. Option C. Pass the matter to the software development team. Option D. Apply the incident response plan to judge the fix. Pause the video now if you want time to think about the answer.
The correct answer is B. Look at what the change management policy requires. Changes to production systems have to follow the organization's change management process for approvals, testing and documentation, so that policy is consulted first. The other steps either come later or belong to different processes. Now, why are the other options incorrect? Option A is incorrect. Ranking the flaw helps prioritization, but it doesn't replace the required change procedure. Option C is incorrect. Passing it to developers may happen later and is not the required first step. Option D is incorrect. The incident response plan applies to active incidents, not routine fixes. Therefore, B, Look at what the change management policy requires, is the correct answer.
Play from 1:52:41 Question 79. What term describes the risk that is still left once safeguards have been put in place? Here are the options. Option A. Inherent. Option B. Residual. Option C. Operational. Option D. Avoided. Pause the video now if you want time to think about the answer.
The correct answer is B. Residual. Residual risk is what remains after controls and other reductions have been applied. Inherent risk is the level before any controls, and the remaining terms mean other things. Now, why are the other options incorrect? Option A is incorrect. Inherent risk is the level before any safeguards exist. Option C is incorrect. Operational risk comes from day-to-day business activity and is not defined by controls. Option D is incorrect. Avoided risk means the activity was not undertaken, so no risk remains from it. Therefore, B, Residual, is the correct answer.
Play from 1:53:54 Question 80. A company wants an extra layer so that people can only reach internal systems through one controlled, logged entry point. Which choice fits? Here are the options. Option A. Hypervisor. Option B. Proxy server. Option C. Remote desktop server. Option D. Jump server. Pause the video now if you want time to think about the answer.
The correct answer is D. Jump server. A jump server is a hardened intermediary through which administrators must connect, centralizing access control and logging for the systems behind it. The other items do not serve as that kind of gatekeeper. Now, why are the other options incorrect? Option A is incorrect. A hypervisor runs virtual machines and does not control who reaches internal systems. Option B is incorrect. A proxy handles application traffic on behalf of clients and is not primarily an administrative access barrier. Option C is incorrect. A remote desktop server provides sessions but does not by itself add a controlled gateway layer. Therefore, D, Jump server, is the correct answer.
Play from 1:55:14 Question 81. While hardening company systems, an administrator wants a public, curated catalog of how real adversaries operate, to guide which defenses to apply. What should be consulted? Here are the options. Option A. SOAR. Option B. CVSS. Option C. MITRE ATT&CK. Option D. CSIRT. Pause the video now if you want time to think about the answer.
The correct answer is C. MITRE ATT&CK. MITRE ATT&CK catalogs adversary tactics and techniques gathered from observed attacks, which makes it the natural guide for choosing defenses. The other items are an automation platform, a scoring system and a response team. Now, why are the other options incorrect? Option A is incorrect. SOAR automates security workflows and is not a catalog of attacker behavior. Option B is incorrect. CVSS rates the severity of vulnerabilities, not what attackers do. Option D is incorrect. A CSIRT is a team that handles incidents, not a reference source. Therefore, C, MITRE ATT&CK, is the correct answer.
Play from 1:56:50 Question 82. A business in a hurricane region is writing its disaster recovery plan and needs a backup location that lets it carry on working without delay. Which site is the best choice? Here are the options. Option A. Hot. Option B. Warm. Option C. Tertiary. Option D. Cold. Pause the video now if you want time to think about the answer.
The correct answer is A. Hot. A hot site is a fully equipped facility kept in sync with the main one, so work can continue immediately after a disaster. Other options need time to set up or are not standard categories. Now, why are the other options incorrect? Option B is incorrect. A warm site has some equipment but needs hours to become fully operational. Option C is incorrect. Tertiary is not a standard recovery site classification. Option D is incorrect. A cold site has no equipment or data ready, so it takes a long time to start. Therefore, A, Hot, is the correct answer.
Play from 1:58:03 Question 83. A scanner flags a flaw on several servers, but the administrator confirms the flaw is not actually there. How is this result classified? Here are the options. Option A. True positive. Option B. True negative. Option C. False negative. Option D. False positive. Pause the video now if you want time to think about the answer.
The correct answer is D. False positive. A false positive is a finding the scanner reports even though the problem does not exist. The scan raised an alarm that turned out to be wrong. Now, why are the other options incorrect? Option A is incorrect. A true positive is a real flaw that was correctly detected. Option B is incorrect. A true negative means nothing was reported and nothing was there. Option C is incorrect. A false negative means a real flaw went unreported. Therefore, D, False positive, is the correct answer.
Play from 1:59:19 Question 84. In the incident response lifecycle, which stage is aimed at stopping an attack from spreading further so business disruption stays low? Here are the options. Option A. Preparation. Option B. Analysis. Option C. Recovery. Option D. Containment. Pause the video now if you want time to think about the answer.
The correct answer is D. Containment. Containment limits how far an incident can spread by isolating affected systems and cutting off the attacker, which keeps the damage and disruption small. It follows detection and analysis and comes before recovery. Now, why are the other options incorrect? Option A is incorrect. Preparation takes place before any incident, setting up tools and procedures. Option B is incorrect. Analysis works out what happened but does not by itself limit the spread. Option C is incorrect. Recovery restores normal operations after the threat is under control. Therefore, D, Containment, is the correct answer.
Play from 2:00:37 Question 85. A security engineer is rolling out secure baselines across the company. Which sequence of steps is the correct one? Here are the options. Option A. Maintain, deploy, establish. Option B. Establish, deploy, maintain. Option C. Deploy, maintain, establish. Option D. Deploy, establish, maintain. Pause the video now if you want time to think about the answer.
The correct answer is B. Establish, deploy, maintain. The baseline must first be defined, then applied to the systems, and then kept current over time. Any order that deploys before defining it has nothing to apply. Now, why are the other options incorrect? Option A is incorrect. Maintaining comes last, since there is nothing to maintain before the baseline exists and has been applied. Option C is incorrect. This order deploys before the baseline has been defined. Option D is incorrect. Deploying first has no defined baseline to apply. Therefore, B, Establish, deploy, maintain, is the correct answer.
Play from 2:02:00 Question 86. To lower its yearly premium, a firm drops ransomware from its cyber insurance. Which risk figure did it most likely rely on? Here are the options. Option A. MTBF. Option B. ARO. Option C. MTTR. Option D. RTO. Pause the video now if you want time to think about the answer.
The correct answer is B. ARO. The annual rate of occurrence estimates how often an event is expected to happen each year, which helps decide whether coverage for it is worth paying for. The other values measure repair time, failure intervals or recovery targets. Now, why are the other options incorrect? Option A is incorrect. MTBF measures the average time between equipment failures, not attack frequency. Option C is incorrect. MTTR measures how long a repair takes. Option D is incorrect. RTO states how quickly operations must be restored after an outage. Therefore, B, ARO, is the correct answer.
Play from 2:03:21 Question 87. An administrator finds many idle desktops on the network that do not meet security requirements. What should be recommended to management? Here are the options. Option A. Isolating them. Option B. Decommissioning them. Option C. Patching them. Option D. Monitoring them. Pause the video now if you want time to think about the answer.
The correct answer is B. Decommissioning them. Machines that nobody uses and that cannot meet requirements only add attack surface, so retiring them removes the risk for good. The other actions leave unneeded systems on the network. Now, why are the other options incorrect? Option A is incorrect. Isolating leaves useless machines in place as a liability. Option C is incorrect. Patching idle systems that may not even be updatable doesn't solve the noncompliance. Option D is incorrect. Monitoring does not fix the noncompliance or lower the risk. Therefore, B, Decommissioning them, is the correct answer.
Play from 2:04:35 Question 88. A team needs to keep a data encryption key somewhere safe where several authorized parties can get it when necessary. What is the best solution? Here are the options. Option A. Key escrow. Option B. Public ledger. Option C. Public key encryption. Option D. Public key infrastructure. Pause the video now if you want time to think about the answer.
The correct answer is A. Key escrow. Key escrow places a copy of the key with a trusted party, which then releases it to authorized parties when needed. The other choices manage certificates, encrypt data or publish information openly. Now, why are the other options incorrect? Option B is incorrect. A public ledger is visible to everyone and is unsuitable for secret keys. Option C is incorrect. Public key encryption protects data but does not store keys for others to retrieve. Option D is incorrect. PKI issues and manages certificates and key pairs and is not a key storage service. Therefore, A, Key escrow, is the correct answer.
Play from 2:05:56 Question 89. A company wants a leaner environment that needs fewer operating system patches to manage. Which technology helps most? Here are the options. Option A. Virtualization. Option B. Real-time operating systems. Option C. Containers. Option D. Microservices. Pause the video now if you want time to think about the answer.
The correct answer is C. Containers. Containers share a single host kernel and package their own dependencies, so fewer operating system instances need patching. Virtual machines each carry a full operating system, and the other choices do not reduce patch counts. Now, why are the other options incorrect? Option A is incorrect. Each virtual machine still needs its own operating system patched. Option B is incorrect. Real-time operating systems are specialized and do not reduce patching. Option D is incorrect. Microservices describe an application design style and not an operating system saving. Therefore, C, Containers, is the correct answer.
Play from 2:07:15 Question 90. Which agreement would a company use to stop partners from talking about its business details outside the relationship? Here are the options. Option A. SLA. Option B. MSA. Option C. BPA. Option D. NDA. Pause the video now if you want time to think about the answer.
The correct answer is D. NDA. A non-disclosure agreement legally restricts what parties may share with outsiders. The other agreements cover service levels, general contract terms or purchasing arrangements. Now, why are the other options incorrect? Option A is incorrect. An SLA sets service performance commitments. Option B is incorrect. An MSA sets general terms for ongoing work. Option C is incorrect. A blanket purchase agreement arranges repeat purchases and doesn't restrict disclosure. Therefore, D, NDA, is the correct answer.
Play from 2:08:21 Question 91. An IT team wants to erase the data on old hard drives but then hand the drives to another department for reuse. Which approach works? Here are the options. Option A. Drive shredder. Option B. Wipe tool. Option C. Degausser. Option D. Retention platform. Pause the video now if you want time to think about the answer.
The correct answer is B. Wipe tool. A wiping tool overwrites the stored data so it cannot be recovered while leaving the drive working for reuse. Shredding and degaussing ruin the drive, and a retention platform is not a sanitization method. Now, why are the other options incorrect? Option A is incorrect. A shredder physically destroys the drive, so it can't be reused. Option C is incorrect. Degaussing uses strong magnets that typically make the drive unusable. Option D is incorrect. A retention platform is for keeping data, not erasing it. Therefore, B, Wipe tool, is the correct answer.
Play from 2:09:39 Question 92. A lender launches a server holding customer identity data and wants to be alerted if anyone changes those files. Which tool should it use? Here are the options. Option A. Network access control. Option B. Whole-disk encryption. Option C. User behavior analytics. Option D. File integrity monitoring. Pause the video now if you want time to think about the answer.
The correct answer is D. File integrity monitoring. File integrity monitoring watches files for unauthorized changes and raises an alert when content or attributes differ from the known good state. The other tools protect confidentiality, control connections or look for odd user activity. Now, why are the other options incorrect? Option A is incorrect. Network access control decides which devices may connect, not whether files change. Option B is incorrect. Whole-disk encryption protects confidentiality and does not detect modification. Option C is incorrect. User behavior analytics flags unusual activity but is not built to track file changes. Therefore, D, File integrity monitoring, is the correct answer.
Play from 2:11:10 Question 93. An administrator wants each employee to hold only the access that the person's job actually needs. What should be applied? Here are the options. Option A. Network segmentation. Option B. Baseline configuration. Option C. Least privilege. Option D. Default password changes. Pause the video now if you want time to think about the answer.
The correct answer is C. Least privilege. Least privilege grants each account just the permissions needed for its role and nothing more, which fits access to the job while limiting risk. The other measures address networks, system settings or credentials. Now, why are the other options incorrect? Option A is incorrect. Segmentation separates networks and doesn't decide what individual users can do. Option B is incorrect. A baseline sets standard system settings rather than per-user access. Option D is incorrect. Changing default passwords improves login security, not permission levels. Therefore, C, Least privilege, is the correct answer.
Play from 2:12:30 Question 94. The host firewall on a legacy Linux machine is configured to accept connections only from a handful of internal addresses. What has been put in place? Here are the options. Option A. SNMP traps. Option B. Network segmentation. Option C. Transfer of risk. Option D. Compensating control. Pause the video now if you want time to think about the answer.
The correct answer is D. Compensating control. Because the system cannot be brought up to modern standards, the local firewall acts as an alternative safeguard that reduces exposure, which makes it a compensating control. The other options do not describe what was done. Now, why are the other options incorrect? Option A is incorrect. SNMP traps send monitoring alerts and do not restrict connections. Option B is incorrect. A single host rule is not a division of the network into segments. Option C is incorrect. Transfer of risk shifts the impact to another party, such as an insurer. Therefore, D, Compensating control, is the correct answer.
Play from 2:13:53 Question 95. A public website was breached through a memory overflow flaw in its code. Which technology would best guard against similar attacks? Here are the options. Option A. SD-WAN. Option B. TLS. Option C. WAF. Option D. NGFW. Pause the video now if you want time to think about the answer.
The correct answer is C. WAF. A web application firewall inspects web requests and blocks attacks aimed at the application layer, including malformed inputs that try to exploit coding flaws. The other tools handle routing, encryption or general network filtering. Now, why are the other options incorrect? Option A is incorrect. SD-WAN manages wide-area connectivity and does not defend applications. Option B is incorrect. TLS encrypts traffic but won't stop an exploit that is carried inside it. Option D is incorrect. A next-generation firewall works mainly on network traffic and is less suited to catching application-level exploits. Therefore, C, WAF, is the correct answer.
Play from 2:15:16 Question 96. When a user's browser is handed a certificate, what is used to check whether that certificate is still valid? Here are the options. Option A. CRC. Option B. CSR. Option C. OCSP. Option D. CA. Pause the video now if you want time to think about the answer.
The correct answer is C. OCSP. The online certificate status protocol lets a client ask whether a particular certificate has been revoked, giving a quick answer on its current validity. The other choices are a checksum, a request form and the issuing authority. Now, why are the other options incorrect? Option A is incorrect. A cyclic redundancy check detects errors in transmitted data and not certificate status. Option B is incorrect. A certificate signing request is how a certificate is requested, not validated. Option D is incorrect. A certificate authority issues certificates but is not itself the status checking method. Therefore, C, OCSP, is the correct answer.
Play from 2:16:39 Question 97. Which technology should a company deploy to actively block attackers coming from outside the network? Here are the options. Option A. Host-based IDS. Option B. Network IPS. Option C. Access control list. Option D. Network IDS. Pause the video now if you want time to think about the answer.
The correct answer is B. Network IPS. A network intrusion prevention system sits in the path of traffic and actively drops malicious packets as they arrive from outside. Detection-only systems only alert, and access lists filter by simple rules. Now, why are the other options incorrect? Option A is incorrect. A host-based IDS monitors one machine and only detects. Option C is incorrect. An access list filters by static rules and cannot recognize attack patterns. Option D is incorrect. A network IDS detects and alerts but does not block. Therefore, B, Network IPS, is the correct answer.
Play from 2:18:00 Question 98. A critical legacy server is placed on its own private network segment. Which control type is most likely at work? Here are the options. Option A. Preventive. Option B. Compensating. Option C. Deterrent. Option D. Corrective. Pause the video now if you want time to think about the answer.
The correct answer is B. Compensating. Old systems that cannot easily be updated are often shielded by isolating them, so the network placement offsets the weakness the server cannot fix itself, and that is a compensating control. Now, why are the other options incorrect? Option A is incorrect. A preventive control would be a broader safeguard, whereas this placement stands in for protection the old system lacks. Option C is incorrect. Deterrent controls discourage attackers and don't isolate anything. Option D is incorrect. Corrective controls fix damage after an incident. Therefore, B, Compensating, is the correct answer.
Play from 2:19:15 Question 99. A risk team wants to put numbers on how much of each asset's value would be lost in an incident. Which type of analysis supports this? Here are the options. Option A. Trend-based. Option B. User-driven. Option C. Heuristic. Option D. Quantitative. Pause the video now if you want time to think about the answer.
The correct answer is D. Quantitative. Quantitative analysis assigns numeric values, such as the exposure factor, which is the share of an asset's value lost in an event. The other methods are descriptive or experience-based and do not produce those figures. Now, why are the other options incorrect? Option A is incorrect. Trend-based analysis looks at patterns over time rather than calculating loss values. Option B is incorrect. User-driven analysis is not a standard method for measuring risk. Option C is incorrect. Heuristic analysis relies on rules of thumb rather than numeric calculation. Therefore, D, Quantitative, is the correct answer.
Play from 2:20:38 Question 100. Scanning shows a known flaw on a production web server. Which response directly removes the flaw? Here are the options. Option A. Monitoring. Option B. Decommissioning. Option C. Patching. Option D. Segmentation. Pause the video now if you want time to think about the answer.
The correct answer is C. Patching. Applying the vendor's patch closes the specific weakness, so it is the direct fix. The other responses reduce exposure or retire the system but leave the flaw in place. Now, why are the other options incorrect? Option A is incorrect. Monitoring may spot exploitation but leaves the flaw in place. Option B is incorrect. Retiring the server is excessive when a fix exists. Option D is incorrect. Segmentation limits the impact without fixing the underlying flaw. Therefore, C, Patching, is the correct answer.
