SY0-701 General Security Concepts Practice Test 8 — 15 Questions

Question 1

Based on the exhibit, which security principle should the team strengthen to reduce the chance that stolen credentials alone provide access to sensitive data?

Accepted Answer

Zero trust, because every request should be re-evaluated instead of relying on the earlier VPN login.. The exhibit shows a scenario where a VPN session grants persistent access to sensitive data without re-authentication. Zero trust is correct because it mandates continuous verification of every request, not just the initial VPN login, so stolen credentials alone would not provide ongoing access to sensitive data. This principle enforces micro-segmentation and per-request authorization, directly addressing the vulnerability of credential theft.

Answer

Least privilege, because the user should only have the minimum file permissions needed.

Answer

Need-to-know, because all finance data should be hidden from anyone outside the department.

Answer

Defense in depth, because multiple layers are always better than one control.

Question 2

Based on the exhibit, what is the best conclusion about the signed document?

Accepted Answer

The invoice was not changed after signing and the signer’s certificate chain validated correctly.. Option B is correct because a valid digital signature provides both integrity (the document was not altered after signing) and authentication (the signer's certificate chain validates to a trusted root). The exhibit shows a successful signature validation, which cryptographically proves that the invoice has not been modified since signing and that the signing certificate is trusted.

Answer

The invoice is confidential because the signature encrypts the document contents.

Answer

The invoice can be edited if the timestamp is still within business hours.

Answer

The sender’s private key is now public because the certificate verified successfully.

Question 3

Match each cryptographic primitive to its main purpose.

Question 4

A branch office needs to send a confidential design document to headquarters over an untrusted network. Headquarters already has the public/private key pair available for document exchange. Which method is most appropriate to keep the file confidential during transit without first sharing a secret key?

Accepted Answer

Encrypt the file with headquarters' public key. Encrypting the file with headquarters' public key ensures that only headquarters, possessing the corresponding private key, can decrypt and read the file. This method provides confidentiality over an untrusted network without requiring a pre-shared secret key, as the public key can be freely distributed.

Answer

Publish a hash of the file for comparison

Answer

Sign the file with the branch office private key only

Answer

Compress the file before sending it

Question 5

A backup server encrypts large nightly database exports before sending them to an offsite storage system. The organization has already arranged a secure way to share the secret key between the systems, and performance is a concern because the files are very large. Which encryption approach is the best fit?

Accepted Answer

Symmetric encryption. Symmetric encryption (e.g., AES-256) is the best fit because it uses a single shared secret key for both encryption and decryption, offering significantly higher throughput than asymmetric methods. For large files like nightly database exports, symmetric ciphers are hardware-accelerated (e.g., AES-NI) and introduce minimal performance overhead, while the secure key exchange is already handled separately.

Answer

Asymmetric encryption

Answer

Hashing

Answer

Digital signatures

Question 6

To discourage unauthorized entry into a records room, facilities installs a large warning sign, a visible camera over the door, and a turnstile staffed by a guard during business hours. Which control category is the warning sign intended to support most directly?

Accepted Answer

Deterrent. The warning sign is a physical security control designed to discourage unauthorized entry by making potential intruders aware of the risks and consequences. This directly supports the deterrent control category, which aims to reduce the likelihood of a security incident by influencing behavior through fear of detection or punishment. Unlike detective controls that identify incidents after they occur, or preventive controls that physically block access, the sign's primary function is psychological deterrence.

Answer

Detective

Answer

Preventive

Answer

Corrective

Question 7

Based on the exhibit, which principle is most directly being violated by the current share permissions?

Accepted Answer

Need-to-know, because only the people working on valuation models should access them.. The exhibit shows share permissions granting 'Finance Dept' full control over a folder containing valuation models. The need-to-know principle restricts access to only those individuals who require the information to perform their job functions. Since not all Finance Dept members work on valuation models, granting the entire department access violates need-to-know, as only the specific users building those models should have access.

Answer

Least privilege, because the broad Finance Dept access exceeds what many users require.

Answer

Zero trust, because the share should refuse access until every file request is reauthenticated.

Answer

Defense in depth, because the folder should have several separate layers of encryption.

Question 8

Based on the exhibit, which key management improvement best preserves recoverability if the primary backup server is lost?

Accepted Answer

Keep the private key in an HSM or secure escrow with tested recovery procedures.. Option C is correct because storing the private key in a Hardware Security Module (HSM) or secure escrow ensures it remains available even if the primary backup server is lost. HSMs provide tamper-resistant key storage and support tested recovery procedures, which is critical for decrypting backups and maintaining recoverability. This approach separates the key from the backup data, preventing a single point of failure.

Answer

Store the private key on the same backup server so recovery is faster.

Answer

Replace AES with hashing so the archive no longer needs a key.

Answer

Send the private key to backup operators by email so they can restore data quickly.

Question 9

A security team downloads a software update package signed by the vendor. The team verifies the signature using the vendor's public key before approving deployment. What does this verification primarily confirm?

Accepted Answer

The package was likely created by the vendor and was not altered after signing. Digital signature verification using the vendor's public key confirms that the package was signed with the vendor's private key, which only the vendor possesses. This provides authentication of the signer's identity and integrity of the data, ensuring the package has not been modified since signing. It does not provide confidentiality, as the package itself is not encrypted.

Answer

The package can only be decrypted by the vendor's private key

Answer

The package is encrypted with the vendor's public key

Answer

The vendor's certificate has not expired

Question 10

Based on the exhibit, what best describes the additional measures applied to the legacy system?

Accepted Answer

Compensating controls, because they reduce risk when the preferred security controls are not possible.. The exhibit shows a legacy system that cannot support modern authentication protocols like Kerberos or NTLMv2. The additional measures—such as network segmentation, strict firewall rules, and an application-layer gateway—are compensating controls. They reduce risk by enforcing security in the network layer since the preferred control (upgrading the OS or application to support strong authentication) is not feasible.

Answer

Preventive controls, because they stop every possible compromise completely.

Answer

Corrective controls, because they repair the controller after an incident occurs.

Answer

Deterrent controls, because they mainly scare attackers away from trying.

Question 11

A system administrator downloads a vendor patch package and a separate checksum file. After the download completes, the administrator runs a command that produces a SHA-256 value for the package and compares it to the vendor's published value. Which cryptographic primitive is being used for the comparison?

Accepted Answer

Hashing. The administrator is using SHA-256 to compute a fixed-length digest of the downloaded package and comparing it to the vendor's published checksum. This is a classic application of a cryptographic hash function (hashing), which produces a unique, irreversible fingerprint of data. The comparison verifies integrity—ensuring the package has not been altered during transit—but does not provide authentication or non-repudiation.

Answer

Symmetric encryption

Answer

Digital signatures

Answer

Asymmetric encryption

Question 12

After a successful phishing attempt, the security team adds MFA, email sandboxing, endpoint isolation, and immutable backups so that one failed safeguard does not expose the company. Which principle does this best illustrate?

Accepted Answer

Defense in depth. Defense in depth is the best fit because the organization is using several independent safeguards across different layers: user authentication, email inspection, endpoint containment, and backup recovery. The idea is that a single compromise, such as one successful phishing email, should not lead directly to full compromise. Security+ expects you to recognize layered protection as a strategy, not just list individual tools.

Why others are wrong: Need-to-know concerns restricting information to only those who require it for their job. Availability is one of the CIA triad objectives, but it is not a layered security strategy. Compensating control refers to an alternative measure used because the preferred control is unavailable or impractical; here the organization is not replacing one missing control, but strengthening multiple defenses at once.

Answer

Need-to-know

Answer

Availability

Answer

Compensating control

Question 13

A legal department sends a confidential contract to an outside partner without first exchanging a shared secret. The sender encrypts the document with the partner's public key so that only the partner can decrypt it with the matching private key. Which cryptographic approach is being used?

Accepted Answer

Asymmetric encryption. B is correct because the scenario describes encrypting a document with the recipient's public key, which can only be decrypted by the recipient's private key. This is the defining characteristic of asymmetric encryption (also known as public-key cryptography), where two different but mathematically related keys are used for encryption and decryption.

Answer

Symmetric encryption

Answer

Hashing

Answer

Digital signatures

Question 14

A cloud support team is changing the way employees access an internal finance portal. Instead of trusting the user's initial login for the rest of the session, the portal now checks identity, device posture, and request context again before allowing access to payroll data or download actions. Which security concept is being implemented?

Accepted Answer

Zero trust. The scenario describes a shift from implicit trust (trusting the initial login for the entire session) to continuous verification of identity, device posture, and request context before granting access to sensitive actions. This is the core principle of Zero Trust, specifically the 'never trust, always verify' model, which treats every access request as if it originates from an untrusted network. The portal is enforcing a policy that re-evaluates trust at each sensitive operation, not just at session start.

Answer

Defense in depth

Answer

Need-to-know

Answer

Least privilege

Question 15

A legacy reporting application cannot be modified this quarter, but users still need access from the corporate network. Security adds a hardened jump server, tighter monitoring, and manual approval for each session because MFA cannot be built into the app yet. What type of control is this?

Accepted Answer

Compensating control. A compensating control is an alternative security measure implemented when the primary control cannot be applied due to technical or operational constraints. In this scenario, the legacy application cannot be modified to support MFA, so the organization deploys a hardened jump server, enhanced monitoring, and manual session approval as compensating controls to reduce risk. These controls do not eliminate the vulnerability but provide an equivalent level of protection until the application can be updated.

Answer

Detective control

Answer

Corrective control

Answer

Deterrent control

SY0-701 General Security Concepts Practice Test 8 — 15 Questions

Exhibit

SY0-701 General Security Concepts Practice Test 8 — 15 Questions

Exhibit