SY0-701 General Security Concepts Practice Test 9 — 15 Questions

Question 1

A security team downloads a software update package signed by the vendor. The team verifies the signature using the vendor's public key before approving deployment. What does this verification primarily confirm?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The package was likely created by the vendor and was not altered after signing. Digital signature verification using the vendor's public key confirms that the package was signed with the vendor's private key, which only the vendor possesses. This provides authentication of the signer's identity and integrity of the data, ensuring the package has not been modified since signing. It does not provide confidentiality, as the package itself is not encrypted.

Answer

The package can only be decrypted by the vendor's private key

Answer

The package is encrypted with the vendor's public key

Answer

The vendor's certificate has not expired

Question 2

Based on the exhibit, what best describes the additional measures applied to the legacy system?

Accepted Answer

Compensating controls, because they reduce risk when the preferred security controls are not possible.. The exhibit shows a legacy system that cannot support modern authentication protocols like Kerberos or NTLMv2. The additional measures—such as network segmentation, strict firewall rules, and an application-layer gateway—are compensating controls. They reduce risk by enforcing security in the network layer since the preferred control (upgrading the OS or application to support strong authentication) is not feasible.

Answer

Preventive controls, because they stop every possible compromise completely.

Answer

Corrective controls, because they repair the controller after an incident occurs.

Answer

Deterrent controls, because they mainly scare attackers away from trying.

Question 3

A system administrator downloads a vendor patch package and a separate checksum file. After the download completes, the administrator runs a command that produces a SHA-256 value for the package and compares it to the vendor's published value. Which cryptographic primitive is being used for the comparison?

Accepted Answer

Hashing. The administrator is using SHA-256 to compute a fixed-length digest of the downloaded package and comparing it to the vendor's published checksum. This is a classic application of a cryptographic hash function (hashing), which produces a unique, irreversible fingerprint of data. The comparison verifies integrity—ensuring the package has not been altered during transit—but does not provide authentication or non-repudiation.

Answer

Symmetric encryption

Answer

Digital signatures

Answer

Asymmetric encryption

Question 4

After a successful phishing attempt, the security team adds MFA, email sandboxing, endpoint isolation, and immutable backups so that one failed safeguard does not expose the company. Which principle does this best illustrate?

Accepted Answer

Defense in depth. Defense in depth is the best fit because the organization is using several independent safeguards across different layers: user authentication, email inspection, endpoint containment, and backup recovery. The idea is that a single compromise, such as one successful phishing email, should not lead directly to full compromise. Security+ expects you to recognize layered protection as a strategy, not just list individual tools.

Why others are wrong: Need-to-know concerns restricting information to only those who require it for their job. Availability is one of the CIA triad objectives, but it is not a layered security strategy. Compensating control refers to an alternative measure used because the preferred control is unavailable or impractical; here the organization is not replacing one missing control, but strengthening multiple defenses at once.

Answer

Need-to-know

Answer

Availability

Answer

Compensating control

Question 5

A legal department sends a confidential contract to an outside partner without first exchanging a shared secret. The sender encrypts the document with the partner's public key so that only the partner can decrypt it with the matching private key. Which cryptographic approach is being used?

Accepted Answer

Asymmetric encryption. B is correct because the scenario describes encrypting a document with the recipient's public key, which can only be decrypted by the recipient's private key. This is the defining characteristic of asymmetric encryption (also known as public-key cryptography), where two different but mathematically related keys are used for encryption and decryption.

Answer

Symmetric encryption

Answer

Hashing

Answer

Digital signatures

Question 6

A cloud support team is changing the way employees access an internal finance portal. Instead of trusting the user's initial login for the rest of the session, the portal now checks identity, device posture, and request context again before allowing access to payroll data or download actions. Which security concept is being implemented?

Accepted Answer

Zero trust. The scenario describes a shift from implicit trust (trusting the initial login for the entire session) to continuous verification of identity, device posture, and request context before granting access to sensitive actions. This is the core principle of Zero Trust, specifically the 'never trust, always verify' model, which treats every access request as if it originates from an untrusted network. The portal is enforcing a policy that re-evaluates trust at each sensitive operation, not just at session start.

Answer

Defense in depth

Answer

Need-to-know

Answer

Least privilege

Question 7

A legacy reporting application cannot be modified this quarter, but users still need access from the corporate network. Security adds a hardened jump server, tighter monitoring, and manual approval for each session because MFA cannot be built into the app yet. What type of control is this?

Accepted Answer

Compensating control. A compensating control is an alternative security measure implemented when the primary control cannot be applied due to technical or operational constraints. In this scenario, the legacy application cannot be modified to support MFA, so the organization deploys a hardened jump server, enhanced monitoring, and manual session approval as compensating controls to reduce risk. These controls do not eliminate the vulnerability but provide an equivalent level of protection until the application can be updated.

Answer

Detective control

Answer

Corrective control

Answer

Deterrent control

Question 8

A systems administrator downloads a patch and a SHA-256 checksum file from the vendor. The administrator hashes the patch locally and the values match. What does the matching hash primarily confirm?

Accepted Answer

The file has not been altered since the vendor published the checksum.. A SHA-256 checksum is a cryptographic hash that acts as a fingerprint for the file. When the locally computed hash matches the vendor-published checksum, it confirms the file's integrity — that the patch has not been modified or corrupted since the vendor generated the checksum. This does not verify confidentiality, authenticity of the signer, or installation success.

Answer

The file remains confidential during transmission.

Answer

The vendor's private key was used to encrypt the patch.

Answer

The patch will definitely install successfully on every system.

Question 9

Match each control category to the best example.

Accepted Answer

Preventive: Firewall. Control categories are matched to examples: preventive controls block, detective controls identify, corrective controls fix, deterrent controls discourage, compensating controls provide alternatives, and directive controls set rules.

Answer

Preventive: Intrusion Detection System

Answer

Detective: Firewall

Question 10

A legal department needs a contract file that can later prove who signed it and whether the content changed after signing. Which cryptographic mechanism should be used?

Accepted Answer

Digital signature. A digital signature provides non-repudiation, ensuring the signer cannot deny signing the document, and integrity, detecting any changes after signing. It uses asymmetric cryptography where the signer's private key creates the signature, and the public key verifies it, making it the correct choice for proving both identity and content integrity.

Answer

Symmetric encryption

Answer

Hashing

Answer

Tokenization

Question 11

Based on the exhibit, what should the administrator do next?

Accepted Answer

Re-download the update from the trusted source and verify the hash again.. If the hash of a downloaded file does not match the vendor-published hash, the file is likely corrupted or tampered with. The administrator should delete the corrupted file, re-download it from the trusted source, and recompute the hash to ensure integrity before installation. This follows the principle of verifying file integrity via cryptographic hashing (e.g., SHA-256) before applying updates.

Answer

Install the update because a longer hash means the file is newer.

Answer

Rename the file to match the vendor’s naming convention and retry installation.

Answer

Disable SHA-256 verification because patch files often change after download.

Question 12

Match each control type to the best description.

Accepted Answer

Administrative: Policies, procedures, and rules. Control types are categorized by nature: administrative involves rules, technical involves technology, physical involves tangible barriers, logical involves software-based access, operational involves processes, and legal/regulatory involves compliance.

Answer

Technical: Physical locks and fences

Answer

Logical: Hardware security modules

Answer

Operational: Software-based authentication

Question 13

A help desk lead notices that several support technicians have broad administrator access across every department's systems so they can resolve tickets faster. After a phishing incident, management wants to reduce the damage if one technician account is compromised. What is the best security principle to apply when redesigning access?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. By applying least privilege, each technician would receive access only to the specific systems and resources required for their role, rather than broad administrator access across all departments. This containment directly limits the blast radius of a compromised account, preventing an attacker from moving laterally to other departmental systems.

Answer

Defense in depth

Answer

Need-to-know

Answer

Zero trust

Question 14

Match each PKI term to what it does.

Accepted Answer

CA: Issues and manages digital certificates. CA issues certificates, RA verifies identities, CRL lists revoked certificates, public key encrypts, private key decrypts, digital signature provides integrity and non-repudiation.

Answer

CA: Verifies identity of certificate requestors

Answer

RA: Issues and manages digital certificates

Answer

CRL: Issues and manages digital certificates

Question 15

Based on the exhibit, which security principle does the organization appear to be using most clearly?

Accepted Answer

Defense in depth, because several different controls stop or limit the attack at different stages.. The exhibit shows multiple security controls—an email filter blocking the attachment, a web filter blocking the download link, and an endpoint detection and response (EDR) tool blocking execution—each acting at a different stage of the attack chain. This layered approach, where no single control is relied upon to stop the threat, is the hallmark of defense in depth. The correct answer is B because the scenario clearly demonstrates overlapping controls that provide redundancy and mitigate risk at various points.

Answer

Zero trust, because all access is denied until a user proves identity again.

Answer

Least privilege, because the attachment was blocked from having administrator rights.

Answer

Need-to-know, because only the security team should be aware of the incident.