Security+ SY0-701 SY0-701 Questions 1–75 | Page 1/14

MCQmedium

A security analyst reviews authentication logs and discovers hundreds of failed login attempts from a single external IP address within a five-minute window. All attempts target the same username 'jsmith' but use different passwords. Which type of password attack does this pattern most likely indicate?

A.Password spraying

B.Brute force

C.Credential stuffing

D.Dictionary attack

AnswerB

A brute force attack programmatically enumerates a large number of possible passwords, often from an exhaustive character set or massive wordlist, and submits them sequentially against one known username. Observing hundreds of distinct password attempts for the same target account is the signature of this technique, especially when the guesses are not sourced from a prior breach. Unlike password spraying, which would distribute guesses across accounts, this log pattern concentrates attempts on a single credential pair.

Why this answer

The pattern of hundreds of failed login attempts from a single external IP address targeting the same username 'jsmith' with different passwords is characteristic of a brute force attack. In a brute force attack, the attacker systematically tries many password guesses against a single account to eventually find the correct credential. This contrasts with password spraying, where a few common passwords are tried against many usernames, and credential stuffing, which uses previously compromised username/password pairs from other breaches.

Exam trap

The trap here is confusing brute force with password spraying: candidates often pick password spraying because they see 'different passwords,' but the key differentiator is the single target username versus multiple usernames, which defines the attack vector.

Why the other options are wrong

Password spraying involves trying a few common passwords against many usernames, but this question describes many passwords against a single username, which is the opposite pattern.

Credential stuffing uses previously breached username/password pairs, but this attack uses many different passwords for a single username, not known credentials.

A dictionary attack uses a list of common passwords against a single username, but the question states 'different passwords' without indicating they come from a predefined list; the sheer volume of attempts from one IP targeting one user in a short time frame is characteristic of a brute-force attack, not a dictionary attack.

When would these options actually be correct?

A question describing failed login attempts from a single IP address targeting multiple different usernames with a small set of common passwords (e.g., 'Password123', 'Welcome1') over a short period would make password spraying the correct answer.

A question describes a security analyst seeing many failed logins from different IPs using the same username/password pairs that match known breach data, targeting multiple accounts.

A dictionary attack would be correct if the question described an attacker using a wordlist of common passwords (e.g., 'password123', 'admin') against a single username, with attempts showing repeated passwords from the list rather than sequential or random variations.

Why candidates pick the wrong answer

Candidates may confuse the terms 'password spraying' and 'brute force' because both involve multiple login attempts, but they differ in the target pattern (many users vs. one user).

Candidates may confuse credential stuffing with brute force because both involve many login attempts, but credential stuffing relies on leaked credentials, not guessing passwords.

Candidates may confuse 'dictionary attack' with any attack using a list of passwords, but fail to recognize that brute force systematically tries all combinations, while dictionary attacks rely on a predefined list of likely passwords.

Full explanation →

MCQmedium

Based on the exhibit, which change best reduces the blast radius if a user workstation is compromised?

A.Add more allow rules from VLAN 10 to VLAN 30 for SMB and RDP so restore jobs stay flexible.

B.Move the backup server into the user VLAN to avoid routing and ACL complexity.

C.Remove direct user access to the backup VLAN and allow only the dedicated backup path.

D.Increase the DHCP lease time so backup jobs run less often during business hours.

AnswerC

Eliminating direct user access to the backup VLAN is a textbook application of network segmentation and the principle of least privilege. By restricting communication to only the dedicated backup application path—for example, a backup server or agent initiating outbound connections to storage on specific ports—a compromised workstation cannot reach recovery repositories laterally. This containment shrinks the blast radius, ensuring that even if an endpoint is fully controlled by an attacker, the confidentiality, integrity, and availability of backups remain intact, which is essential for incident recovery and ransomware mitigation.

Why this answer

Removing direct user access to the backup VLAN and allowing only the dedicated backup path enforces network segmentation, which limits lateral movement. If a workstation in VLAN 10 is compromised, an attacker cannot pivot directly to the backup server in VLAN 30, reducing the blast radius. This aligns with the principle of least privilege and defense-in-depth for backup infrastructure.

Exam trap

The trap here is that candidates may think adding more allow rules (Option A) improves flexibility, but in security architecture, reducing unnecessary access paths is key to minimizing blast radius, not increasing connectivity.

How to eliminate wrong answers

Option A is wrong because adding more allow rules from VLAN 10 to VLAN 30 for SMB and RDP increases the attack surface, allowing a compromised workstation to directly access backup servers, which expands rather than reduces the blast radius. Option B is wrong because moving the backup server into the user VLAN eliminates network segmentation entirely, exposing the backup server to any compromised workstation in the same broadcast domain and defeating the purpose of isolation. Option D is wrong because increasing the DHCP lease time does not affect network access controls or segmentation; it only delays IP address renewal and has no impact on blast radius reduction.

Full explanation →

MCQhard

A Java web service accepts a Base64-encoded `profile` object from the browser. During testing, changing a serialized field from `role=user` to `role=admin` causes a deserialization error unless the original signed blob is reused. When a captured valid blob is modified only slightly, the application reconstructs a different class and then exposes an internal admin page. Which attack pattern is most likely?

A.Insecure deserialization, because untrusted serialized data is being reconstructed into server-side objects.

B.SQL injection, because the attacker is changing a field to access a different page.

C.Cross-site request forgery, because the browser is sending a forged request to the application.

D.Cross-site scripting, because the modified object exposes an internal admin page.

AnswerA

Insecure deserialization is the best fit because the application accepts a serialized object from an untrusted source and turns it back into live server-side data. The fact that a small modification changes object behavior shows the server is trusting attacker-controlled serialized content. That can lead to authorization bypass, object confusion, or even code execution depending on the framework and validation controls.

Why this answer

The scenario describes a classic insecure deserialization attack. The Java web service accepts a Base64-encoded serialized object from the browser and reconstructs it into server-side objects without integrity verification. When the attacker modifies a serialized field (role=user to role=admin), the application deserializes the tampered data, which causes a deserialization error unless the original signed blob is reused, but a slight modification reconstructs a different class and exposes an internal admin page.

This directly matches the OWASP Top 10 insecure deserialization pattern where untrusted data is deserialized, leading to object injection and privilege escalation.

Exam trap

The trap here is that candidates may confuse the symptom (accessing an admin page) with a web-based attack like XSS or CSRF, but the root cause is the insecure deserialization of untrusted serialized data, not client-side script injection or request forgery.

How to eliminate wrong answers

Option B is wrong because SQL injection involves injecting malicious SQL queries into input fields to manipulate a database, not modifying serialized object fields to change server-side class behavior or access pages. Option C is wrong because cross-site request forgery (CSRF) relies on tricking a user's browser into sending an authenticated request to a target application, not on manipulating serialized data to alter server-side object reconstruction. Option D is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, not modifying serialized objects to cause server-side deserialization of a different class.

Full explanation →

MCQmedium

A help desk technician reviews a ticket where a user says they logged out of the payroll portal, but another employee who found the session cookie in a browser debug log could still access the account until the session expired. Which attack best matches this behavior?

A.Session hijacking, because a stolen session token was reused to impersonate the user.

B.Pretexting, because the attacker pretended to be an authorized employee on a phone call.

C.CSRF, because the victim was tricked into sending unwanted requests from their browser.

D.Insecure deserialization, because serialized objects were accepted without validation.

AnswerA

Session hijacking is correct because the attacker obtained a valid session identifier—such as a session cookie—after the user authenticated, and then presented that same token to the web server in subsequent requests. This allows the attacker to fully impersonate the user without knowing their password, as the server only validates the session token to identify the user. The reuse of a stolen token is the defining characteristic of session hijacking, directly matching the scenario described.

Why this answer

The described behavior—where a session cookie stolen from a browser debug log is reused by another employee to access the payroll portal—is a classic session hijacking attack. Session hijacking occurs when an attacker captures a valid session token (e.g., a cookie containing a session ID) and uses it to impersonate the authenticated user, bypassing the need for credentials. In this case, the session cookie was not invalidated upon logout, allowing the attacker to reuse it until the session's expiration time.

Exam trap

The trap here is that candidates may confuse session hijacking with CSRF, but the key distinction is that session hijacking involves stealing and reusing an existing session token, whereas CSRF tricks the victim's browser into performing actions using the victim's own active session.

How to eliminate wrong answers

Option B is wrong because pretexting involves fabricating a scenario (e.g., a phone call) to trick a victim into divulging information, but the question describes a technical attack using a stolen session cookie, not social engineering. Option C is wrong because Cross-Site Request Forgery (CSRF) tricks a victim's browser into sending unwanted requests while the victim is authenticated, but here the attacker directly reuses a stolen session token without involving the victim's browser.

Full explanation →

MCQmedium

A security analyst is responding to a potential ransomware incident on a Windows server that is still running. The analyst needs to preserve forensic evidence for analysis. Which of the following actions should the analyst perform first, based on the order of volatility?

A.Capture a full memory dump of the server

B.Shut down the server to prevent further damage

C.Create a forensic disk image of the hard drive

D.Run a full antivirus scan on the system

AnswerA

Correct. Memory is the most volatile data and should be captured first to preserve evidence such as running processes, network connections, and malware in memory. Any delay or system shutdown may cause this data to be lost.

Why this answer

The order of volatility dictates that the most volatile data (memory) must be captured first because it contains critical evidence like running processes, network connections, and encryption keys that will be lost when the system is powered off. A full memory dump preserves this volatile data before any other actions that could alter the system state.

Exam trap

The trap here is that candidates often think shutting down the server is the safest first step to contain damage, but CompTIA tests the forensic principle that volatile data must be preserved before any containment or remediation actions.

Why the other options are wrong

Shutting down the server destroys volatile data in RAM, which is critical for ransomware analysis (e.g., encryption keys, running processes). The order of volatility dictates capturing memory first.

In a live ransomware incident, the order of volatility dictates that volatile data (memory) must be captured before non-volatile data (disk). Creating a disk image first risks losing critical evidence in memory, such as encryption keys or running processes.

Running a full antivirus scan modifies system files and memory, violating the order of volatility which prioritizes capturing volatile data (like memory) first to preserve evidence.

When would these options actually be correct?

In a scenario where the server is already compromised and the priority is to contain the threat to prevent lateral movement or further data encryption, shutting down the server may be the first action.

This would be correct if the server had already been powered off or if the question specified that memory acquisition was not possible (e.g., no tools available) and the priority was to preserve persistent data for offline analysis.

In a scenario where the server is already isolated and the goal is to identify and remove malware without immediate forensic preservation, running an antivirus scan could be the first step to stop active infection.

Why candidates pick the wrong answer

Candidates often think stopping the ransomware's execution immediately will limit damage, but they overlook the forensic need to preserve volatile evidence before powering off.

Candidates often assume that preserving the hard drive is the most important step, not realizing that volatile memory contains crucial evidence that disappears when the system is shut down or altered.

Candidates may think antivirus is a quick, safe action to stop ransomware, not realizing it alters evidence and contradicts forensic best practices.

Full explanation →

MCQmedium

A security analyst receives an alert about a user account attempting to access multiple network shares in rapid succession within a short time frame. The analyst reviews the logs and sees that the IP address originates from the internal network, but the user is currently on leave. Which type of attack is most likely occurring?

A.Pass-the-hash attack

B.Brute-force attack

C.Credential stuffing attack

D.Internal reconnaissance

AnswerD

Internal reconnaissance involves an attacker who has already compromised a system and is now scanning internal resources to identify valuable data or further targets. The rapid access to multiple network shares aligns with this activity.

Why this answer

The behavior—an internal IP address rapidly querying multiple network shares—is characteristic of internal reconnaissance, where an attacker who has already gained a foothold maps out available resources. The user being on leave indicates the account is compromised, and the rapid succession of share access attempts is a classic sign of automated enumeration (e.g., using `net view` or SMB queries) rather than a direct credential attack.

Exam trap

The trap here is that candidates confuse the rapid enumeration of network shares with a brute-force or credential-based attack, failing to recognize that the attacker is already authenticated and is simply mapping the network for further exploitation.

Why the other options are wrong

Pass-the-hash attacks involve using captured password hashes to authenticate without knowing the plaintext password, but the alert describes rapid access to multiple shares, not authentication with a hash. The user is on leave, suggesting the account is compromised, but the behavior (reconnaissance) is more indicative of internal reconnaissance.

A brute-force attack involves repeated login attempts with different passwords, but the alert describes rapid access to multiple network shares after authentication, not failed logins.

Credential stuffing uses previously compromised credentials from other breaches, but the question states the user is on leave and the IP is internal, suggesting the attacker already has valid credentials and is performing reconnaissance, not testing stolen credentials.

When would these options actually be correct?

A pass-the-hash attack would be correct if the question described an attacker using a stolen hash to authenticate to multiple systems or services without needing the plaintext password, such as in a lateral movement scenario after compromising a single host.

A brute-force attack would be correct if the alert showed numerous failed login attempts against a single account or service from the same IP, indicating password guessing.

A security analyst sees multiple failed login attempts from various external IPs using username/password pairs known from a recent data breach. The correct answer would be credential stuffing, as the attacker is using stolen credentials to gain unauthorized access.

Why candidates pick the wrong answer

Candidates may confuse any attack involving compromised credentials with pass-the-hash, especially if they recall that pass-the-hash can be used for lateral movement, but they overlook that the specific behavior (rapid share access) is reconnaissance, not authentication.

Candidates may confuse 'rapid succession' with brute-force attempts, not realizing the user is already authenticated and the activity is post-login reconnaissance.

Candidates may confuse rapid access attempts with credential testing, but credential stuffing typically involves many different accounts, not a single user's account accessing multiple shares.

Full explanation →

MCQmedium

A manufacturer identifies a rare but very costly ransomware risk. Executives decide not to eliminate the activity, but to purchase cyber insurance and formally acknowledge the remaining exposure. Which risk treatment is being used?

A.Avoidance

B.Transfer

C.Mitigation

D.Acceptance

AnswerB

Transfer shifts the financial burden of a potential loss to a third party, most commonly through a cyber insurance policy that covers ransomware payments, extortion demands, and business interruption costs. This strategy is especially appropriate for a rare but very costly risk because it converts an uncertain, potentially catastrophic loss into a predictable premium while allowing the manufacturer to continue operating. The organization still retains responsibility for incident response and reputation, but the financial impact is moved to the insurer.

Why this answer

(Transfer) because purchasing cyber insurance shifts the financial risk of the ransomware incident to the insurer. The executives formally acknowledge the remaining exposure, which confirms they are not simply accepting the risk but are actively transferring the monetary impact through a contractual agreement.

Exam trap

The trap here is that candidates confuse 'acceptance' with 'acknowledgment' — the phrase 'formally acknowledge the remaining exposure' is a red herring; true acceptance requires no further action, but purchasing insurance proves the risk is being transferred, not accepted.

How to eliminate wrong answers

Option A (Avoidance) is wrong because avoidance would require discontinuing the activity that introduces the ransomware risk, such as shutting down the affected systems or processes. Option C (Mitigation) is wrong because mitigation involves implementing technical controls (e.g., endpoint detection, backups, patching) to reduce the likelihood or impact of ransomware, not purchasing insurance. Option D (Acceptance) is wrong because acceptance means the organization consciously retains the risk without transferring or mitigating it; purchasing insurance demonstrates a transfer, not passive acceptance.

Full explanation →

MCQmedium

A company is redesigning its network to host a public-facing web application that accesses a confidential database. The security team needs to minimize the risk of a direct attack against the database server while still allowing the web server to retrieve and update data. Which network architecture best achieves this objective?

A.Place both the web server and the database server in the same DMZ segment and rely on host-based firewalls for protection.

B.Place the web server in the DMZ and the database server on the internal network. Configure the firewall to allow inbound traffic from the web server to the database server on the required port only.

C.Connect both servers to a single internal VLAN and use a reverse proxy to forward external traffic to the web server.

D.Use a site-to-site VPN to connect the web server and database server, and place both behind a single NAT gateway.

AnswerB

This architecture follows the principle of defense in depth. The DMZ provides an additional security layer for the web server, while the database is isolated on the internal network with a restrictive firewall rule that limits access to only the web server, reducing the attack surface.

Why this answer

It implements a tiered network architecture where the web server resides in the DMZ (a semi-trusted zone) and the database server is placed on the internal network, isolated from direct internet access. The firewall is configured with a stateful rule that permits only the web server's IP and the specific database port (e.g., TCP 3306 for MySQL or 1433 for MSSQL), preventing any direct inbound connections from the internet to the database. This minimizes the attack surface by ensuring that even if the web server is compromised, the database is not directly reachable from external hosts.

Exam trap

The trap here is that candidates often assume placing both servers in the DMZ is sufficient because they think the DMZ itself provides isolation, but they overlook that the DMZ is still a single security zone where lateral movement between hosts is not restricted, making the database vulnerable if the web server is breached.

Why the other options are wrong

Placing both servers in the same DMZ segment exposes the database to the same untrusted network as the web server, increasing the attack surface. Host-based firewalls alone are insufficient to prevent a direct attack on the database if the web server is compromised.

Placing both servers on a single internal VLAN with a reverse proxy does not isolate the database from direct external access; if the web server is compromised, the attacker can pivot directly to the database on the same VLAN, violating the principle of defense in depth.

A site-to-site VPN connects two networks securely, but placing both servers behind a single NAT gateway does not isolate the database from direct internet exposure, failing to minimize the risk of direct attack against the database server.

When would these options actually be correct?

This option would be correct in a scenario where both servers host non-sensitive data and the primary goal is to simplify network design while still providing basic isolation from the internal network. For example, a public-facing web application with a read-only, non-confidential database that can tolerate some risk.

This architecture would be correct if the question asked for a solution to protect a web application from external threats while keeping both servers on the same internal network, with the requirement that no direct inbound access to the web server is allowed and all external traffic must be terminated at the reverse proxy.

This option would be correct if the question required secure connectivity between two geographically separate networks (e.g., branch office and headquarters) while hiding both servers behind a single public IP for outbound internet access, with no need for DMZ isolation.

Why candidates pick the wrong answer

Candidates may think that host-based firewalls provide adequate protection and that placing servers together simplifies management, overlooking the principle of defense in depth and the need to isolate sensitive databases from untrusted zones.

Candidates may think a reverse proxy provides sufficient security by hiding the web server's IP, and they may overlook that the database remains on the same flat network segment, making it vulnerable to lateral movement after a web server compromise.

Candidates may think VPN provides sufficient security and overlook the need for network segmentation, or they confuse site-to-site VPN with remote access VPN, believing it inherently protects the database from direct attack.

Full explanation →

MCQmedium

After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?

A.Risk acceptance

B.Risk mitigation

C.Risk avoidance

D.Risk transference

AnswerB

Correct. By deploying a firewall to restrict access, the organization is reducing the likelihood that the vulnerability can be exploited. This is a risk mitigation strategy using a compensating control.

Why this answer

The security team is implementing a hardware-based network firewall to restrict inbound traffic to only authorized source IP addresses and port numbers. This directly reduces the likelihood of exploitation by limiting the attack surface, which is the essence of risk mitigation — applying controls to reduce the risk to an acceptable level. Patching or upgrading is not feasible, so compensating controls like network segmentation and access control lists (ACLs) are used to mitigate the vulnerability.

Exam trap

The trap here is that candidates confuse 'risk mitigation' with 'risk avoidance' because they think blocking traffic is 'avoiding' the vulnerability, but avoidance means eliminating the risk entirely (e.g., decommissioning the app), whereas mitigation reduces the likelihood or impact while the risk still exists.

Why the other options are wrong

Risk acceptance involves acknowledging a risk and taking no action to reduce it, but here management approved purchasing and deploying a firewall to restrict traffic, which actively reduces the vulnerability's exploitability.

Risk avoidance would mean eliminating the risk by discontinuing the application or removing the vulnerability entirely, but the question states the application cannot be patched or upgraded and remains in use, so the risk is not avoided.

Risk transference involves shifting the financial impact of a risk to a third party (e.g., purchasing cyber insurance or outsourcing). In this scenario, the organization is directly implementing a firewall to reduce the vulnerability's exploitability, which is a mitigation action, not transferring the risk.

When would these options actually be correct?

Risk acceptance would be correct if the organization decided to continue operating the vulnerable application without implementing any controls, formally acknowledging the risk and its potential impact without taking further action.

Risk avoidance would be correct if the organization decided to decommission the legacy application or replace it with a different system that does not have the vulnerability, thereby eliminating the risk entirely.

A company identifies a high-risk vulnerability in a legacy system and decides to purchase a cybersecurity insurance policy to cover potential financial losses from exploitation, rather than implementing technical controls. This would be risk transference.

Why candidates pick the wrong answer

Candidates may confuse acceptance with the decision to keep the application running despite the vulnerability, overlooking that the firewall deployment is a proactive control that reduces risk.

Candidates may confuse 'avoidance' with 'prevention' and think that adding a firewall avoids the risk, but avoidance requires ceasing the risky activity, not just reducing the likelihood of exploitation.

Candidates may confuse purchasing a hardware firewall with transferring risk to a vendor, but the firewall is a technical control retained by the organization, not a transfer of financial liability.

Full explanation →

MCQmedium

During malware response on a finance workstation, the system is still powered on and connected. The manager asks whether you can just reboot it to stop the issue. What is the best next step?

A.Reboot immediately to prevent any further damage from the suspected malware.

B.Capture volatile evidence and document the system state before containment actions.

C.Copy suspicious files to a shared drive and continue normal operations.

D.Run a full disk cleanup to remove temporary files and reduce risk.

AnswerB

This is the correct next step because evidence preservation comes before intrusive remediation when a system is still live. Memory, running processes, active network connections, and logged-on sessions may reveal malware behavior and scope. Documenting the time, state, and actions taken also supports the incident response process and helps preserve the integrity of later findings if the case requires internal review or legal action.

Why this answer

In incident response, the first priority when a system is still powered on is to capture volatile evidence (e.g., memory contents, running processes, network connections) before any containment actions like rebooting. Rebooting would destroy this critical data, which may be essential for forensic analysis and understanding the malware's behavior. The order of volatility (RFC 3227) dictates that volatile data must be collected first to preserve evidence integrity.

Exam trap

The trap here is that candidates may think rebooting is a quick fix to stop malware, but CompTIA emphasizes that preserving volatile evidence is the critical first step before any containment action, as rebooting destroys that evidence.

How to eliminate wrong answers

Option A is wrong because rebooting immediately destroys volatile evidence (e.g., RAM contents, active network connections, running processes) that could be crucial for forensic analysis and determining the malware's origin and impact. Option C is wrong because copying suspicious files to a shared drive could spread the malware to other systems on the network, violating containment principles and increasing risk. Option D is wrong because running a full disk cleanup would delete temporary files that might contain malware artifacts or evidence, and it does nothing to stop the active malware or preserve forensic data.

Full explanation →

MCQmedium

An organization's file server contains sensitive HR data. The security team discovers that permissions on a confidential folder have been altered. Which of the following security controls would MOST likely help determine the account responsible for this change?

A.Data loss prevention (DLP) system

B.Mandatory access control (MAC)

C.Audit logging

D.Host-based intrusion prevention system (HIPS)

AnswerC

Audit logging records user actions such as file access, modification, and permission changes. It provides a detailed trail that can be reviewed to identify the account responsible for altering permissions and the exact time of the change.

Why this answer

Audit logging is the correct answer because it records detailed information about who made changes to files and folders, including the account name, timestamp, and the specific permission alteration. By reviewing audit logs, the security team can trace the unauthorized permission change back to the responsible user account. This is a detective control that directly supports accountability and forensic investigation.

Exam trap

The trap here is that candidates often confuse a preventive control like MAC or HIPS with a detective control like audit logging, failing to recognize that only audit logs provide the specific account attribution needed for this scenario.

Why the other options are wrong

A DLP system monitors and prevents unauthorized data transfers, but it does not track or log permission changes on file servers.

Mandatory access control (MAC) is a policy model that enforces access based on labels and clearances, not a mechanism for auditing who changed permissions. It does not provide logs or accountability for changes.

A host-based intrusion prevention system (HIPS) monitors and blocks malicious activities on a single host, but it does not log or track permission changes to files or folders. It is not designed to provide an audit trail of who altered file permissions.

When would these options actually be correct?

A question asking which control would prevent sensitive HR data from being emailed outside the organization would make DLP the correct answer.

A question asking which control would prevent unauthorized users from modifying permissions on classified data, where the system enforces access based on security labels and user clearances, making MAC the correct answer.

An organization wants to detect and block unauthorized attempts to modify system files or registry keys on a critical server. Which security control would most likely prevent exploitation of a zero-day vulnerability targeting that host?

Why candidates pick the wrong answer

Candidates may confuse DLP's data monitoring capabilities with the ability to track changes to permissions, or they may think DLP logs all file-related activities.

Candidates may confuse MAC with auditing because both involve access control, but MAC focuses on preventing changes via policy enforcement, not detecting who made a change.

Candidates may confuse HIPS with host-based intrusion detection systems (HIDS) that can monitor file integrity, or they may think HIPS can log all host activities, including permission changes, due to its broad security scope.

Full explanation →

MCQeasy

A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?

A.The account was probably being used normally because the password was changed

B.The pattern may indicate password guessing or credential stuffing

C.The SIEM is misconfigured because all failed logons are false positives

D.The account is definitely malicious and should be deleted immediately

AnswerB

Repeated failed logons from the same account and source, followed by a successful logon, is a well-established signature of password guessing or credential stuffing. The attacker submits a large set of guesses, and when one finally matches, the success logon completes the pattern, indicating that a valid credential has been compromised. This correlation is not definitive proof, but it is a strong indicator that warrants immediate investigation and validation before considering containment or eradication.

Why this answer

The pattern of 20 rapid failed authentication attempts followed by a successful authentication from the same source IP is a classic indicator of a password guessing or credential stuffing attack. The attacker likely used a list of common passwords or previously compromised credentials, and the final success suggests they found a valid password. SIEM correlation rules are designed to detect such brute-force or spraying behaviors, and this event warrants immediate investigation to determine if the account is compromised.

Exam trap

The trap here is that candidates may dismiss the alert as a false positive due to a user forgetting their password, but the specific combination of rapid failures followed by success from the same IP is a textbook sign of a successful brute-force or credential stuffing attack, not normal user behavior.

How to eliminate wrong answers

Option A is wrong because a password change would not cause 20 rapid failures followed by a success from the same IP; normal usage does not exhibit this pattern, and password changes typically generate a single failure if the old password is used, not a burst of failures. Option C is wrong because failed logons are not inherently false positives; they are legitimate security events that can indicate attacks, and a properly configured SIEM should alert on such patterns to detect credential abuse.

Full explanation →

MCQmedium

Based on the exhibit, which improvement best aligns the current backup design with the stated recovery targets?

A.Keep the same design but extend backup retention from 30 days to 90 days.

B.Switch to frequent incremental or snapshot backups stored in a separate, immutable location with routine restore tests.

C.Share the backup administrator password in a team chat so any engineer can restore data during an outage.

D.Remove backup encryption so restores run faster during an emergency.

AnswerB

The business needs a much smaller RPO and a faster RTO than the current design can deliver. More frequent backups reduce the amount of data lost, while a separate immutable repository improves resilience against ransomware and storage failures. Regular restore tests confirm that the chosen method actually meets the recovery objective in practice, not just on paper.

Why this answer

The current backup design lacks off-site, immutable storage and routine restore testing, which are critical to meet recovery point and time objectives (RPO/RTO). Frequent incremental or snapshot backups in a separate, immutable location protect against ransomware and ensure data integrity, while routine restore tests verify that backups are actually recoverable when needed.

Exam trap

CompTIA often tests the misconception that simply extending retention or making backups faster (e.g., removing encryption) improves recovery, when in reality the key gaps are off-site immutability and restore testing to ensure recoverability against ransomware and operational errors.

How to eliminate wrong answers

Option A is wrong because extending retention to 90 days does not address the lack of off-site or immutable storage, nor does it improve recovery speed or reliability; it only keeps more data in the same vulnerable location. Option C is wrong because sharing the backup administrator password in a team chat violates the principle of least privilege and introduces a massive security risk, potentially allowing unauthorized access to backup systems. Option D is wrong because removing backup encryption would expose sensitive data in transit and at rest, violating confidentiality requirements and potentially compliance mandates, while any performance gain is negligible compared to the security loss.

Full explanation →

MCQmedium

After a facilities outage, multiple employees report that their phones automatically joined a network named "CorpWiFi" in the lobby even though the legitimate access point was offline. A nearby attacker device then captured the captive portal login traffic. What attack is most likely?

A.Rogue access point

B.Evil twin

C.Bluetooth bluejacking

D.NFC relay attack

AnswerB

An evil twin is a fraudulent wireless network that imitates a trusted network's SSID and often broadcasts a stronger signal to cause clients to automatically roam to it. Once connected, the attacker presents a captive portal that mimics the legitimate login page, harvesting usernames and passwords. This exactly matches the reported symptoms of multiple employees connecting to a familiar SSID and being asked for credentials after a facility outage.

Why this answer

Evil twin. In this scenario, the attacker set up a rogue access point with the same SSID ("CorpWiFi") as the legitimate network, which was offline. When employees' phones automatically attempted to reconnect to a known SSID, they associated with the attacker's device, which then presented a fake captive portal to capture login credentials.

This is the classic definition of an evil twin attack: a fraudulent AP that mimics a legitimate one to intercept traffic.

Exam trap

The trap here is confusing an evil twin with a rogue access point; candidates often pick 'rogue access point' because both involve unauthorized APs, but the key distinction is that an evil twin mimics a legitimate SSID to intercept traffic, while a rogue AP is physically connected to the internal network.

How to eliminate wrong answers

Option A is wrong because a rogue access point is an unauthorized AP plugged into the corporate network, not a fake AP set up to mimic an offline legitimate AP; here the attacker's device is not connected to the corporate LAN. Option C is wrong because Bluetooth bluejacking involves sending unsolicited messages over Bluetooth, not capturing Wi-Fi captive portal traffic or spoofing an SSID. Option D is wrong because an NFC relay attack extends the range of an NFC transaction (e.g., contactless payment) by relaying signals between two devices, and does not involve Wi-Fi SSID spoofing or captive portal interception.

Full explanation →

MCQmedium

After a suspicious laptop is imaged with a write blocker, the original drive is sealed and stored. Before a second analyst examines the image, what is the most important next step to preserve admissibility?

A.Mount the image read/write so the analyst can browse faster.

B.Copy the image to a USB drive for easier transport.

C.Document the transfer in the chain-of-custody log and verify the image hash still matches the acquisition value.

D.Rename the evidence file to match the case number.

AnswerC

Chain-of-custody documentation shows who handled the evidence, when it changed hands, and why. Verifying the image hash against the acquisition hash proves the data has not changed since collection. Together, these steps support integrity and admissibility in administrative, HR, or legal reviews. A well-maintained log plus matching hashes is the standard way to show the evidence remained untampered during transfer and analysis.

Why this answer

Before a second analyst accesses the image, the most critical step is to update the chain-of-custody log to document the transfer of custody and to verify the integrity of the image by comparing its current hash value against the original acquisition hash. This ensures that the evidence has not been altered or corrupted since it was first imaged, which is essential for maintaining admissibility in legal proceedings under rules such as the Federal Rules of Evidence.

Exam trap

CompTIA often tests the misconception that renaming or copying evidence is a valid step for preservation, when in fact the core legal requirement is maintaining integrity verification and chain-of-custody documentation before any further handling.

How to eliminate wrong answers

Option A is wrong because mounting the image read/write would modify the file system metadata (e.g., last access timestamps) and potentially alter the image, breaking the hash integrity and rendering the evidence inadmissible. Option B is wrong because copying the image to a USB drive without first verifying the hash and documenting the transfer in the chain-of-custody log introduces a gap in the custody trail and risks integrity loss; the copy must be verified against the original hash, not just moved. Option D is wrong because renaming the evidence file to match the case number is a procedural convenience but does not address the legal requirements of chain-of-custody documentation or hash verification, and could cause confusion if the original filename is needed for forensic tool compatibility.

Full explanation →

MCQmedium

After a server rebuild, an administrator notices that Remote Desktop, SMBv1, and Print Spooler are still enabled on a Windows file server even though the server only stores department documents. The security team also wants to know if future changes drift away from the approved build. What should be implemented?

A.Apply the approved secure baseline and enable configuration drift monitoring against it.

B.Keep the server as-is and rely on the antivirus console to stop misuse.

C.Move the server into a different VLAN and leave the operating system settings unchanged.

D.Schedule a monthly reboot to clear temporary settings and reduce attack surface.

AnswerA

A secure baseline defines the expected hardened state, and drift monitoring detects unauthorized or accidental changes over time. This directly addresses both the current unnecessary services and the need to catch future deviations. It is the most complete and operationally useful response.

Why this answer

Applying an approved secure baseline (e.g., via Group Policy or Security Compliance Toolkit) ensures that unnecessary services like Remote Desktop, SMBv1, and Print Spooler are explicitly disabled. Enabling configuration drift monitoring (e.g., using Azure Policy, DSC, or a SIEM) allows the security team to detect and alert on any unauthorized changes that deviate from the baseline, addressing both the immediate risk and the long-term compliance requirement.

Exam trap

The trap here is that candidates often think network segmentation (VLAN) or periodic reboots are sufficient to mitigate service-level vulnerabilities, but the question specifically asks for a solution that prevents future drift from an approved build, which requires a baseline and monitoring, not just isolation or temporary fixes.

How to eliminate wrong answers

Option B is wrong because relying solely on an antivirus console does not disable or prevent the exploitation of enabled services like SMBv1 (which is vulnerable to EternalBlue) or Print Spooler (which has known privilege escalation flaws); antivirus is not a substitute for reducing the attack surface. Option C is wrong because moving the server to a different VLAN does not disable the enabled services; it only segments network traffic, leaving the server still vulnerable to lateral movement if an attacker gains access to that VLAN. Option D is wrong because scheduling a monthly reboot does not permanently disable services or prevent drift; it only clears temporary settings, and the unwanted services would remain enabled after each reboot.

Full explanation →

MCQmedium

An IT manager wants a document that defines the mandatory minimum requirements for all company laptops, including full-disk encryption, password length, and screen-lock timing. The help desk also needs a separate document that shows exactly how to enroll a laptop in management software. Which document type should contain the mandatory laptop requirements?

A.Policy, because it gives broad direction without technical detail.

B.Standard, because it defines the required technical settings that must be followed.

C.Procedure, because it gives step-by-step instructions for completing a task.

D.Guideline, because it offers flexible recommendations for administrators.

AnswerB

A standard is the correct document type for mandatory, measurable technical requirements. In this case, the organization needs exact minimum settings for encryption, password length, and screen-lock timing, which are all enforceable specifications. The procedure for enrolling devices would be a separate document that explains how to carry out the requirement, but the baseline technical requirements belong in the standard.

Why this answer

A standard defines mandatory, specific technical requirements that must be uniformly applied, such as full-disk encryption (e.g., AES-256), minimum password length (e.g., 14 characters), and screen-lock timeout (e.g., 5 minutes). Unlike a policy, which provides high-level direction, a standard enforces precise configuration baselines that all laptops must meet, ensuring compliance and security consistency.

Exam trap

The trap here is confusing a standard with a policy, where candidates mistakenly think a policy can contain technical specifics, but CompTIA tests that a policy is always high-level and a standard provides the mandatory technical details.

How to eliminate wrong answers

Option A is wrong because a policy provides broad, high-level direction without specifying technical details like encryption algorithms or password lengths, so it cannot define mandatory minimum requirements. Option C is wrong because a procedure gives step-by-step instructions for completing a task (e.g., enrolling a laptop in management software), not the mandatory technical settings themselves. Option D is wrong because a guideline offers flexible recommendations, not mandatory requirements, and administrators are not required to follow them.

Full explanation →

MCQmedium

A server room is located next to a chilled-water pipe, and facilities staff want the earliest possible warning if moisture starts leaking under the raised floor. Which control is the best fit?

A.Install water leak sensors tied into the environmental monitoring system.

B.Replace the badge reader with a biometric lock.

C.Add a security camera pointing at the server racks.

D.Move the servers onto a separate VLAN.

AnswerA

Water leak sensors placed along the chilled water pipe, under raised floor tiles, and near equipment racks detect conductive or optical changes from moisture and send alerts to the environmental monitoring system. This provides immediate warning before fluid reaches sensitive electronics, allowing operators to close isolation valves, shut down affected equipment, or dispatch maintenance. Because the pipe is the hazard source, sensing is the only mitigation that directly addresses the risk.

Why this answer

Water leak sensors are specifically designed to detect the presence of moisture, and when integrated into an environmental monitoring system, they provide immediate alerts (e.g., SNMP traps or email notifications) at the earliest sign of a leak. This allows facilities staff to respond before water damages server equipment under the raised floor, meeting the requirement for earliest possible warning.

Exam trap

The trap here is that candidates may confuse physical security controls (like cameras or biometric locks) with environmental monitoring controls, failing to recognize that only a dedicated moisture sensor provides the earliest automated detection of a water leak.

How to eliminate wrong answers

Option B is wrong because a biometric lock controls physical access to the server room but does not detect moisture or provide any warning about water leaks. Option C is wrong because a security camera pointed at server racks can visually confirm a leak only after it has occurred and become visible, which is not the earliest possible warning and lacks automated alerting.

Full explanation →

MCQeasy

Based on the exhibit, what should the employee do first?

A.Reply with the code because the request appears to come from payroll support.

B.Report the message through the company’s phishing-report process and do not share the code.

C.Forward the email to coworkers so they can watch for the same request.

D.Open the attached file to see whether it contains the payroll fix details.

AnswerB

The message is a social engineering attempt that tries to pressure the user into revealing an MFA code. Reporting it quickly helps the security team investigate, warn others, and block related messages. The employee should never provide the code, even if the sender claims to be from payroll or support.

Why this answer

The message exhibits classic social engineering indicators: an unsolicited request for a sensitive code, urgency, and a spoofed sender address. The employee must report it via the company's phishing-report process to alert the security team and must not share the code, as that would compromise the account. This aligns with security awareness training that emphasizes verifying requests out-of-band and never providing credentials or codes in response to email requests.

Exam trap

The trap here is that candidates may assume the email is legitimate because it appears to come from an internal department (payroll support) and uses urgent language, leading them to choose Option A or D, when in fact any unsolicited request for sensitive information or action should be treated as a potential phishing attempt.

How to eliminate wrong answers

Option A is wrong because replying with the code would directly compromise the employee's account, as the request is a phishing attempt, not a legitimate payroll support request. Option C is wrong because forwarding the email to coworkers could propagate the phishing attack and increase the number of compromised accounts, violating the principle of containment. Option D is wrong because opening an attached file from an unsolicited email could execute malware or trigger a credential-harvesting payload, even if the attachment appears to be a payroll fix document.

Full explanation →

MCQeasy

After building a new file server, an administrator reviews the security baseline and notices that a remote desktop service is enabled even though no one uses it. What is the best hardening action?

A.Keep the service enabled in case someone needs it later

B.Disable the unnecessary service

C.Change the server name to make it harder to find

D.Increase disk space on the server

AnswerB

Removing unused services reduces attack surface and aligns the server with the secure baseline.

Why this answer

The best hardening action is to disable the unnecessary remote desktop service because it reduces the attack surface. An enabled but unused service, such as Remote Desktop Protocol (RDP) on TCP/3389, is a common vector for brute-force attacks and exploits (e.g., BlueKeep, CVE-2019-0708). Disabling it eliminates this risk without affecting legitimate operations.

Exam trap

The trap here is that candidates may confuse 'security through obscurity' (e.g., renaming the server) with a proper hardening action, or they may assume that keeping a service enabled 'just in case' is acceptable, when the correct approach is to disable any unnecessary service to minimize the attack surface.

How to eliminate wrong answers

Option A is wrong because keeping an unused service enabled violates the principle of least functionality and needlessly exposes the server to potential exploitation. Option C is wrong because changing the server name does not mitigate the risk of the service being discovered or attacked; RDP can still be scanned and targeted regardless of the hostname. Option D is wrong because increasing disk space does not address the security risk of an unnecessary service; it is a resource management action, not a hardening measure.

Full explanation →

MCQmedium

A financial institution is implementing a new policy for all remote access to its payment processing system. The system will generate a unique digital signature for each administrative action, and all actions will be recorded in a tamper-evident audit log that is replicated to an immutable storage location. The primary objective of this policy is to ensure that administrators who perform sensitive operations cannot later deny having executed them. Which security goal is this policy primarily intended to enforce?

A.Authorization

B.Non-repudiation

C.Authentication

D.Availability

AnswerB

Non-repudiation is a security service that provides cryptographic proof of the origin, authenticity, and integrity of a transaction or communication. In a financial institution's policy, mechanisms such as digital signatures, hash chaining, and tamper-evident audit logs ensure that an individual cannot plausibly deny having initiated or approved a specific action. This directly supports accountability and legal defensibility, making it the correct goal for preventing false denial.

Why this answer

The policy's use of unique digital signatures for each administrative action, combined with a tamper-evident audit log replicated to immutable storage, directly enforces non-repudiation. Non-repudiation ensures that an administrator cannot deny having performed a specific action because the digital signature cryptographically binds the action to the administrator's identity, and the immutable log prevents any subsequent alteration or deletion of the record. This is the primary security goal when the objective is to prevent denial of responsibility for sensitive operations.

Exam trap

The trap here is that candidates often confuse authentication (proving identity at login) with non-repudiation (proving identity for a specific action after the fact), but the question's focus on digital signatures and tamper-evident logs clearly points to non-repudiation, not just authentication.

Why the other options are wrong

The policy focuses on preventing denial of actions through digital signatures and tamper-evident logs, which is non-repudiation, not authorization. Authorization controls what actions a user is allowed to perform, but does not prevent denial of those actions.

The policy focuses on preventing denial of actions (non-repudiation) through digital signatures and tamper-evident logs, not on verifying identity (authentication). Authentication is about proving who you are, not proving that you performed a specific action.

The policy focuses on preventing denial of actions (non-repudiation), not ensuring system uptime or resource accessibility, which is the goal of availability.

When would these options actually be correct?

A question describing a policy that defines which administrators can access the payment system based on their roles, using role-based access control (RBAC) or access control lists (ACLs), would make authorization the correct answer.

A question where the primary goal is to verify the identity of a user before granting access, such as 'A system requires users to provide a password and a one-time code before accessing sensitive data. Which security goal is being enforced?'

A question describing a policy to ensure that a payment processing system remains operational during peak hours, with redundant servers and failover mechanisms, would make availability the correct answer.

Why candidates pick the wrong answer

Candidates may confuse authorization with non-repudiation because both involve administrative actions, but authorization is about permissions, not about irrefutably proving actions were taken.

Candidates may confuse authentication with non-repudiation because both involve identity, but authentication only verifies identity at a point in time, whereas non-repudiation provides proof of actions that cannot be denied later.

Candidates may confuse the audit log's role in recording actions with ensuring the system is available for future access, or think that tamper-evident logs relate to system reliability.

Full explanation →

Multi-Selecteasy

A help desk team needs to reset passwords on servers during incidents, but they should not keep standing administrator rights all day. Which two controls best support this requirement? Select two.

Select 2 answers

A.Use privileged access management (PAM) to control and audit elevated access.

B.Grant time-limited or just-in-time elevation only when the task is approved.

C.Share one permanent domain administrator account with the whole team.

D.Use a regular user account and disable all authentication logging.

E.Give every help desk user full access all the time so work is faster.

AnswersA, B

PAM is a security framework that centralizes management of privileged accounts, including secure credential storage, automated password rotation, and session recording. It enforces a controlled workflow where help desk staff check out elevated credentials only for approved tasks, and every action is logged and attributable to an individual. This transforms ad-hoc privileged access into an auditable, approval-based process, directly supporting least privilege and compliance.

Why this answer

Privileged Access Management (PAM) solutions enforce just-in-time (JIT) elevation, time-bound access, and session auditing. This allows the help desk team to obtain administrator rights only when needed for incident response, eliminating the need for standing admin rights while maintaining full audit trails.

Exam trap

The trap here is that candidates may think sharing a single domain admin account is efficient for a team, but CompTIA tests that this violates auditability and the principle of least privilege, making it the opposite of what the scenario requires.

Full explanation →

MCQeasy

An employee receives an email that appears to come from the company's payroll provider. It says payroll documents will be deleted today unless the employee signs in through the included link. What is the best first action?

A.Click the link quickly and sign in to avoid losing the documents.

B.Report the message and verify the request using a trusted contact method.

C.Reply to the sender and ask whether the message is legitimate.

D.Forward the email to coworkers so they can watch for the same warning.

AnswerB

Reporting the message to the security team or IT service desk preserves forensic evidence and allows the organization to check for similar campaigns or indicators of compromise. Verifying the request through a trusted contact method—such as a phone number from an internal directory or a known good URL—confirms whether the document link is legitimate or a social-engineering attempt. This approach neutralizes the phishing vector without engaging the suspicious content, and it aligns with incident response and user awareness training.

Why this answer

The email exhibits classic signs of a phishing attack—urgency, a threat of data loss, and a link to a fake login page. The best first action is to report the suspicious message to the security team and independently verify the request by contacting the payroll provider through a trusted channel (e.g., a known phone number or a previously bookmarked URL). This prevents credential theft and potential account compromise.

Exam trap

The trap here is that candidates may think replying to the sender (Option C) is a safe way to verify legitimacy, but in reality, it confirms the email address as active and can expose the user to further social engineering or malware delivery.

How to eliminate wrong answers

Option A is wrong because clicking the link and signing in would directly hand over the employee's credentials to an attacker, enabling account takeover and potential lateral movement within the network. Option C is wrong because replying to the sender confirms the email address is active and monitored, which can lead to targeted follow-up attacks; the sender's address is likely spoofed or compromised, so the reply would go to the attacker. Option D is wrong because forwarding the email to coworkers spreads the phishing threat, increasing the number of potential victims and the attack surface; the correct procedure is to report the email to the security team for analysis and blocking.

Full explanation →

MCQeasy

A help desk technician reports several workstations are suddenly showing lots of pop-up ads and browser redirects after users installed a free media player. What type of unwanted software is most likely present?

A.Ransomware

B.Adware

C.Rootkit

D.Logic bomb

AnswerB

Adware is a type of malicious software that automatically delivers unwanted advertisements, typically through pop-ups, browser redirects, and injected banners. It often installs without explicit user consent or as part of a bundled download, and its presence is characterized by the sudden, frequent display of ads across multiple workstations—exactly the behavior described in the scenario.

Why this answer

Adware is the most likely culprit because it is a type of unwanted software designed to display intrusive advertisements, often through pop-up ads and browser redirects. The infection vector—users installing a free media player—is a classic distribution method for adware, which bundles itself with legitimate software to generate revenue via ad impressions. Unlike ransomware or rootkits, adware does not encrypt files or hide its presence; it directly manipulates browser sessions to serve ads.

Exam trap

The trap here is that candidates may confuse the symptoms of adware with ransomware or a rootkit because pop-ups and redirects can sometimes be caused by more severe malware, but the specific context of a free media player installation points directly to adware as the most likely type of unwanted software.

How to eliminate wrong answers

Option A is wrong because ransomware encrypts files or locks the system and demands a ransom, which does not align with the symptoms of pop-up ads and browser redirects. Option C is wrong because a rootkit is designed to hide its presence and provide persistent, stealthy access to an attacker, not to generate visible pop-up ads or browser redirects. Option D is wrong because a logic bomb is a piece of code that executes a malicious function when a specific condition is met (e.g., a date or user action), and it does not cause ongoing ad displays or browser redirects.

Full explanation →

MCQeasy

An administrator needs to send sensitive configuration details to a remote branch office so only the branch manager can read them. Which cryptographic method is most appropriate?

A.Hashing the file before sending it

B.Encrypting the file so only the intended recipient can decrypt it

C.Using a checksum printed in the email subject line

D.Appending the word confidential to the file name

AnswerB

Encryption protects confidentiality by making the file unreadable to anyone without the correct key. For sensitive configuration details, encryption is the right tool because the recipient can decrypt the file while unauthorized parties cannot read it in transit or at rest.

Why this answer

Encrypting the file with the branch manager's public key ensures that only the manager, possessing the corresponding private key, can decrypt and read the sensitive configuration details. This asymmetric encryption method directly addresses the requirement of confidentiality and targeted recipient access, unlike hashing or simple labeling.

Exam trap

The trap here is that candidates confuse integrity mechanisms (hashing, checksums) with confidentiality mechanisms (encryption), assuming any cryptographic operation provides secrecy, when only encryption with the intended recipient's key ensures exclusive readability.

How to eliminate wrong answers

Option A is wrong because hashing is a one-way function that verifies data integrity, not confidentiality; it cannot be reversed to read the original file. Option C is wrong because a checksum only detects accidental or malicious changes to the file during transit, but it does not prevent anyone from reading the file contents. Option D is wrong because appending 'confidential' to the file name provides no cryptographic protection; it is merely a label that does not restrict access or encrypt the data.

Full explanation →

MCQmedium

A security analyst notices repeated failed login attempts to a critical database server from a single external IP address over the past hour. The analyst reviews the authentication logs and sees that the account name used in each attempt is 'admin'. Which of the following security controls should the analyst recommend to mitigate this type of attack with minimal impact on legitimate users?

A.Configure an account lockout policy to lock the 'admin' account after three failed attempts.

B.Implement a temporary block rule on the perimeter firewall for the source IP address.

C.Disable the 'admin' account until the source IP can be investigated.

D.Require multi-factor authentication on the 'admin' account for all remote logins.

AnswerB

Blocking the attacking IP at the firewall immediately halts the malicious traffic without affecting other users or accounts. This is a quick, low-impact containment measure that can be reversed if false positive, making it the best immediate response.

Why this answer

Implementing a temporary block rule on the perimeter firewall for the source IP address directly stops the attack at the network boundary, preventing further authentication attempts without affecting legitimate users who are not using that IP. This approach is a form of dynamic IP blocking, which is a common mitigation for brute-force attacks targeting a single account from a specific external source.

Exam trap

The trap here is that candidates often choose account lockout policies (Option A) because they seem like a direct countermeasure to failed logins, but they fail to recognize that locking a critical shared account like 'admin' can cause a denial of service for legitimate users, whereas blocking the source IP is a more targeted and less disruptive control.

Why the other options are wrong

An account lockout policy would lock the 'admin' account after three failed attempts, but the attacker is using a single external IP and can simply wait for the lockout to expire or use a different account. This does not prevent the attack from the same IP and could lock out legitimate admins.

Disabling the 'admin' account would prevent legitimate administrative access entirely, causing significant operational disruption, and does not address the external IP source of the attack, which could simply switch to another account name.

While MFA adds security, it does not prevent the repeated failed login attempts from a single IP; the attack is already occurring and MFA would not stop the brute-force attempts themselves, only add a second factor if the password were guessed. The question asks to mitigate the attack with minimal impact on legitimate users, and MFA does not address the source IP or the ongoing attempts.

When would these options actually be correct?

This option would be correct if the question described a brute-force attack targeting multiple user accounts from various IP addresses, where locking accounts after a few attempts prevents credential guessing without affecting a single IP.

If the question described an internal brute-force attack targeting a single privileged account from multiple internal IPs, and the organization could afford temporary downtime for that account while investigating a suspected compromise, disabling the account would be a valid containment step.

In a scenario where an attacker has successfully guessed a password and is attempting to log in remotely, and the goal is to prevent unauthorized access even if credentials are compromised, requiring MFA for all remote logins would be the correct recommendation.

Why candidates pick the wrong answer

Candidates often think account lockout is a standard defense against brute-force attacks, but they overlook that the attack is from a single IP targeting a single account, making IP blocking more effective and less disruptive.

Candidates may think disabling the targeted account is a quick way to stop the attack, overlooking that it blocks all legitimate use and fails to address the external IP vector, which could be blocked more precisely.

Candidates may think MFA is a universal solution for authentication attacks, overlooking that the immediate issue is the brute-force attempt from a single IP, which is better addressed by blocking that IP.

Full explanation →

MCQmedium

A web login form uses unsanitized input in the backend query. When an attacker enters `' OR '1'='1'--` into the username field, the application grants access without a valid password. Which attack pattern is being used?

A.Cross-site scripting, because the attacker is trying to run code in the browser.

B.SQL injection, because the input changes the meaning of the database query.

C.Broken session management, because the user is still logged in after leaving the page.

D.Insecure deserialization, because the application accepts user input.

AnswerB

SQL injection occurs when untrusted input is embedded into a query and alters the intended logic. The crafted string closes the original condition and adds a statement that evaluates as true, which can bypass authentication checks. This is a classic sign that the application is constructing queries unsafely instead of using parameterized statements or properly bound variables.

Why this answer

The attacker's input (`' OR '1'='1'--`) is a classic SQL injection payload that alters the structure of the backend SQL query. By injecting a tautology (`OR '1'='1'`) and commenting out the rest of the query with `--`, the attacker bypasses authentication, causing the database to return a valid row without requiring a correct password.

Exam trap

The trap here is that candidates may confuse SQL injection with cross-site scripting because both involve untrusted input, but SQL injection targets the database layer through query manipulation, whereas XSS targets the client-side DOM or browser execution context.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) that execute in a user's browser, not altering a backend database query. Option C is wrong because broken session management refers to flaws in session token generation, handling, or expiration (e.g., predictable cookies or missing logout), not to input manipulation that changes a query's logic. Option D is wrong because insecure deserialization involves the processing of untrusted serialized objects (e.g., PHP or Java serialization streams) to achieve code execution or privilege escalation, not the injection of SQL syntax into a query string.

Full explanation →

MCQhard

Based on the exhibit, which social engineering attack is most likely?

A.Phishing

B.Vishing

C.Baiting

D.Pretexting

AnswerB

The attacker is using a phone call to impersonate support staff and pressure the user into sharing an MFA code. That is voice-based phishing, or vishing. The fabricated ticket number, urgency around payroll, and caller ID spoofing are classic social engineering clues. The goal is credential or factor theft through a believable phone pretext rather than a malicious link or attachment.

Why this answer

The exhibit shows a voicemail message instructing the recipient to call a specific phone number to verify account activity. This is a classic vishing (voice phishing) attack, where the attacker uses a phone call or voicemail to trick the victim into providing sensitive information or calling a fraudulent number. Unlike phishing, which uses email or text, vishing relies on voice communication channels.

Exam trap

The trap here is that candidates may confuse vishing with pretexting, but vishing specifically uses voice communication (phone call or voicemail) as the attack vector, whereas pretexting can occur via any medium and focuses on the fabricated story.

How to eliminate wrong answers

Option A is wrong because phishing typically involves email or text messages with malicious links or attachments, not a voicemail instructing a phone call. Option C is wrong because baiting involves offering something enticing (e.g., a free USB drive) to lure the victim into a trap, not a voice-based request. Option D is wrong because pretexting involves creating a fabricated scenario (pretext) to obtain information, often through impersonation, but the exhibit specifically uses a voicemail to initiate a phone call, which is the hallmark of vishing.

Full explanation →

MCQmedium

Based on the exhibit, what is the primary security concern with the current access assignments, and what concept is being violated?

A.The system is missing multifactor authentication for payroll users.

B.The configuration violates separation of duties by letting one person prepare and approve the same payroll activity.

C.The account should be converted to a shared group account for the finance team.

D.The permissions are acceptable because payroll users always need full access to related finance functions.

AnswerB

The same user can change payroll data, approve the release, and export the payment file. That concentration of authority creates a clear separation-of-duties failure because one person can both create and authorize a sensitive financial action.

Why this answer

The exhibit shows a single user account with permissions to both prepare and approve payroll transactions. This violates the security principle of separation of duties, which requires that no single individual has control over all phases of a critical process. The primary concern is that this configuration enables fraud or error without independent oversight, as the same person could create and authorize a fraudulent payroll entry.

Exam trap

CompTIA often tests the distinction between authentication mechanisms (like MFA) and authorization principles (like separation of duties), tempting candidates to select a plausible-sounding but irrelevant option about multifactor authentication when the core issue is conflicting access assignments.

How to eliminate wrong answers

Option A is wrong because the question focuses on access assignment conflicts, not authentication factors; multifactor authentication addresses identity verification, not the segregation of conflicting duties. Option C is wrong because converting the account to a shared group account would aggregate permissions further, making separation of duties worse and reducing audit trail granularity. Option D is wrong because it incorrectly assumes full access is always necessary; finance functions often require strict role-based access control to prevent conflicts like preparing and approving the same transaction.

Full explanation →

MCQmedium

A security analyst detects unusual outbound traffic from a workstation that appears to be communicating with a known malicious IP address. The analyst immediately isolates the workstation from the network. Which of the following is the NEXT step in the incident response process according to NIST SP 800-61?

A.Eradication

B.Recovery

C.Containment

D.Lessons Learned

AnswerA

Eradication is the correct immediate next step after containment. The analyst must identify and eliminate the root cause of the malicious outbound traffic—such as removing malware binaries, terminating adversary-controlled processes, deleting persistence mechanisms like scheduled tasks or registry run keys, and revoking compromised credentials. Isolation alone only limits the threat's spread; without eradication, the infection remains dormant and can easily reinfect the host once reconnected.

Why this answer

According to NIST SP 800-61, the incident response process follows a sequence: Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Lessons Learned. Since the analyst has already performed containment by isolating the workstation, the next step is Eradication, which involves removing the threat (e.g., malware, backdoors) from the affected system. This ensures the root cause is eliminated before moving to recovery.

Exam trap

The trap here is that candidates often confuse 'Containment' with the final isolation step, forgetting that NIST mandates a separate Eradication phase to eliminate the threat before recovery.

Why the other options are wrong

Recovery occurs after eradication and involves restoring systems to normal operation. Since the workstation has only been isolated (containment), eradication—removing the threat—must come next.

In NIST SP 800-61, containment is performed before eradication. The question states the workstation has already been isolated (containment), so the next step is eradication, not containment.

In NIST SP 800-61, the incident response process follows: Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity (Lessons Learned). After containment (isolating the workstation), the next step is Eradication, not Lessons Learned. Lessons Learned occurs after Recovery.

When would these options actually be correct?

Recovery would be the next step after eradication in a scenario where the threat has already been removed (e.g., malware cleaned) and the question asks for the step to restore the system to production.

A question asks: 'After detecting a malware outbreak, what is the first step to prevent further spread?' Containment would be correct because it focuses on limiting damage before eradication or recovery.

Lessons Learned would be the correct answer if the question asked for the final step in the incident response process after recovery is complete, or if the scenario described that the incident has been fully resolved and the team is now conducting a post-incident review to improve future responses.

Why candidates pick the wrong answer

Candidates may confuse the order of steps, thinking that recovery immediately follows containment, or they may misinterpret 'recovery' as a broad term that includes threat removal.

Candidates may confuse containment with isolation, thinking that isolating the workstation is the containment step, but the question explicitly says isolation has already occurred, making containment the prior step, not the next.

Candidates may think that after isolating the workstation, the next logical step is to analyze what happened and learn from it, confusing the order of steps or skipping eradication and recovery.

Full explanation →

MCQmedium

A privileged account is used on a jump box at 02:15, and the SIEM shows multiple interactive logons from the same account to different servers within 10 minutes. The administrator says they used a password vault for the session. Which log source best confirms whether the access was authorized?

A.Privileged access management or password vault audit logs

B.DHCP lease logs from the jump box subnet

C.Printer server logs for the operations department

D.Web proxy logs for outbound browsing activity

AnswerA

Privileged access management (PAM) or password vault audit logs are the definitive source for validating the legitimacy of a privileged session initiated from a jump box. These logs record the exact time a credential was checked out, which user performed the checkout, which target system the credential was intended for, and whether the session was approved by a policy or an administrator. They also capture session timeouts, rotation events, and often include a reference to a recorded session replay, making them both the authorization and verification record for the 02:15 activity.

Why this answer

The privileged access management (PAM) or password vault audit logs are the definitive source because they record exactly when a password was checked out, which user performed the checkout, and the specific session ID or ticket associated with the jump box use. Since the administrator claims the password vault was used, these logs will show the checkout event at 02:15 and the subsequent interactive logons, confirming whether the vault authorized the session. No other log source can tie the authentication to the vault's approval process.

Exam trap

The trap here is that candidates assume DHCP logs or generic server logs can validate authentication authorization, when in fact only the PAM audit trail provides the cryptographic proof of vault-mediated access.

How to eliminate wrong answers

Option B is wrong because DHCP lease logs only record IP address assignments and timestamps for devices on the subnet; they do not capture authentication events, user identity, or whether a password vault was used, so they cannot confirm authorization. Option C is wrong because printer server logs only track print jobs and printer-related activity, which are irrelevant to interactive logons or privileged access management; they provide no data about authentication or vault usage.

Full explanation →

MCQeasy

The executive team wants to know which payment services are most critical and how long each can be offline before the business is seriously harmed. Which activity should security support?

A.A tabletop exercise, because leaders are practicing response discussions.

B.A business impact analysis, because it identifies critical functions and outage impact.

C.Incident containment, because the goal is to stop an active breach.

D.Vulnerability scanning, because it finds weaknesses in systems.

AnswerB

A business impact analysis helps determine which services matter most, what impact downtime causes, and how long outages can last before causing serious business harm. It is the right activity when leaders need prioritization and recovery expectations.

Why this answer

A business impact analysis (BIA) is the correct activity because it systematically identifies critical business functions—such as payment processing—and quantifies the maximum tolerable downtime (MTD) and recovery time objectives (RTO). This directly answers the executive team's question about which payment services are most critical and how long each can be offline before causing serious harm.

Exam trap

The trap here is that candidates confuse a tabletop exercise (a reactive drill) with a business impact analysis (a proactive assessment), leading them to choose Option A because it involves leadership discussion, while missing that the BIA is the only activity that formally identifies critical functions and quantifies outage impact.

How to eliminate wrong answers

Option A is wrong because a tabletop exercise is a discussion-based simulation used to test response plans and roles, not a formal process to identify critical functions or quantify outage impact. Option C is wrong because incident containment is a reactive step taken during an active security breach, not a proactive analysis to determine criticality and outage tolerance. Option D is wrong because vulnerability scanning identifies technical weaknesses in systems (e.g., missing patches, misconfigurations), but does not assess business process criticality or the financial/operational impact of downtime.

Full explanation →

MCQmedium

A public-facing file transfer server is running an appliance firmware version that is now end-of-life. The vendor has stated that no further security patches will be released. Management wants the best long-term fix before the next audit. What should be done?

A.Increase logging and keep the current firmware until a problem appears.

B.Move the server to a different subnet and continue using the same firmware.

C.Replace or upgrade the end-of-life firmware with a supported version.

D.Change the administrator password and leave the device in place.

AnswerC

Replacing or upgrading the unsupported firmware is the best long-term fix because it restores the ability to receive patches and vendor support. That directly addresses the outdated component risk instead of merely masking it with monitoring or network controls.

Why this answer

Running end-of-life firmware means no security patches will be released, leaving the server vulnerable to known exploits. The best long-term fix is to replace or upgrade to a supported firmware version that receives ongoing security updates, ensuring the system remains secure for the next audit and beyond.

Exam trap

CompTIA often tests the misconception that compensating controls like logging, segmentation, or password changes are sufficient to mitigate end-of-life vulnerabilities, when the only proper long-term fix is to upgrade or replace the unsupported software.

How to eliminate wrong answers

Option A is wrong because increasing logging does not address the underlying vulnerability; it only provides visibility into attacks without preventing them, and waiting for a problem to appear could lead to a breach. Option B is wrong because moving the server to a different subnet does not fix the firmware vulnerabilities; it only provides network segmentation, but the server remains exposed to attacks that exploit the unpatched firmware, and lateral movement from a compromised host could still occur. Option D is wrong because changing the administrator password does not remediate the known security flaws in the end-of-life firmware; it only addresses credential management, leaving the system vulnerable to remote code execution or other exploits that bypass authentication.

Full explanation →

MCQmedium

A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?

A.Stack canaries

B.Transport Layer Security (TLS)

C.Code signing

D.Data Execution Prevention (DEP)

AnswerA

Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.

Why this answer

Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.

Exam trap

The trap here is that candidates often confuse runtime exploit mitigation (stack canaries) with network security controls (TLS) or software supply chain controls (code signing), leading them to pick a control that does not operate at the memory level during execution.

Why the other options are wrong

TLS encrypts network traffic but does not prevent buffer overflow exploitation; the vulnerability is in the application code, not in transit.

Code signing verifies the integrity and origin of executable code, but it does not detect or prevent runtime exploitation of buffer overflow vulnerabilities. The question asks about detecting and preventing exploitation at runtime, which code signing cannot address.

DEP prevents execution of code in non-executable memory regions, but it does not detect or prevent the buffer overflow itself; the overflow can still corrupt memory and bypass DEP if the attacker uses return-oriented programming (ROP).

When would these options actually be correct?

A question asking which control protects data confidentiality during transmission between a client and server, especially over an untrusted network.

Code signing would be correct in a scenario where the question asks for a control to ensure that only trusted, unmodified software is executed, such as preventing execution of tampered binaries or malware disguised as legitimate applications.

A question asking which control prevents execution of injected shellcode in a buffer overflow scenario, assuming no ROP or other bypass techniques, would have DEP as the correct answer.

Why candidates pick the wrong answer

Candidates may think TLS provides runtime protection against all attacks or confuse network security controls with application-level exploit mitigations.

Candidates may confuse code signing with runtime protection mechanisms, thinking that signed code implies safety from exploitation, or they may overestimate the scope of code signing as a security control.

Candidates may confuse runtime exploit prevention with memory protection mechanisms, thinking DEP stops all buffer overflow exploitation when it only blocks code execution from data pages.

Full explanation →

MCQeasy

A forum lets users save a profile signature. One user enters a string containing script code, and later other users who view that profile see the script run in their browsers. What attack is this?

A.Cross-site scripting

B.Command injection

C.CSRF

D.Broken authentication

AnswerA

This is cross-site scripting because attacker-supplied script code is stored and then executed when other users view the content. The dangerous part is that the payload is delivered through a trusted website and runs in the victim's browser. Stored XSS is a common issue in profiles, comments, and forums.

Why this answer

This is a classic stored cross-site scripting (XSS) attack. The malicious script is permanently stored on the server (in the user's profile signature) and executed in the browsers of any other user who views that profile. The attack exploits the forum's failure to sanitize user input before rendering it in HTML, allowing arbitrary JavaScript to run in the victim's session context.

Exam trap

The trap here is that candidates often confuse stored XSS with reflected XSS or CSRF, but the key distinction is that the payload is permanently stored on the server and executed for every viewer, not just the attacker or a single victim.

How to eliminate wrong answers

Option B (Command injection) is wrong because command injection involves injecting OS commands into a server-side application (e.g., via a web form or API) that executes them on the host system, not client-side script execution in a browser. Option C (CSRF) is wrong because cross-site request forgery tricks an authenticated user into performing unintended actions on a trusted site, not injecting and executing script code in a stored profile field. Option D (Broken authentication) is wrong because broken authentication refers to flaws in login, session management, or credential handling (e.g., weak passwords, session fixation), not the injection of client-side scripts into stored content.

Full explanation →

Matchingeasy

Match each control type to the example that best fits it.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

MFA is required before a user can open the email system.

File integrity monitoring alerts when a protected file changes.

A compromised laptop is reimaged from a standard build.

A login banner warns that activity is monitored and audited.

A procedure tells staff to report lost devices within one hour.

Extra logging is enabled while a missing patch is being scheduled.

Why these pairings

Preventive controls block incidents, detective controls identify them, corrective controls restore after incidents, deterrent controls discourage attacks, compensating controls provide alternative measures, and directive controls mandate behaviors.

Full explanation →

MCQeasy

An EDR alert shows PowerShell launching from a scheduled task, downloading encoded commands, and running them in memory. No suspicious executable is written to disk. What kind of attack is this?

A.A fileless attack that relies on trusted tools already on the system

B.A worm that spreads by exploiting a network service

C.A logic bomb that waits for a specific date or event

D.A rootkit that changes kernel behavior to hide processes

AnswerA

A fileless attack uses legitimate, already-trusted system tools such as PowerShell to execute malicious code directly in memory, avoiding writing an executable to disk. The scheduled task provides persistence or a trigger, and the EDR alert reflects behavioral detection of an abnormal PowerShell invocation chain, such as downloading and running a payload via IEX or reflection. Because no traditional malware file exists, antivirus scanners that rely on file signatures often miss it, making the use of trusted tooling a hallmark of fileless technique.

Why this answer

This is a fileless attack because PowerShell, a trusted system tool, is used to download and execute encoded commands directly in memory without writing any malicious executable to disk. The attack leverages living-off-the-land binaries (LOLBins) and PowerShell's ability to run scripts in memory, bypassing traditional file-based detection mechanisms.

Exam trap

The trap here is that candidates may confuse 'fileless' with 'no file at all,' but the attack still uses system files (PowerShell) and may leave traces in event logs or memory, leading them to incorrectly choose rootkit or logic bomb options due to misunderstanding the attack's execution method.

How to eliminate wrong answers

Option B is wrong because a worm spreads by self-replicating across a network, often exploiting a service vulnerability, but this scenario describes a scheduled task triggering PowerShell to download and run commands, not autonomous propagation. Option C is wrong because a logic bomb activates based on a specific date or event, but here the trigger is a scheduled task without mention of a conditional payload tied to time or user action. Option D is wrong because a rootkit modifies kernel-level behavior to hide processes or files, whereas this attack operates at the user level using PowerShell and does not alter the operating system kernel.

Full explanation →

MCQeasy

A laptop user reports that many files now have strange extensions, a ransom note appears on the desktop, and the files cannot be opened. Which malware is most likely responsible?

A.Spyware

B.Ransomware

C.Rootkit

D.Worm

AnswerB

Ransomware is a type of extortion malware that encrypts a victim's files with a strong cryptographic algorithm (often a combination of AES and RSA) and then appends a distinctive extension to each encrypted file, such as .lock or .polysafe. Following encryption, it drops a ransom note containing payment instructions, usually demanding cryptocurrency in exchange for the decryption key. The user's report of 'strange file extensions' and widespread file corruption is the classic indicator that ransomware has executed a local encryption payload, rather than merely collecting information or hiding in the system.

Why this answer

Ransomware is the correct answer because it encrypts the user's files, appends a new extension (e.g., .encrypted or .locked), and displays a ransom note demanding payment for the decryption key. The symptoms of inaccessible files with altered extensions and a visible ransom note are the classic indicators of a ransomware infection, such as those caused by CryptoLocker or LockBit.

Exam trap

The trap here is that candidates may confuse ransomware with a worm because both can spread rapidly, but the key differentiator is the ransom note and file encryption, which are unique to ransomware.

How to eliminate wrong answers

Option A is wrong because spyware is designed to covertly monitor user activity and steal sensitive information (e.g., keystrokes, browsing habits) without altering file extensions or displaying ransom notes. Option C is wrong because a rootkit is a stealthy malware that hides its presence and other malicious processes from the operating system, typically by modifying kernel-level functions, and does not encrypt files or leave ransom notes. Option D is wrong because a worm is a self-replicating malware that spreads across networks by exploiting vulnerabilities (e.g., SMB EternalBlue) and does not inherently encrypt files or display ransom notes; its primary goal is propagation, not extortion.

Full explanation →

MCQmedium

During troubleshooting, several hosts in VLAN 20 lose access to the default gateway at random. Their ARP caches now map the gateway IP to a workstation MAC address, and traffic briefly flows through that workstation before timing out. What attack is most likely?

A.DNS poisoning, because the workstation name may be resolving to the wrong IP address.

B.ARP poisoning, because false ARP replies are redirecting gateway traffic to another host.

C.Replay attack, because the attacker is reusing old network frames to confuse the hosts.

D.Denial of service, because traffic eventually times out and connectivity is lost.

AnswerB

ARP poisoning occurs when an attacker sends unsolicited ARP replies or gratuitous ARP messages on the local subnet, causing victim hosts to associate the gateway IP with the attacker's MAC address. This redirects traffic intended for the default gateway to the attacker's machine, enabling interception, man-in-the-middle attacks, or intentional disruption of connectivity. In VLAN 20, all hosts share the same broadcast domain, making them vulnerable to such layer-2 attacks. The observed symptom of lost access directly matches the poisoned ARP cache, making this the correct root cause.

Why this answer

The scenario describes classic ARP poisoning (also known as ARP spoofing). The attacker sends forged ARP replies to the hosts in VLAN 20, associating the gateway's IP address with the attacker's MAC address. This causes the hosts to forward traffic destined for the gateway to the attacker's workstation, where it is briefly forwarded (or dropped) before timing out, matching the symptoms of a man-in-the-middle attack via ARP cache corruption.

Exam trap

CompTIA often tests ARP poisoning by describing symptoms of gateway loss and ARP cache corruption, and the trap here is that candidates may confuse it with DNS poisoning because both involve redirection, but ARP poisoning operates at Layer 2 (MAC address) while DNS poisoning operates at Layer 7 (name resolution).

How to eliminate wrong answers

Option A is wrong because DNS poisoning involves corrupting DNS records to redirect domain names to malicious IPs, but the issue here is at Layer 2 (ARP) with MAC-to-IP mappings, not DNS resolution. Option C is wrong because a replay attack captures and retransmits valid network frames to impersonate a device or cause duplication, but it does not directly alter ARP caches or redirect gateway traffic to a workstation MAC. Option D is wrong because denial of service (DoS) aims to overwhelm or disrupt services, but the specific symptom of ARP cache entries mapping the gateway to a workstation MAC indicates active manipulation, not just traffic timing out as a secondary effect.

Full explanation →

MCQmedium

Based on the exhibit, which change should be made first to secure remote administration of the network device?

A.Enable FTP so administrators can upload and download configuration files securely.

B.Disable Telnet and allow SSHv2 only for remote administration.

C.Open the management interface to any internet host as long as the password is complex.

D.Use one shared local administrator account for all network engineers.

AnswerB

Telnet sends all management traffic, including login credentials and command output, as unencrypted text over TCP port 23, making it trivial for an attacker on the network path to intercept the session and obtain privileged access. SSHv2, by contrast, provides confidentiality, integrity, and server authentication via cryptographic key exchange, and it can enforce strong cipher and MAC algorithms for the management session. Disabling Telnet and enabling only SSHv2 for remote administration is the correct first hardening step for the management plane.

Why this answer

Telnet transmits all data, including credentials, in cleartext, making it vulnerable to interception. SSHv2 provides encrypted remote administration and is the secure replacement for Telnet. Disabling Telnet and enabling only SSHv2 is the immediate and necessary first step to secure remote device management.

Exam trap

The trap here is that candidates may think enabling a protocol like FTP with 'secure' in its name is sufficient, or they may overlook that Telnet's lack of encryption is the most critical vulnerability to address first, not password complexity or shared accounts.

How to eliminate wrong answers

Option A is wrong because FTP also transmits credentials and data in cleartext; it is not a secure protocol and should not be used for remote administration. Option C is wrong because exposing the management interface to any internet host dramatically increases the attack surface, regardless of password complexity; management should be restricted to trusted IPs or a jump host. Option D is wrong because using a shared local administrator account eliminates accountability and audit trails; each administrator should have unique credentials for non-repudiation and proper logging.

Full explanation →

MCQmedium

A threat intelligence feed says an adversary rotates domains daily, uses cloud VPS hosting, and reuses the same malware sample across several campaigns. Analysts want the indicator that remains useful even when the domain changes. What should they prioritize?

A.The current domain name because it is the easiest item to block immediately.

B.The malware's SHA-256 file hash because it uniquely identifies the sample.

C.The cloud provider's entire ASN because all traffic from that provider is automatically malicious.

D.The malware's file name because attackers usually keep the same name for convenience.

AnswerB

A file hash is a highly specific indicator for a known binary and remains useful even if the attacker changes domains or hosting providers. Since the report says the same malware sample is reused, the hash provides a stable detection and correlation point across campaigns. It is a stronger immediate IOC than infrastructure that can be replaced quickly.

Why this answer

The malware's SHA-256 file hash is the most persistent indicator because it is a cryptographic hash that uniquely identifies the specific binary sample, regardless of the domain or IP address used for delivery. Unlike domains or IPs, which the adversary can rotate daily, the hash remains constant as long as the same malware sample is reused across campaigns. This makes it a reliable indicator of compromise (IOC) for detection via file reputation or hash-based blocklists.

Exam trap

The trap here is that candidates often prioritize the most immediately blockable indicator (the domain) over the most persistent one (the hash), failing to recognize that adversaries specifically rotate domains to evade static blocklists.

How to eliminate wrong answers

Option A is wrong because the current domain name is ephemeral—the adversary rotates it daily, so blocking it provides only temporary protection and requires constant updates. Option C is wrong because the cloud provider's entire ASN is not automatically malicious; legitimate traffic also originates from that ASN, and blocking it would cause widespread false positives and deny service to benign users.

Full explanation →

Multi-Selecteasy

Employees need to sign in once to the corporate portal and then access email and the HR app without entering credentials again. Which two technologies make this possible in a secure design? Select two.

Select 2 answers

A.Single sign-on (SSO).

B.Federation between the identity provider and the other applications.

C.Network address translation (NAT).

D.Port address translation (PAT).

E.A hardened BIOS password on each workstation.

AnswersA, B

Single sign-on (SSO) is the correct mechanism because it permits a user to authenticate once to a central identity provider and then access multiple trusted applications without being prompted for credentials again. The authentication produces a session or token that is presented to each service, enabling seamless navigation through the corporate portal. This reduces password fatigue, centralizes identity governance, and allows administrators to enforce consistent authentication policies across all connected applications.

Why this answer

Single sign-on (SSO) allows a user to authenticate once and then access multiple applications (email, HR app) without re-entering credentials. This is achieved by the identity provider (IdP) issuing a token (e.g., SAML assertion, OIDC ID token) that is trusted by the service providers. SSO reduces password fatigue and centralizes authentication, but must be paired with federation to securely share identity across different domains or applications.

Exam trap

CompTIA often tests the distinction between SSO and federation, where candidates mistakenly think SSO alone is sufficient for cross-domain access, but federation is required when the applications are managed by different identity domains or external providers.

Full explanation →

MCQeasy

A caller says they are from IT support and asks a user to read back the one-time MFA code that just arrived on their phone. What type of attack is this most likely?

A.Phishing

B.Smishing

C.Vishing

D.Baiting

AnswerC

Vishing is voice phishing, where an attacker uses a phone call or VoIP call to manipulate a target. Asking for an MFA code by phone is a common and dangerous tactic because the attacker may be trying to complete a real login.

Why this answer

This is a vishing (voice phishing) attack because the attacker uses a phone call to socially engineer the victim into revealing a one-time MFA code. Unlike phishing (email) or smishing (SMS), vishing relies on voice communication to bypass technical controls and trick the user into providing the code, which the attacker can then use to authenticate as the victim.

Exam trap

The trap here is that candidates see 'MFA code' and 'phone' and incorrectly assume smishing (SMS-based phishing), but the attack vector is the voice call, not the text message, which defines it as vishing.

How to eliminate wrong answers

Option A is wrong because phishing specifically refers to attacks carried out via email, often with malicious links or attachments, not a phone call requesting an MFA code. Option B is wrong because smishing is conducted via SMS text messages, not a voice call; while the MFA code arrives via SMS, the attack vector is the phone call, making it vishing.

Full explanation →

MCQmedium

During onboarding, a manager wants a document that explains how to request access to a shared drive, who approves it, and what the help desk must do after approval. Which document type is MOST appropriate?

A.Guideline, because it describes optional best practices for access requests.

B.Procedure, because it provides the ordered steps for requesting and fulfilling access.

C.Policy, because it names the general security principle without implementation detail.

D.Standard, because it should define every case-specific approval path in the organization.

AnswerB

A procedure is the best document for describing the sequence of actions, approvals, and responsibilities involved in a recurring task. In this case, it would tell users how to submit the request, who reviews it, and what the help desk does after approval. Procedures improve consistency and reduce errors in operational workflows.

Why this answer

A procedure is the correct document type because it specifies the exact ordered steps for requesting access to a shared drive, the approval authority, and the help desk's post-approval actions. Unlike a policy, which states high-level security principles, a procedure provides the operational workflow needed for onboarding tasks.

Exam trap

The trap here is confusing a procedure with a policy or standard, where candidates pick 'policy' because it sounds authoritative, but fail to recognize that procedures are the only document type that provides ordered steps for a specific workflow.

How to eliminate wrong answers

Option A is wrong because a guideline describes optional best practices or recommendations, not mandatory steps for access requests. Option C is wrong because a policy defines general security principles (e.g., 'access must be authorized') without implementation details like who approves or what the help desk does. Option D is wrong because a standard sets mandatory, uniform requirements (e.g., encryption strength), not case-specific approval paths or step-by-step instructions.

Full explanation →

MCQmedium

After confirming malicious activity on a workstation, the incident lead wants the system cleaned up quickly. The analyst has not yet collected any volatile data. What should the analyst do before remediation begins?

A.Capture volatile evidence such as memory and running process information before changing the system.

B.Immediately uninstall every suspicious application and delete related files.

C.Restore the workstation from backup before documenting the incident.

D.Close the incident because the malicious activity has already been confirmed.

AnswerA

Volatile data disappears quickly and often contains the best clues about active malicious behavior, injected code, network connections, and open sessions. Capturing memory and process state before cleanup preserves that evidence for later analysis. Once remediation begins, many of those artifacts are lost or altered. In an incident response workflow, evidence collection should happen before eradication whenever the system is still available and safe to examine.

Why this answer

Volatile data (e.g., memory contents, running processes, network connections) is lost when the system is powered off or changed. The analyst must capture this evidence first to preserve forensic artifacts that can identify the root cause, scope, and indicators of compromise (IOCs) before remediation alters the system state.

Exam trap

The trap here is that candidates may prioritize speed of remediation over proper forensic procedure, forgetting that volatile data is the most time-sensitive evidence and must be collected before any system changes occur.

How to eliminate wrong answers

Option B is wrong because immediately uninstalling applications and deleting files destroys volatile evidence and may trigger anti-forensic mechanisms, preventing full analysis of the attack. Option C is wrong because restoring from backup overwrites the current system state, erasing all volatile and non-volatile evidence needed for investigation and legal proceedings. Option D is wrong because confirming malicious activity does not complete the incident response process; the analyst must still collect evidence, contain the threat, and perform root cause analysis before closure.

Full explanation →

MCQmedium

A finance application stores approval records for wire transfers. Auditors need to prove which employee approved each transfer, and employees must not be able to deny their approval later. Which security objective is best addressed by binding each approval to an individual identity and preserving immutable logs?

A.Confidentiality, because the approval records should be hidden from everyone except finance staff.

B.Nonrepudiation, because the organization needs proof that a specific person performed the approval.

C.Availability, because the approval system must remain online during business hours.

D.Integrity, because the record must never be changed after it is saved.

AnswerB

Correct. Nonrepudiation provides evidence that a specific user performed an action and later cannot reasonably deny it. Binding approvals to individual identities, using signed records, and keeping immutable logs all support that objective. This is especially important for financial workflows where auditors must trace accountability for every approval.

Why this answer

Nonrepudiation ensures that an action cannot be denied by the person who performed it. By binding each approval to a unique employee identity and preserving immutable logs, the organization can irrefutably prove who approved each wire transfer, preventing employees from later denying their approval. This directly addresses the requirement for accountability and proof of action.

Exam trap

The trap here is that candidates often confuse integrity with nonrepudiation, thinking that keeping a record unchanged (integrity) is sufficient to prove who performed an action, but nonrepudiation requires a cryptographic binding of identity to the action, not just data preservation.

How to eliminate wrong answers

Option A is wrong because confidentiality focuses on preventing unauthorized access to data, not on proving who performed an action; hiding approval records does not prevent an employee from denying their approval. Option C is wrong because availability ensures the system is accessible when needed, but it does not provide proof of identity or prevent denial of past actions. Option D is wrong because integrity ensures data is not altered, but even if a record remains unchanged, it does not prove which specific employee performed the approval without a binding identity.

Full explanation →

MCQmedium

Administrators need to manage internal switches from home. Management traffic must be encrypted, MFA must be used, and no switch management interface should be exposed directly to the internet. Which design is best?

A.Open SSH directly to each switch on a public IP address and restrict access by source IP only.

B.Use a VPN into the internal network, then administer the switches through a hardened jump host over SSH.

C.Allow HTTPS management to each switch over the internet because the channel is encrypted.

D.Use Telnet inside the office and route home users through a split-tunnel VPN.

AnswerB

This design keeps management interfaces internal, encrypts traffic over the VPN, and lets the organization enforce MFA at the VPN or jump-host entry point. SSH provides secure device administration while the jump host centralizes access and logging.

Why this answer

It uses a VPN to create an encrypted tunnel from the home user to the internal network, then requires SSH (which encrypts management traffic) through a hardened jump host. This design ensures MFA can be enforced at the VPN or jump host layer, and no switch management interface is directly exposed to the internet, satisfying all three requirements.

Exam trap

The trap here is that candidates often think HTTPS encryption alone is sufficient for internet-exposed management, ignoring the requirement that no management interface be directly exposed to the internet, and that MFA must be enforced separately.

How to eliminate wrong answers

Option A is wrong because opening SSH directly to each switch on a public IP address exposes the management interface to the internet, violating the requirement that no switch interface be directly exposed; source IP restriction alone is insufficient as a security control and does not enforce MFA. Option C is wrong because allowing HTTPS management directly over the internet still exposes the switch management interface to the internet, and while HTTPS encrypts the channel, it does not inherently enforce MFA or prevent direct exposure. Option D is wrong because Telnet transmits data in cleartext (no encryption), and a split-tunnel VPN would route home users through the internet for management traffic, failing to encrypt the management session and exposing the traffic.

Full explanation →

MCQhard

Based on the exhibit, what is the most likely SOC conclusion and next action? A scheduled alert fired on a server that repeatedly connects to a vendor update site at fixed intervals. The security team wants to know whether the alert represents a real threat or a harmless operational pattern.

A.Treat the activity as confirmed command-and-control traffic and isolate the server immediately.

B.Classify the alert as a likely false positive, verify it against the maintenance record, and tune the rule.

C.Assume DNS poisoning is occurring and immediately flush the DNS cache on every endpoint.

D.Open a credential theft incident and reset all administrator passwords across the environment.

AnswerB

The logs show a signed, approved patch agent on a server explicitly assigned to patch management, connecting to the vendor update host on a predictable schedule. That pattern matches normal operations rather than covert beaconing. The best SOC action is to validate the asset and change context, document the finding, and tune the detection logic or allowlist the known-good behavior.

Why this answer

The scheduled alert firing at fixed intervals to a known vendor update site strongly suggests a legitimate update or heartbeat mechanism, not malicious C2 traffic. Option B correctly directs the analyst to verify against maintenance records (confirming the pattern is expected) and then tune the rule to reduce future false positives, which is the standard SOC workflow for benign scheduled activity.

Exam trap

The trap here is that candidates see 'scheduled alert' and 'fixed intervals' and immediately think of C2 beaconing, but the key differentiator is the destination being a known vendor update site, which points to a false positive rather than a threat.

How to eliminate wrong answers

Option A is wrong because isolating the server immediately for confirmed C2 traffic is premature; the traffic is to a known vendor update site at fixed intervals, which is the opposite of typical C2 behavior (which uses irregular patterns and often non-standard ports). Option C is wrong because DNS poisoning would cause traffic to unexpected IPs, not a known vendor site, and flushing DNS cache on every endpoint is an extreme, unnecessary action for a single scheduled alert. Option D is wrong because credential theft incidents involve unauthorized access or lateral movement, not a server making outbound connections to a vendor site; resetting all admin passwords would be a massive overreaction and disrupt operations without evidence.

Full explanation →

MCQeasy

An office loses power several times each month, causing servers to shut down without warning. Which control best helps keep the systems running long enough for a safe shutdown?

A.A UPS sized to support the equipment for a short period.

B.A better wallpaper design in the server room.

C.A stronger password for the power strip.

D.More user awareness training about turning monitors off.

AnswerA

A UPS is the best control because it provides temporary battery power during outages, giving systems time to continue running briefly or shut down cleanly. This reduces the chance of data loss and hardware damage. It is a common environmental safeguard for servers and other critical devices that must survive short power interruptions.

Why this answer

A UPS (Uninterruptible Power Supply) provides battery backup power to connected equipment, allowing servers to continue running for a short duration after a power loss. This gives administrators enough time to perform a safe, orderly shutdown, preventing data corruption and hardware damage from abrupt power loss.

Exam trap

The trap here is that candidates may confuse a UPS with a surge protector or power strip, thinking that any power-related device provides backup runtime, when only a UPS with battery storage can keep systems running after a power failure.

How to eliminate wrong answers

Option B is wrong because wallpaper design has no impact on power continuity or safe shutdown procedures; it is purely cosmetic. Option C is wrong because a stronger password for the power strip does not provide backup power or enable graceful shutdown; power strips do not manage power loss events. Option D is wrong because user awareness training about turning monitors off does not address the need for servers to remain powered during an outage; it focuses on energy savings, not uptime or safe shutdown.

Full explanation →

MCQmedium

A company is evaluating a new cloud-based customer relationship management (CRM) provider. The provider’s documentation includes a SOC 2 Type II report, but the company’s compliance team specifically requires evidence that data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted with AES-256. Which of the following actions best demonstrates that the company has performed proper due diligence in vendor risk management?

A.Request the provider to sign a contractual service-level agreement (SLA) that guarantees encryption compliance.

B.Accept the SOC 2 Type II report as sufficient and proceed without further review.

C.Review the detailed control descriptions and auditor test results within the SOC 2 Type II report that address encryption of data in transit and at rest.

D.Conduct an independent penetration test on the provider’s infrastructure before signing the contract.

AnswerC

A SOC 2 Type II report includes a detailed description of controls, the control objectives, and the results of the auditor’s testing over a period of time. Reviewing these specific sections allows the company to verify that encryption controls are designed and operating effectively, which satisfies due diligence requirements for third-party risk management.

Why this answer

A SOC 2 Type II report includes detailed control descriptions and independent auditor test results that specifically verify whether encryption controls (TLS 1.2+ for data in transit and AES-256 for data at rest) are designed and operating effectively over a period of time. Reviewing these granular details allows the company to confirm compliance with its specific encryption requirements, which is a core component of due diligence in vendor risk management.

Exam trap

The trap here is that candidates assume a SOC 2 Type II report is a blanket certification of all security controls, when in fact it only attests to the controls that were specifically selected and tested, so failing to review the detailed control descriptions can lead to accepting a report that does not cover the required encryption standards.

Why the other options are wrong

An SLA guarantees future performance but does not provide evidence of current compliance; the company needs to verify encryption controls before accepting the provider, not just contractually promise them.

Accepting the SOC 2 Type II report as sufficient without reviewing its detailed controls and test results fails to verify that the specific encryption requirements (TLS 1.2+ for transit, AES-256 for at rest) are actually addressed, which is necessary for proper due diligence.

Conducting an independent penetration test is not the best action because the company already has a SOC 2 Type II report that likely covers encryption controls; performing a separate pentest goes beyond the required due diligence and may not directly address the specific encryption requirements.

When would these options actually be correct?

This option would be correct if the question asked for the best way to ensure ongoing compliance after the contract is signed, or if the company had already verified encryption controls and needed a contractual remedy for non-compliance.

This option would be correct if the compliance team required only a general assurance of security controls without specific encryption requirements, and the SOC 2 Type II report was from a reputable auditor covering all relevant control areas.

This option would be correct if the question asked for the most thorough validation of a provider's security posture when no third-party audit report is available, or if the provider is a high-risk vendor handling extremely sensitive data and the company requires independent verification beyond existing reports.

Why candidates pick the wrong answer

Candidates may think a contractual SLA is a strong legal safeguard that forces compliance, overlooking that due diligence requires verifying actual controls, not just promises.

Candidates may assume that a SOC 2 Type II report is a comprehensive certification that automatically covers all security requirements, leading them to believe no further review is needed.

Candidates may think that a penetration test provides direct evidence of encryption implementation, but they overlook that the SOC 2 report already includes auditor-tested controls for encryption, making a separate pentest redundant and not the best demonstration of due diligence for this specific requirement.

Full explanation →

MCQeasy

A team manages virtual machines in a public cloud and wants an audit trail of who created instances, changed security groups, and modified IAM settings. What should be enabled first?

A.Host-based antivirus on each virtual machine.

B.Cloud control plane or audit logging.

C.A guest operating system screen saver policy.

D.A static public IP address for every virtual machine.

AnswerB

This is the best answer because audit logs record management actions such as instance creation, security group changes, and IAM updates. Those events are central to cloud investigations and change tracking. Enabling cloud-native logging first gives the team visibility into who did what and when, which is essential for security monitoring and accountability.

Why this answer

Cloud control plane or audit logging (e.g., AWS CloudTrail, Azure Monitor, or Google Cloud Audit Logs) captures all API calls that create instances, modify security groups, or change IAM settings. This provides the required audit trail of who performed each action, when, and from what source, which is essential for security incident response and compliance.

Exam trap

The trap here is confusing guest OS-level controls (antivirus, screen saver) with cloud provider-level audit logging, leading candidates to pick a security tool that addresses a different threat surface.

How to eliminate wrong answers

Option A is wrong because host-based antivirus protects against malware on the VM's operating system but does not log cloud control plane actions like instance creation or IAM changes. Option C is wrong because a guest OS screen saver policy enforces local session locking, which is unrelated to auditing cloud-level administrative actions. Option D is wrong because assigning a static public IP to each VM provides a fixed network address but generates no audit logs for who created instances or modified security groups.

Full explanation →

MCQmedium

Based on the exhibit, what type of malware behavior is most likely occurring?

A.Ransomware, because the endpoint made an outbound connection after opening a document.

B.Fileless attack, because PowerShell was launched in memory with no new payload written to disk.

C.Spyware, because the laptop made an encrypted outbound connection.

D.Worm activity, because the laptop communicated with an external IP address.

AnswerB

This is a fileless attack because the malicious activity relies on script execution rather than a traditional dropped executable. The encoded PowerShell command, hidden execution, and absence of a new file on disk strongly indicate memory-based or script-based malware behavior that can evade basic file scanning.

Why this answer

The exhibit shows PowerShell being launched in memory with no new payload written to disk, which is the hallmark of a fileless attack. Fileless malware exploits legitimate system tools like PowerShell to execute malicious code directly in memory, evading traditional signature-based detection that relies on scanning files on disk.

Exam trap

The trap here is that candidates see an outbound connection and immediately assume ransomware or spyware, but the key indicator is PowerShell executing in memory with no disk write, which is the defining characteristic of a fileless attack.

How to eliminate wrong answers

Option A is wrong because ransomware typically encrypts files and demands payment, but the exhibit shows no evidence of file encryption or ransom note; the outbound connection alone does not confirm ransomware. Option C is wrong because spyware exfiltrates data over encrypted channels, but the exhibit lacks indicators of data collection or exfiltration; an encrypted outbound connection is common for many legitimate applications. Option D is wrong because worm activity involves self-replicating propagation across networks, and the exhibit only shows a single outbound connection to an external IP, which is insufficient to confirm worm behavior.

Full explanation →

MCQeasy

A vulnerability scan reports that a public web server is running an operating system version that no longer receives security updates. Which issue is present?

A.Weak permissions

B.Outdated component

C.DNS poisoning

D.Smishing

AnswerB

An unsupported operating system is an outdated component because the vendor has ceased releasing security updates and patches for it. This leaves known vulnerabilities permanently unmitigated, making the server more exposed to exploitation. In vulnerability scan reports, an end-of-life OS is typically categorized under outdated components, reflecting the software's obsolete state. This is the correct classification because the root cause is the lack of vendor support, not an access or network issue.

Why this answer

An operating system version that no longer receives security updates is an outdated component. This means the vendor has ceased patching known vulnerabilities, leaving the system exposed to exploits that target unpatched flaws. In the context of a public web server, this directly violates the principle of maintaining a secure baseline and is a common finding in vulnerability scans.

Exam trap

The trap here is that candidates may confuse 'outdated component' with 'weak permissions' because both involve configuration issues, but the question specifically describes a version that no longer receives updates, which is a lifecycle/obsolescence problem, not a permissions misconfiguration.

How to eliminate wrong answers

Option A is wrong because weak permissions refer to misconfigured access controls (e.g., world-writable files or improper ACLs), not the age or update status of the OS itself. Option C is wrong because DNS poisoning is an attack that corrupts DNS resolution data (e.g., spoofed A records) to redirect traffic, unrelated to the OS version's patch level. Option D is wrong because smishing is a social engineering attack using SMS text messages to trick users into revealing information, not a technical vulnerability in server software.

Full explanation →

MCQmedium

After an internal PKI was rebuilt, users now see certificate warnings when connecting to the company intranet portal. The portal certificate chains to a new CA, but endpoint trust stores do not recognize it yet. What should the administrator deploy?

A.The portal's private key so users can validate the certificate locally.

B.The root CA certificate for the new PKI to trusted endpoint stores.

C.A new certificate signing request on each endpoint.

D.A self-signed certificate on the portal to avoid future CA problems.

AnswerB

Correct. Endpoint trust stores need the trusted root certificate so they can validate the certificate chain presented by the intranet portal. Once the root CA is trusted, the browser can build a chain of trust from the portal certificate through any intermediate certificates back to the root. This resolves the warning without exposing private keys.

Why this answer

The root CA certificate must be distributed to all endpoint trust stores to establish trust in the new PKI. Without the root CA in the trusted root certification authorities store, the certificate chain is incomplete, causing browsers to display certificate warnings. Deploying the root CA certificate via Group Policy or MDM resolves this by allowing endpoints to validate the portal's certificate chain.

Exam trap

The trap here is that candidates may confuse distributing the root CA certificate with distributing the private key or generating a CSR, but the core concept is that trust is established by adding the root CA to the trusted store, not by modifying the portal or endpoints' certificates.

How to eliminate wrong answers

Option A is wrong because distributing the portal's private key would compromise the certificate's security, allowing anyone to impersonate the portal; private keys must never be shared. Option C is wrong because a new certificate signing request (CSR) on each endpoint is unnecessary and irrelevant—CSRs are used to request certificates from a CA, not to establish trust in an existing CA. Option D is wrong because a self-signed certificate would not be trusted by endpoints either (unless its root is manually added), and it would bypass the benefits of a proper PKI, such as revocation and centralized management.

Full explanation →

MCQmedium

After restoring a virtualized file server from backup, users can log in but the accounting application returns database consistency errors. What should you do next?

A.Declare the restore successful because the virtual machine boots and users can sign in.

B.Verify the restore in an isolated environment and confirm application-level integrity and permissions.

C.Increase the backup retention period and wait for the next scheduled full backup.

D.Delete the backup set to prevent confusion with the restored data.

AnswerB

This is the best next step because a restore is only useful if the data and application work as expected. Testing in an isolated environment lets you confirm database consistency, file permissions, application dependencies, and any version mismatches without risking production impact. That approach also helps determine whether the backup itself is valid or whether a separate application or storage issue is causing the errors.

Why this answer

The restore process must be validated beyond basic boot and login functionality. Database consistency errors indicate that the application-level data integrity was compromised during the restore, likely due to missing or inconsistent database files, permissions, or transaction logs. Verifying the restore in an isolated environment allows you to test application-specific integrity checks (e.g., DBCC CHECKDB for SQL Server) and confirm that file permissions and security descriptors are intact before returning the server to production.

Exam trap

The trap here is that candidates assume a successful VM boot and user login equate to a complete restore, overlooking the need to validate application-level data integrity and permissions in an isolated test environment.

How to eliminate wrong answers

Option A is wrong because declaring success based solely on VM boot and user login ignores the critical application-level integrity failure; database consistency errors mean the restore is incomplete or corrupted. Option C is wrong because increasing backup retention and waiting for the next full backup does not address the current data integrity issue and delays resolution. Option D is wrong because deleting the backup set would destroy the only source for a potential re-restore or forensic analysis, and it does not fix the consistency errors.

Full explanation →

MCQhard

After a switch reboot in a conference room, several laptops obtain valid IP addresses in the correct subnet, but their default gateway changes to 10.20.40.50, which is not the legitimate router. Packet capture shows DHCP offers coming from a MAC address that does not belong to the approved DHCP server, and the rogue device responds faster than the real server. What attack is most likely occurring?

A.ARP poisoning, because the attacker is changing IP-to-MAC mappings on the local network.

B.Rogue DHCP service, because an unauthorized DHCP server is handing out network settings.

C.Replay attack, because the attacker is reusing old DHCP offers.

D.DNS poisoning, because the clients are being sent to the wrong network path.

AnswerB

A rogue DHCP service is the best answer. The clients receive valid-looking leases from an unauthorized device, and the device supplies the default gateway before the legitimate server can respond. This is a common and dangerous network attack because it can redirect traffic, enable interception, or break connectivity without requiring packet spoofing at the ARP layer.

Why this answer

The scenario describes an unauthorized device responding to DHCP discovery messages faster than the legitimate server, assigning valid IPs but a rogue default gateway (10.20.40.50). This is the classic behavior of a rogue DHCP server, which intercepts DHCP traffic to manipulate client network settings, enabling man-in-the-middle attacks. The packet capture confirming DHCP offers from an unknown MAC address directly identifies the attack as a Rogue DHCP service.

Exam trap

The trap here is that candidates confuse the symptom (wrong gateway) with ARP poisoning or DNS attacks, but the key clue is the DHCP offer source and the faster response time, which uniquely identifies a rogue DHCP server.

How to eliminate wrong answers

Option A is wrong because ARP poisoning involves sending forged ARP replies to associate an attacker's MAC address with a legitimate IP, not distributing DHCP lease offers with a fake gateway. Option C is wrong because a replay attack would capture and retransmit valid DHCP offers from the real server, not generate new offers with a different gateway IP from an unauthorized MAC. Option D is wrong because DNS poisoning manipulates DNS resolution to redirect traffic to malicious sites, whereas this attack alters the default gateway at the network layer via DHCP, not DNS records.

Full explanation →

Multi-Selecthard

After several unauthorized edits to firewall objects caused a production outage, a security team wants one control that will flag future configuration drift and another that will automatically restore the approved baseline before the next maintenance window. Which two controls best meet that goal? Select two.

Select 2 answers

A.File integrity monitoring on firewall configuration files and rule exports.

B.Automated configuration management to reapply the approved baseline after drift.

C.A login banner warning administrators that unauthorized changes are monitored.

D.Mandatory annual security awareness training for all IT staff.

E.Quarterly business impact reviews of the firewall change log.

AnswersA, B

File integrity monitoring (FIM) works by generating cryptographic hashes of firewall configuration files and rule exports at a known-good state, then periodically re-hashing and comparing them to detect any unauthorized modification. When drift is detected, FIM alerts the security team to the exact file and time of change, enabling rapid investigation and remediation. This is a detective control because it identifies that unauthorized edits have occurred but does not automatically revert them.

Why this answer

File integrity monitoring (FIM) on firewall configuration files and rule exports (Option A) detects unauthorized changes by computing cryptographic hashes of baseline files and alerting on any deviation. This directly flags configuration drift, meeting the first requirement. Automated configuration management (Option B) can reapply the approved baseline from a version-controlled repository, restoring the correct state before the next maintenance window, satisfying the second requirement.

Exam trap

The trap here is that candidates may confuse passive controls like banners or training with active detection and remediation, or mistakenly think that a quarterly review meets the requirement for automatic restoration before the next maintenance window.

Full explanation →

MCQeasy

After a user signs in, a file server checks whether they can edit a shared folder. Which AAA concept is being applied?

A.Authentication

B.Authorization

C.Accounting

D.Encryption

AnswerB

Authorization determines what actions an authenticated user is allowed to perform. In this case, the server is checking whether the user has permission to edit the shared folder, not whether they are who they claim to be. This is a common access-control decision made after successful login.

Why this answer

The file server is checking whether the authenticated user has the specific permission to edit the shared folder. This is the definition of authorization: determining what an authenticated user is allowed to do. Authentication (A) only verifies identity, not rights; accounting (C) tracks usage; encryption (D) protects data in transit or at rest.

Exam trap

The trap here is confusing authentication with authorization: candidates often pick 'Authentication' because they think 'signing in' is the entire security process, but the question explicitly states the check happens after sign-in and is about editing rights, which is authorization.

How to eliminate wrong answers

Option A is wrong because authentication only verifies the user's identity (e.g., via password or certificate), not whether they can edit a folder. Option C is wrong because accounting logs and audits user actions (e.g., login times, file accesses) but does not enforce permissions. Option D is wrong because encryption (e.g., TLS or BitLocker) protects data confidentiality but does not control access rights.

Full explanation →

Multi-Selectmedium

Field staff use company-owned tablets that also run approved personal apps. Security needs business data isolated from personal data, the ability to wipe only corporate content, and enforcement of screen lock and encryption. Which two controls best fit? Select two.

Select 2 answers

A.Enroll the tablets in MDM and enforce encryption and a screen-lock PIN.

B.Use a managed work profile or container to separate corporate apps and data.

C.Allow rooted devices if the antivirus app is current.

D.Place all apps in one shared profile and use a single passcode for every user.

E.Disable remote wipe so personal photos are never affected.

AnswersA, B

Enrolling tablets in Mobile Device Management (MDM) directly addresses the need for isolating business data from personal data through containerisation or separate profiles. This mechanism also enables the crucial ability to selectively wipe only corporate content, leaving personal data untouched. Furthermore, MDM provides the capability to enforce essential security policies such as device encryption and a screen-lock PIN, satisfying all specified requirements for data protection and access control on mixed-use company devices.

Why this answer

Mobile Device Management (MDM) enforces security policies like encryption and screen-lock PIN across the device, meeting the requirements for data protection. Option B is correct because a managed work profile or container (e.g., Android Work Profile or iOS Managed Open In) isolates corporate apps and data from personal apps, allowing selective wipe of corporate content without affecting personal data.

Exam trap

The trap here is that candidates often confuse MDM with MAM (Mobile Application Management) and assume MDM alone provides data isolation, when in fact a managed work profile or container is required for selective wipe and app-level separation.

Full explanation →

MCQmedium

A web application was updated at 10:00. At 10:05, the SIEM reports a sharp rise in HTTP 500 errors and WAF blocks from the same source range. The application owner says customers are seeing failures only on the new checkout page. What is the best next step?

A.Close the incident because the WAF is blocking the suspicious traffic.

B.Correlate deployment, WAF, and application logs to determine whether the release or an attack caused the failures.

C.Disable all customer accounts until the failures disappear from the dashboard.

D.Increase the server's disk space and memory thresholds immediately.

AnswerB

This is the best next step because the timing strongly suggests either a bad deployment or an exploit attempt against the new checkout page. Correlating release records with WAF events and application logs helps determine whether the errors are caused by a coding defect, an input validation issue, or hostile traffic. That analysis lets the team respond appropriately instead of assuming the WAF alone has solved the problem.

Why this answer

The temporal correlation between the deployment at 10:00 and the spike in HTTP 500 errors and WAF blocks at 10:05 strongly suggests a causal relationship. The best next step is to correlate deployment logs, WAF logs, and application logs to determine whether the new checkout page code introduced a bug (causing 500 errors) or whether an attacker is exploiting a vulnerability in the new code (triggering WAF blocks). This diagnostic step avoids premature conclusions and ensures the root cause is identified before any remediation.

Exam trap

The trap here is that candidates may assume WAF blocks always indicate an attack and choose Option A, failing to recognize that a recent deployment could introduce bugs that cause both 500 errors and false positive WAF triggers.

How to eliminate wrong answers

Option A is wrong because closing the incident while customers are actively experiencing failures on the new checkout page ignores the business impact and the possibility that the WAF blocks are a symptom of a misconfigured release, not a successful defense. Option C is wrong because disabling all customer accounts is an extreme, disruptive action that would cause massive business harm without any evidence that accounts are compromised; the issue is isolated to a single page and likely a code or configuration problem. Option D is wrong because increasing disk space and memory thresholds does not address HTTP 500 errors or WAF blocks; these are application-layer or security-layer issues, not resource exhaustion problems.

Full explanation →

MCQmedium

Based on the exhibit, what type of web attack is most likely taking place?

A.Cross-site scripting, because the input is visible in the URL and causes an error.

B.SQL injection, because the attacker is manipulating the database query with crafted input.

C.Broken authentication, because the application returns a 500 error.

D.Insecure deserialization, because the application is parsing attacker-controlled data.

AnswerB

This is SQL injection because the input includes SQL control characters and logic that alter the intended query. The database error and the developer note about string concatenation confirm that user-supplied data is being inserted directly into SQL without parameterization. That makes the application vulnerable to query manipulation.

Why this answer

The exhibit shows a URL parameter (e.g., `id=1 OR 1=1`) that is being passed to a database query. The attacker is injecting SQL syntax to manipulate the query logic, which is the hallmark of SQL injection. The 500 error likely results from the database server crashing or returning an invalid result set, confirming that the injection is affecting the database.

Exam trap

The trap here is that candidates see the input in the URL and the error message and mistakenly associate them with cross-site scripting (XSS), failing to recognize that the error is a database server response, not a client-side script execution.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into a web page, not manipulating database queries; the visible input in the URL and the error are not indicative of XSS, which typically executes in the browser. Option C is wrong because broken authentication refers to flaws in session management or credential verification (e.g., weak passwords, session fixation), not to database query manipulation or server errors from SQL injection. Option D is wrong because insecure deserialization involves the processing of serialized objects (e.g., PHP or Java serialization) that can lead to remote code execution, not the direct injection of SQL commands into a URL parameter.

Full explanation →

Multi-Selectmedium

EDR flags a word processor that launched encoded PowerShell and then made an outbound HTTPS connection to a rare domain. Which two actions should the analyst take first from the EDR console? Select two.

Select 2 answers

A.Isolate the endpoint from the network to stop further communication and lateral movement.

B.Collect a live response package or volatile data from the host before remediation begins.

C.Uninstall the word processor immediately because it is the process that launched PowerShell.

D.Reboot the laptop right away to clear the encoded PowerShell process from memory.

E.Whitelist the rare domain temporarily to see whether the connection is business-related.

AnswersA, B

This is the primary containment action because the host shows behavior consistent with active compromise and command execution. Network isolation limits attacker reach, preserves the current state, and reduces the chance of credential theft or lateral movement. EDR-based isolation is fast, reversible, and appropriate before more invasive remediation steps.

Why this answer

Isolating the endpoint from the network immediately stops the outbound HTTPS connection to the rare domain, preventing data exfiltration and blocking potential lateral movement. This is a critical first step in containment, as the encoded PowerShell and rare domain strongly suggest a malicious payload or C2 communication.

Exam trap

The trap here is that candidates may prioritize remediation (uninstalling or rebooting) over containment and evidence preservation, failing to recognize that isolation and data collection are the mandated first steps in incident response according to NIST SP 800-61.

Full explanation →

MCQeasy

A web portal builds its database query by directly appending a user's search input. When the user types a single quote, the application returns a database error. Which attack is most likely?

A.Cross-site scripting

B.SQL injection

C.DNS poisoning

D.Privilege escalation

AnswerB

SQL injection occurs when untrusted user input is concatenated directly into a SQL statement without proper sanitization or parameterization. An attacker can craft input containing SQL metacharacters, such as a single quote and boolean operators, to break out of the intended query structure and manipulate the statement's logic—for example, bypassing WHERE conditions or adding UNION-based exfiltration. The resulting database error from the appended input is a classic indicator of an exploitable SQL injection, making this the correct answer.

Why this answer

The application directly concatenates user input into a database query without sanitization. When a single quote (') is appended, it breaks the SQL string delimiter, causing a syntax error that the database exposes. This is the classic indicator of a SQL injection vulnerability, where an attacker can manipulate the query structure.

Exam trap

The trap here is that candidates may confuse the immediate symptom (a database error) with cross-site scripting, but the single quote directly points to SQL syntax breakage, not script execution in the browser.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, not directly causing database errors via a single quote in a query. Option C is wrong because DNS poisoning corrupts DNS resolver caches to redirect traffic, not database query manipulation. Option D is wrong because privilege escalation is the act of gaining elevated access rights, not the injection technique that leads to unauthorized data access.

Full explanation →

MCQeasy

Based on the exhibit, what type of social engineering attack is the caller using?

A.Vishing, because the attacker is using a phone call to pressure the target.

B.Ransomware, because the caller is asking for money.

C.SQL injection, because the caller is asking for account details.

D.Tailgating, because the attacker mentions an executive assistant.

AnswerA

Vishing is a form of phishing that occurs over voice calls, where the attacker exploits authority, urgency, and intimidation to manipulate the target into disclosing sensitive information, such as financial credentials or personally identifiable information. The phone call in the exhibit creates a real-time, interactive channel that heightens pressure and reduces the target's opportunity to verify the request, which are hallmark characteristics of vishing.

Why this answer

The caller is using a phone call to impersonate a trusted figure (the CEO) and create urgency to pressure the target into violating security policy. This matches the definition of vishing (voice phishing), which relies on social engineering over voice channels to extract sensitive information or actions.

Exam trap

The trap here is that candidates may confuse the mention of 'asking for money' with ransomware, but ransomware is a technical malware attack, not a social engineering phone call, and the question explicitly describes a phone-based interaction.

How to eliminate wrong answers

Option B is wrong because ransomware is a type of malware that encrypts files and demands payment for decryption, not a social engineering attack conducted via phone call. Option C is wrong because SQL injection is a web application attack that exploits improper input validation to manipulate database queries, not a social engineering technique. Option D is wrong because tailgating is a physical security attack where an unauthorized person follows an authorized individual into a restricted area without proper authentication, not a phone-based social engineering tactic.

Full explanation →

MCQmedium

A SIEM analyst reviews authentication logs and sees the following pattern over 15 minutes: 68 different user accounts each had one failed login attempt from the same source IP, followed by no lockouts, and then one of the accounts successfully authenticated from that same IP using a valid password. What is the most likely explanation?

A.A brute-force attack against a single account using many password guesses.

B.A password spraying attack using common passwords across many accounts.

C.A replay attack using captured authentication traffic.

D.A successful SSO federation event after a directory sync delay.

AnswerB

This pattern matches password spraying because the attacker tests a small number of common guesses against many accounts to avoid lockouts.

Why this answer

The pattern of 68 different user accounts each experiencing a single failed login attempt from the same source IP, followed by one successful authentication from that IP using a valid password, is the classic signature of a password spraying attack. In password spraying, the attacker tries a small number of common passwords (often just one) against many accounts to avoid triggering account lockout policies, which typically lock an account after a small number of consecutive failures (e.g., 3–5 attempts). The single success indicates the attacker found an account using a weak or common password.

Exam trap

CompTIA often tests the distinction between brute-force (many passwords, one account) and password spraying (one password, many accounts), and the trap here is that candidates see 'failed login attempts' and immediately assume brute-force without noticing the unique pattern of one failure per account.

How to eliminate wrong answers

Option A is wrong because a brute-force attack against a single account would show many failed attempts for that one account (e.g., dozens or hundreds), not one failure each across 68 different accounts. Option C is wrong because a replay attack would involve capturing and retransmitting valid authentication traffic (e.g., Kerberos tickets or NTLM hashes), not a pattern of failed logins followed by a single success; replay attacks do not generate failed login events from the attacker's perspective. Option D is wrong because an SSO federation event after a directory sync delay would not produce 68 failed logins from the same IP; SSO events typically show a single successful authentication via a token or assertion (e.g., SAML response), not a spray of failures.

Full explanation →

MCQmedium

Security receives a company laptop used in an insider theft investigation. A manager wants the device moved to another office for review by legal staff. Which action best supports chain of custody?

A.Power on the laptop to confirm the user profile and recent activity before transport.

B.Place it in a labeled evidence bag, record the collector, time, location, and condition, and require signatures for each transfer.

C.Remove the drive and clone it without documenting the collection process.

D.Email a photo of the laptop to legal and leave the original on a desk.

AnswerB

Chain of custody depends on proving who handled the evidence, when, where, and in what condition. Documenting the device at collection, sealing it appropriately, and recording every transfer creates a defensible record that supports legal review. This approach reduces the risk of tampering claims and helps establish that the laptop was preserved from the moment it was seized until it reaches legal or forensic personnel.

Why this answer

It follows the formal chain of custody process required for evidence handling. Placing the laptop in a labeled evidence bag with documented collector, time, location, and condition, along with requiring signatures for each transfer, ensures the integrity and admissibility of evidence by creating an unbroken audit trail. This aligns with NIST SP 800-86 and forensic best practices for maintaining custody of digital evidence.

Exam trap

CompTIA often tests the misconception that simply securing the device or performing preliminary analysis is sufficient, but the trap here is that any action altering the device state or lacking formal documentation breaks the chain of custody, even if the intent is to preserve evidence.

How to eliminate wrong answers

Option A is wrong because powering on the laptop alters system state, modifies timestamps, and can trigger encryption or anti-forensic mechanisms, thereby breaking the chain of custody and potentially destroying volatile evidence. Option C is wrong because removing the drive and cloning it without documenting the collection process violates chain of custody requirements; proper documentation of each step, including drive removal and cloning, is essential for evidence integrity. Option D is wrong because emailing a photo and leaving the original on a desk fails to secure the device, does not document transfer or condition, and provides no chain of custody, making the evidence inadmissible.

Full explanation →

Matchingmedium

Match each awareness-program metric to the interpretation the security team should use. 1. 8% of users clicked the simulated phishing link. 2. 34% of users reported the simulation using the report-phish button. 3. The median time from message delivery to first user report was 12 minutes. 4. 96% of staff completed the annual awareness module.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Click rate

Report rate

Time to report

Training completion rate

Why these pairings

Each metric guides interpretation: click rate indicates susceptibility, report rate shows security culture, reaction time measures responsiveness, and completion rate reflects training adoption.

Full explanation →

Matchingeasy

Match each control type to the most fitting example in a branch office.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Secure boot refuses to start untrusted boot code.

A log review process shows when an administrator changed a firewall rule.

A damaged endpoint is restored from a known-good image.

A camera above the server rack makes misuse less likely.

A written standard tells staff how to handle removable media.

A restricted jump box is used until direct admin access is approved again.

Why these pairings

Preventive controls block incidents; detective controls identify them; corrective controls restore operations; deterrent controls discourage attacks; compensating controls provide alternative protection; physical controls secure physical access.

Full explanation →

MCQhard

A contractor signs in to a project portal that fronts several SaaS tools. Access must be granted only if all of the following are true: the user is assigned to the project, the device is managed, and the request occurs during the approved maintenance window. Which access model best supports this requirement?

A.Role-based access control because the contractor has one project role

B.Attribute-based access control because multiple runtime attributes determine access

C.Single sign-on because the user should not log in more than once

D.Privileged access management because the contractor needs temporary access

AnswerB

ABAC is the best fit because the decision depends on several attributes evaluated dynamically: user assignment, device status, and time of request. This lets the organization express a policy that is more precise than a static role and better aligned to least privilege. In a federated portal, ABAC can also work alongside identity assertions to make access decisions at sign-in and during session use.

Why this answer

Attribute-based access control (ABAC) evaluates multiple runtime attributes—such as user-project assignment, device management status, and time of request—against policies to grant access. This matches the requirement because all three conditions must be true simultaneously, and ABAC can combine subject, resource, and environment attributes in a single policy rule. Role-based access control (RBAC) would only check the user's role, not device or time attributes.

Exam trap

The trap here is that candidates see 'contractor' and 'project' and immediately think of RBAC roles, overlooking that the requirement explicitly demands evaluation of multiple runtime attributes (device managed, maintenance window) which only ABAC can handle dynamically.

How to eliminate wrong answers

Option A is wrong because RBAC grants access based solely on a user's role (e.g., 'contractor'), not on dynamic runtime attributes like device management status or time of day; it cannot enforce the multi-condition logic required. Option C is wrong because single sign-on (SSO) only provides a unified authentication experience (e.g., using SAML or OIDC) and does not enforce authorization policies based on device or time attributes. Option D is wrong because privileged access management (PAM) is designed to control and audit elevated access (e.g., admin credentials or just-in-time privileges), not to evaluate general access conditions like project assignment or device compliance.

Full explanation →

MCQeasy

A user reports a suspicious pop-up on a workstation and the SOC suspects malware. Which action should the responder take first to contain the threat?

A.Disconnect the workstation from the network

B.Wipe the workstation immediately

C.Return the workstation to the user after restarting it

D.Wait until the next patch cycle to see if the issue disappears

AnswerA

Disconnecting the workstation from the network is the immediate containment step in incident response. It severs the host's ability to communicate with any command-and-control (C2) infrastructure, preventing the malware from receiving instructions, exfiltrating data, or using the host to pivot and move laterally to other systems. Unlike disruptive actions, isolation preserves the current state of memory and disk, allowing forensic evidence to be collected intact while stopping the attack's spread.

Why this answer

Disconnecting the workstation from the network immediately isolates the suspected malware, preventing it from communicating with command-and-control (C2) servers, spreading laterally to other hosts, or exfiltrating data. This is the first step in the NIST incident response containment phase, as it stops network-based propagation without destroying forensic evidence.

Exam trap

CompTIA often tests the misconception that immediate eradication (wiping) is the first step, but the correct order is containment first to stop the spread, then eradication and recovery.

How to eliminate wrong answers

Option B is wrong because wiping the workstation destroys volatile data and forensic artifacts (e.g., memory dumps, logs, malware binaries) that are critical for analysis and attribution. Option C is wrong because restarting the workstation may allow malware to execute persistence mechanisms or trigger destructive payloads, and returning it to the user risks further compromise. Option D is wrong because waiting for the next patch cycle leaves the threat active, allowing the malware to spread, escalate privileges, or cause data loss, violating the principle of timely containment.

Full explanation →

Matchinghard

Match each SOC alert artifact to the most useful investigation pivot. Each pivot should help determine whether the alert is a true incident, a false positive, or part of a broader campaign.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Check whether the pattern matches password spraying across accounts rather than a brute-force attempt on one user.

Pivot to parent-child process trees and script-block telemetry on the endpoint.

Compare the query pattern and periodicity for possible DNS tunneling or beaconing.

Correlate with scheduled tasks, recent file creation, and account activity for staging or exfiltration.

Review token/session logs and conditional-access telemetry to see whether a hijacked session or relay attack occurred.

Why these pairings

Each artifact is matched to a pivot that directly aids in verifying the alert's validity, whether by checking reputation, correlating with threat intelligence, or comparing against normal behavior.

Full explanation →

MCQeasy

A user says their files suddenly have a new extension and a note appears demanding payment to restore access. Which type of malware is most likely involved?

A.Ransomware

B.Adware

C.Spam filter

D.Screen saver

AnswerA

Crypto-ransomware, such as the notorious Ryuk or LockBit variants, encrypts user files using symmetric algorithms like AES, then appends a unique extension to each affected file to mark it as compromised. A ransom note is then dropped in each directory, instructing the victim to pay a cryptocurrency ransom in exchange for the decryption key, which perfectly matches the sudden file extension and note appearance described.

Why this answer

Ransomware is the correct answer because it specifically encrypts files and appends a new extension, then displays a ransom note demanding payment for decryption. This matches the user's description of files becoming inaccessible with a new extension and a payment demand.

Exam trap

The trap here is that candidates may confuse ransomware with adware or other malware types, but the key differentiator is the combination of file encryption, extension change, and a ransom demand.

How to eliminate wrong answers

Option B (Adware) is wrong because adware displays unwanted advertisements and does not encrypt files or demand ransom payments. Option C (Spam filter) is wrong because a spam filter is a security tool that blocks unwanted email, not a type of malware that modifies files. Option D (Screen saver) is wrong because a screen saver is a benign utility that prevents screen burn-in and has no capability to encrypt files or demand payments.

Full explanation →

MCQmedium

A Linux operations team is building a new production gold image for database servers. Security requires every build to disable password-based SSH, enable audit logging, use the company NTP servers, and remove the desktop package set. The admins need a document that defines these exact required settings and allows exceptions only through formal approval. Which artifact should be used?

A.Policy

B.Baseline

C.Guideline

D.Procedure

AnswerB

A baseline is a documented, approved set of configuration settings and hardening rules that represent the minimum acceptable security posture for a system or environment. It is exactly what is needed for a production gold image, as it specifies exact values for file permissions, user account settings, service configurations, and other system parameters. Baselines are often derived from industry standards such as CIS Benchmarks or STIGs, making them concrete and verifiable.

Why this answer

A baseline defines the minimum security configuration that must be applied to all systems, such as disabling password-based SSH, enabling audit logging, using specific NTP servers, and removing unnecessary packages. It is the correct artifact because it specifies required settings and allows exceptions only through formal approval, which aligns with the scenario's need for a mandatory configuration standard. Policies are high-level statements of intent, guidelines are recommendations, and procedures are step-by-step instructions, none of which enforce mandatory settings with exception control.

Exam trap

The trap here is confusing a policy (high-level intent) with a baseline (specific mandatory settings), leading candidates to choose 'Policy' because they think it governs all security, but baselines are the actual technical enforcement documents that require formal exceptions.

How to eliminate wrong answers

Option A is wrong because a policy is a high-level statement of management intent (e.g., 'All systems must be secure') and does not define specific technical settings like disabling password-based SSH or removing desktop packages. Option C is wrong because a guideline is a recommendation or best practice that is not mandatory and does not enforce required settings or require formal approval for exceptions. Option D is wrong because a procedure is a detailed step-by-step process for performing a task (e.g., how to install an OS), not a document that defines required configuration settings with exception control.

Full explanation →

MCQmedium

A business unit is worried about the financial impact of a rare but severe data center outage. After reviewing the risk register, leadership decides to purchase cyber insurance and document the remaining exposure rather than redesign the entire platform. Which risk treatment is this?

A.Risk transfer

B.Risk avoidance

C.Risk mitigation

D.Risk acceptance

AnswerA

Risk transfer is the correct classification because purchasing an insurance policy shifts the financial consequences of a rare, disruptive event to an external insurer in exchange for a fixed premium. This does not eliminate the operational risk or reduce the probability of the event; it only ensures that the monetary loss is compensated by a third party. This strategy is ideal for low-probability, high-impact risks where the financial loss could otherwise threaten the business unit's viability.

Why this answer

(Risk transfer) because purchasing cyber insurance transfers the financial risk of a data center outage to an insurance provider. The business unit is not avoiding the risk by redesigning the platform, nor are they mitigating it through technical controls; they are simply documenting the residual exposure after transferring the monetary impact. This aligns with the risk treatment strategy of shifting the burden of loss to a third party.

Exam trap

The trap here is that candidates confuse risk transfer (shifting financial liability) with risk mitigation (reducing probability/impact via technical controls), especially when the scenario mentions 'documenting the remaining exposure'—which is a hallmark of risk acceptance, not mitigation.

How to eliminate wrong answers

Option B (Risk avoidance) is wrong because the business unit is not eliminating the risk by ceasing operations or redesigning the platform; they are accepting the outage's possibility and insuring against it. Option C (Risk mitigation) is wrong because mitigation involves implementing controls (e.g., redundancy, failover clusters, or backup power) to reduce the likelihood or impact of the outage, not purchasing insurance to cover financial losses.

Full explanation →

MCQmedium

A help desk analyst receives a ticket stating that an employee got an urgent text message from someone claiming to be the CEO. The message asked the employee to buy gift cards and send the redemption codes immediately. What attack is most likely taking place?

A.Phishing, because the attacker is trying to steal information through a deceptive message sent to a user.

B.Smishing, because the attacker is using SMS or text messaging to trick the employee into taking an action.

C.Vishing, because the attacker is using a phone call to pressure the employee into complying.

D.Baiting, because the attacker is tempting the user with a reward in exchange for cooperation.

AnswerB

Smishing is phishing delivered through text messaging. The attacker is impersonating an executive and creating urgency to pressure the employee into buying gift cards and revealing codes. That combination of mobile delivery, impersonation, and urgency fits a text-based social engineering attack.

Why this answer

The attack uses SMS/text messaging as the delivery vector, which is the defining characteristic of smishing. The urgent request to buy gift cards and send redemption codes is a classic social engineering tactic designed to exploit the employee's trust in the CEO's authority, not to steal credentials or install malware directly.

Exam trap

The trap here is that candidates may confuse smishing with general phishing (Option A) because both involve deceptive messages, but the exam specifically tests the delivery vector—SMS vs. email—as the key differentiator for attack classification.

How to eliminate wrong answers

Option A is wrong because phishing typically refers to broader email-based attacks, not specifically SMS/text messages; while smishing is a subset of phishing, the question explicitly describes a text message, making smishing the more precise term. Option C is wrong because vishing (voice phishing) requires a phone call, not a text message; the scenario lacks any mention of a voice interaction. Option D is wrong because baiting involves offering a fake reward or enticement (e.g., free download or USB drop) to trick the user, whereas this attack uses a direct request for action under false authority, not a lure.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 1–75