Security+ SY0-701 SY0-701 Questions 676–750 | Page 10/14

676

MCQhard

Based on the exhibit, which metric best shows that employees are recognizing and escalating phishing attempts more quickly?

A.Click rate, because a lower click rate is the only useful awareness metric.

B.Training completion rate, because it proves every employee attended the awareness session.

C.Median report time, because it shows how quickly users notify security after spotting a phish.

D.Number of simulation emails sent, because a larger campaign is always a better metric.

AnswerC

Median report time best demonstrates faster recognition and escalation, which reduces attacker dwell time and improves response. In the exhibit, the median time dropped from 8 minutes to 3 minutes, showing better behavior under pressure. Click rate is still useful, but quick reporting is the stronger indicator of resilience and response readiness.

Why this answer

The median report time directly measures the speed at which employees notify the security team after identifying a phishing simulation email. A decreasing median report time indicates that users are recognizing phishing attempts more quickly and escalating them, which is the key behavioral change this metric captures. Unlike click rate, which only measures failure, report time measures the positive action of reporting.

Exam trap

The SY0-701 exam often tests the distinction between metrics that measure awareness (e.g., training completion) versus metrics that measure behavioral change (e.g., median report time), and candidates mistakenly choose click rate because it is a common phishing metric, but it does not capture the speed of escalation.

How to eliminate wrong answers

Option A is wrong because click rate measures the percentage of users who clicked a phishing link, which indicates failure to recognize a phish, not the speed of recognition or escalation; a lower click rate is useful but does not show how quickly users report. Option B is wrong because training completion rate only proves attendance, not whether employees learned to recognize or escalate phishing attempts; it is a proxy for exposure, not effectiveness. Option D is wrong because the number of simulation emails sent is a measure of campaign scale, not user behavior; a larger campaign does not inherently indicate faster recognition or reporting.

Full explanation →

677

MCQeasy

A hospital is deploying a new medical imaging system that stores patient data. The system must ensure that data remains confidential even if the physical storage media is stolen. Which of the following controls should be implemented?

A.Full-disk encryption (FDE) on the storage media.

B.Regular security awareness training for staff.

C.Network segmentation using VLANs.

D.File-level access controls based on user roles.

AnswerA

Full-disk encryption encrypts all data on the storage media, rendering it unreadable without the decryption key. If the physical media is stolen, the data remains confidential because the thief cannot access it without the key. This directly addresses the requirement to protect data at rest in the event of physical theft, making it the appropriate control.

Why this answer

The correct answer is full-disk encryption. It is the only control that ensures data confidentiality if the physical storage media is stolen, because the data is encrypted and inaccessible without the key. Other options address access control, network security, or user awareness, none of which protect data at rest against physical theft.

Exam trap

The trap here is confusing access controls or network segmentation with data-at-rest protection, which are ineffective if the physical drive is stolen.

Full explanation →

678

MCQeasy

After a workstation hardening baseline is updated, the security team wants to confirm that finance laptops actually match the new settings. Which control is the best way to verify this?

A.Run a configuration compliance scan against the updated baseline

B.Ask users whether they think their laptops are secure

C.Assume the baseline was applied because the change ticket was approved

D.Delete the old baseline so there is only one policy to reference

AnswerA

A configuration compliance scan is the definitive verification method because it programmatically compares each endpoint's actual registry keys, service states, group policy settings, and installed software against the approved hardening baseline. This identifies even minor deviations such as a disabled firewall rule or an outdated patch level, giving security teams concrete evidence of compliance or drift. Unlike subjective assessments, a scan produces reproducible, auditable results that directly reflect whether the updated baseline was successfully deployed.

Why this answer

A configuration compliance scan compares the current settings of the finance laptops against the updated hardening baseline. This automated process checks specific registry keys, file permissions, service states, and security policy settings (e.g., via SCAP or CIS benchmarks) to verify alignment. It provides objective, measurable evidence of compliance, unlike subjective user feedback or assumptions.

Exam trap

The trap here is that candidates may confuse change management approval (Option C) with actual technical verification, overlooking the need for a direct compliance check to confirm implementation.

How to eliminate wrong answers

Option B is wrong because asking users whether they think their laptops are secure relies on subjective opinion and lacks technical verification; users cannot accurately assess registry settings, service configurations, or Group Policy objects. Option C is wrong because assuming the baseline was applied based solely on an approved change ticket ignores the possibility of failed deployments, manual overrides, or configuration drift; change management does not guarantee technical enforcement. Option D is wrong because deleting the old baseline does not verify that the new settings are actually applied; it only removes a reference point, leaving no way to measure compliance or detect deviations.

Full explanation →

679

MCQeasy

A policy states that sensitive data must be encrypted, but it does not say which encryption strength to use. The security architect wants a document that lists the exact approved encryption settings for systems to follow. What document is needed?

A.A procedure, because it explains the step-by-step order for handling every file.

B.A standard, because it specifies the required technical values and configurations.

C.A guideline, because it gives suggestions that teams may choose to adopt.

D.A memo, because it is the fastest way to tell teams about a new requirement.

AnswerB

A standard is the right document when the organization needs exact, mandatory technical settings such as approved encryption strength or configuration values. The policy provides the high-level requirement, while the standard translates that requirement into measurable controls that systems and auditors can follow consistently.

Why this answer

A standard is the correct document because it mandates specific, measurable technical requirements—such as exact encryption algorithms (e.g., AES-256), key lengths, and cipher modes (e.g., GCM)—that systems must follow to comply with the policy. Unlike a policy, which states a goal (e.g., 'encrypt sensitive data'), a standard provides the enforceable configuration baseline that the security architect needs.

Exam trap

The trap here is confusing a standard with a guideline: candidates often pick 'guideline' because both documents provide technical details, but a standard is mandatory and prescriptive, while a guideline is advisory and flexible.

How to eliminate wrong answers

Option A is wrong because a procedure details the step-by-step order for performing a task (e.g., how to encrypt a file using a specific tool), not the approved encryption settings themselves. Option C is wrong because a guideline offers recommendations or best practices that teams may choose to adopt, but the security architect requires mandatory, exact values, not optional suggestions. Option D is wrong because a memo is an informal communication method, not a formal document that defines technical requirements; it lacks the authority and precision needed for enforcing encryption configurations.

Full explanation →

680

MCQhard

Based on the exhibit, which governance artifact is being described?

A.Policy, because it states broad organizational intent without requiring specific settings.

B.Standard, because it defines mandatory requirements but does not describe a step-by-step process.

C.Procedure, because it explains the exact sequence an administrator should follow to secure the device.

D.Baseline, because it defines the approved minimum configuration that systems must meet.

AnswerD

The exhibit is labeled as a minimum configuration and lists required settings that establish the approved security floor for all laptops. That is the classic purpose of a baseline. It provides a reference point for configuration consistency and drift detection, and it is often approved by security and technical owners together. The annual review cycle also fits a controlled baseline update process.

Why this answer

The exhibit describes a baseline because it specifies the approved minimum configuration settings that systems must meet, such as requiring AES-256 encryption, disabling weak protocols like SSL and TLS 1.0, and enforcing a minimum password length of 14 characters. These are mandatory security thresholds, not broad intent, step-by-step instructions, or optional standards.

Exam trap

The trap here is that candidates confuse a standard with a baseline, but a standard is a broader mandatory requirement (e.g., 'use encryption') while a baseline specifies the exact minimum acceptable configuration (e.g., 'use AES-256 with a key length of 256 bits').

How to eliminate wrong answers

Option A is wrong because a policy states broad organizational intent and high-level goals, not specific configuration settings like 'AES-256 encryption' or 'disable SSL/TLS 1.0'. Option B is wrong because a standard defines mandatory requirements but does not include the specific numeric thresholds or approved minimum values that a baseline does; the exhibit lists exact minimums (e.g., 14-character passwords), which is characteristic of a baseline. Option C is wrong because a procedure provides a step-by-step sequence of actions, whereas the exhibit only lists required configuration states without any ordered instructions.

Full explanation →

681

MCQmedium

A company is placing a customer-facing web application behind a new security control. The team wants to block malicious HTTP requests such as injection attempts before they reach the application server, with minimal code changes to the app itself. Which control is the best fit?

A.Network access control (NAC) at the switch port.

B.Web application firewall (WAF) in front of the application.

C.Data loss prevention (DLP) on the email gateway.

D.Endpoint detection and response (EDR) on the web server only.

AnswerB

A web application firewall (WAF) is purpose-built to protect web applications by inspecting HTTP/HTTPS traffic at the application layer and filtering malicious requests using signature-based and behavioral rules. It understands web protocols, allowing it to block common exploits such as SQL injection, cross-site scripting (XSS), and CSRF without requiring changes to application code. Deploying a WAF inline in front of the application provides real-time, proactive filtering of inbound requests before they reach the server, making it the correct control for this scenario.

Why this answer

A web application firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7), blocking malicious payloads such as SQL injection and cross-site scripting (XSS) before they reach the web server. It operates without requiring changes to the application code, making it the ideal choice for this scenario.

Exam trap

The trap here is that candidates may confuse a WAF with a network firewall or NAC, thinking any 'security control' placed in front of a server can block application-layer attacks, but only a WAF operates at Layer 7 with HTTP-specific inspection capabilities.

How to eliminate wrong answers

Option A is wrong because Network Access Control (NAC) operates at Layer 2/3 to enforce access policies based on device posture or authentication at the switch port, and it cannot inspect or block application-layer HTTP attacks like injection attempts. Option C is wrong because Data Loss Prevention (DLP) on the email gateway is designed to monitor and prevent exfiltration of sensitive data in email traffic, not to filter malicious HTTP requests targeting a web application. Option D is wrong because Endpoint Detection and Response (EDR) on the web server only detects and responds to threats at the host level after they have reached the server, whereas the requirement is to block attacks before they reach the application server with minimal code changes.

Full explanation →

682

MCQeasy

A customer-facing website must stay available if one of two application servers fails. Which design should the team implement?

A.A single server with a larger power supply

B.A load balancer in front of multiple application servers

C.A daily screenshot of the website

D.A more restrictive password policy

AnswerB

A load balancer distributes traffic across both application servers and health-checks them, so failure of one is transparent to users. This directly satisfies the availability constraint, which a single server, DNS round-robin without health checks, or vertical scaling cannot guarantee.

Why this answer

A load balancer distributes incoming traffic across multiple application servers, providing high availability and fault tolerance. If one server fails, the load balancer automatically redirects traffic to the remaining healthy server(s), ensuring the website remains accessible. This design directly addresses the requirement for continued availability despite a single server failure.

Exam trap

The trap here is that candidates may confuse high availability with other security or operational measures, such as backups or password policies, failing to recognize that only redundant infrastructure with automatic failover can maintain uptime during a server failure.

How to eliminate wrong answers

Option A is wrong because a larger power supply only addresses power redundancy for a single server, not server-level failure; if the server itself fails, the website goes down regardless of power capacity. Option C is wrong because a daily screenshot captures a static image of the website at a point in time and does nothing to maintain live availability or handle server failures. Option D is wrong because a more restrictive password policy improves authentication security but has no impact on server redundancy or application availability.

Full explanation →

683

MCQmedium

An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?

A.Power off the server immediately to stop all attacker activity

B.Isolate the server from the network while keeping it powered on

C.Start restoring from backup before collecting any logs or memory data

D.Delete the ransomware note and suspicious files to reduce business disruption

AnswerB

Network isolation, such as unplugging the cable or applying a host-based firewall rule, halts the ransomware's ability to encrypt additional shares and disrupts command-and-control channels, effectively containing the blast radius. Keeping the server powered preserves memory-resident data, including the malicious process, open handles, and potential encryption keys, which can be harvested via a memory dump for attribution and recovery. This approach balances incident containment with evidence preservation, and should be executed in a way that doesn't delete or alter on-disk artifacts.

Why this answer

The correct first step is to isolate the server from the network while keeping it powered on. This preserves volatile evidence (e.g., memory, running processes, network connections) that is critical for forensic analysis and understanding the ransomware's entry vector. Powering off would destroy this data, and restoring from backup prematurely could reintroduce the infection or miss evidence needed to prevent recurrence.

Exam trap

The trap here is that candidates often assume immediate power-off is the safest containment action, but CompTIA emphasizes preserving volatile evidence first, as powering off destroys critical forensic data that may be needed for decryption or attribution.

How to eliminate wrong answers

Option A is wrong because powering off the server immediately destroys volatile data in RAM (e.g., encryption keys, active network connections, process artifacts) that are essential for forensic analysis and may be needed to decrypt files or identify the ransomware variant. Option C is wrong because restoring from backup before collecting logs or memory data risks restoring an infected state or missing evidence that could reveal how the ransomware entered, allowing it to strike again.

Full explanation →

684

MCQmedium

A security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of outbound traffic from a single internal workstation to an external IP address known to be associated with a command-and-control (C2) server. The workstation's user reports no unusual activity. Which of the following should the analyst do FIRST?

A.Disconnect the workstation from the network.

B.Run a full antivirus scan on the workstation.

C.Review firewall logs to see if the traffic is being blocked.

D.Inform the user to shut down the workstation.

AnswerA

Disconnecting the workstation from the network is the immediate containment action because it severs the active command-and-control channel, preventing data exfiltration and halting any further lateral movement. Unlike shutting down, this preserves volatile evidence such as running processes, open network connections, and memory-resident malware, which are critical for forensic analysis and determining the full scope of the compromise.

Why this answer

The IDS alert indicates a high volume of outbound traffic to a known C2 server, which strongly suggests the workstation is compromised and communicating with an attacker. Disconnecting the workstation from the network (Option A) is the immediate containment step to prevent data exfiltration and further C2 communication, following the NIST incident response framework's containment phase. This action stops the threat at the network layer without waiting for additional analysis.

Exam trap

CompTIA often tests the principle that containment (disconnecting the network) must precede eradication (antivirus scan) or analysis (log review), and the trap here is that candidates choose a less disruptive step like running a scan or checking logs, thinking they need more data before acting.

Why the other options are wrong

Running a full antivirus scan is a secondary step after containing the threat; the immediate priority is to stop potential data exfiltration or further C2 communication by disconnecting the workstation from the network.

Reviewing firewall logs to see if traffic is being blocked is a secondary step; the immediate priority is to contain the potential compromise by disconnecting the workstation from the network to prevent further C2 communication.

In this scenario, the priority is to contain the potential compromise immediately by disconnecting the workstation from the network. Instructing the user to shut down the workstation could destroy volatile evidence (e.g., memory contents) and does not prevent the C2 traffic from continuing during the shutdown process.

When would these options actually be correct?

This would be the correct first step if the alert indicated a low-priority anomaly (e.g., a single outbound connection to a non-malicious IP) and the analyst needed to verify the workstation's security posture before escalating.

This option would be correct if the question asked: 'After containing a potential C2 infection, which step should the analyst take to verify if the IDS alert was a false positive?' In that scenario, reviewing firewall logs helps confirm whether the traffic was actually blocked or allowed.

This option would be correct if the question stated that the workstation is exhibiting signs of a severe malware infection (e.g., ransomware encrypting files) and the analyst's goal is to prevent further damage to the system itself, with network containment already in place or not the primary concern.

Why candidates pick the wrong answer

Candidates often default to scanning as a standard response to malware alerts, overlooking that containment is critical when active C2 traffic is detected.

Candidates may think that checking firewall logs is a quick way to validate the alert without disrupting the user, but they overlook the urgency of stopping active C2 traffic.

Candidates may think shutting down the workstation is a quick way to stop the traffic and prevent further damage, but they overlook the need to preserve evidence and the fact that disconnecting the network is a more effective containment step.

Full explanation →

685

MCQmedium

During triage, you see a legitimate browser process spawning powershell.exe with an encoded command, followed by an outbound connection to a newly registered domain. No new executable is written to disk. Which malware characteristic best fits this behavior?

A.Fileless malware that relies on scripting and memory-resident execution.

B.A macro virus that only runs when a document is opened.

C.A boot sector virus that persists by altering startup code.

D.A logic bomb that activates only when a specific date or event is reached.

AnswerA

This pattern matches malware that abuses trusted processes and scripts instead of dropping a traditional executable file. Browser-to-PowerShell chaining, encoded commands, and memory-resident activity are common indicators. The lack of a new file on disk does not mean the endpoint is clean; it often means the attacker is trying to evade traditional file-based detection.

Why this answer

The described behavior—a legitimate browser process spawning PowerShell with an encoded command, executing in memory without writing a new executable to disk, and making an outbound connection to a newly registered domain—is the classic hallmark of fileless malware. Fileless malware leverages built-in scripting engines (like PowerShell) and runs entirely in memory, avoiding traditional disk-based detection by antivirus and forensic tools.

Exam trap

The trap here is that candidates may assume any malware that doesn't write a file is a 'macro virus' or 'boot sector virus,' but the key differentiator is the use of a scripting engine (PowerShell) spawned by a legitimate process, combined with memory-only execution and an immediate C2 connection, which uniquely defines fileless malware.

How to eliminate wrong answers

Option B is wrong because a macro virus requires a document to be opened and typically writes a macro to the document or template, whereas the scenario involves a browser process spawning PowerShell with an encoded command and no document interaction. Option C is wrong because a boot sector virus alters the Master Boot Record (MBR) or Volume Boot Record (VBR) to persist on disk at system startup, but the scenario shows no disk write and execution is memory-resident via a scripting engine. Option D is wrong because a logic bomb triggers only when a specific condition (date, event, or user action) is met, but the scenario describes an immediate outbound connection following the PowerShell execution, with no mention of a delayed or conditional trigger.

Full explanation →

686

MCQmedium

Based on the exhibit, which metric best indicates improved phishing resistance?

A.Training completion rate.

B.Number of phishing emails sent by attackers.

C.Phish report rate.

D.Total number of help desk tickets.

AnswerC

Phish report rate measures the proportion of simulated or real phishing deliveries that users report through the designated reporting mechanism. It directly reflects whether employees are not only recognizing suspicious messages but also taking the correct security action, making it a leading indicator of phishing resistance. Higher report rates typically correlate with lower engagement with malicious emails and better SOC visibility.

Why this answer

The phish report rate measures how many users report a simulated phishing email to the security team, which directly indicates their ability to recognize and respond to phishing attempts. A higher report rate demonstrates improved security awareness and resistance because users are actively identifying threats rather than ignoring or falling for them. This metric is a key performance indicator in security awareness programs because it reflects behavioral change, not just training completion.

Exam trap

CompTIA often tests the misconception that training completion rate (Option A) is the best indicator of security awareness, but the exam emphasizes that behavioral metrics like phish report rate are more meaningful because they measure actual user response to threats.

How to eliminate wrong answers

Option A is wrong because training completion rate only measures whether users finished the training module, not whether they retained or applied the knowledge to resist phishing attacks. Option B is wrong because the number of phishing emails sent by attackers is an external threat metric that the organization cannot control and does not reflect user resistance or program effectiveness. Option D is wrong because the total number of help desk tickets is a broad metric that includes many unrelated issues (e.g., password resets, software problems) and does not specifically measure phishing resistance or user reporting behavior.

Full explanation →

687

MCQeasy

A user reports that their laptop is showing frequent pop-up ads, the browser homepage keeps changing, and the system has become noticeably slower. What is the most likely immediate containment action?

A.Keep the laptop online so security tools can continue collecting data

B.Disconnect the laptop from the network and begin endpoint isolation

C.Immediately reimage the laptop before preserving any evidence

D.Ask the user to uninstall the browser and reinstall it manually

AnswerB

Disconnecting the laptop and isolating the endpoint halts any active malicious network activity, preventing lateral movement and cutting off command-and-control channels before the investigation proceeds. This containment step is the top priority in incident response because it preserves volatile data, such as running processes and network connections, while ensuring the threat cannot spread to other hosts. After isolation, analysts can safely perform triage, evidence preservation, and forensic data collection.

Why this answer

The best immediate action is to isolate the laptop from the network. The symptoms suggest malicious or unwanted software may be communicating with outside servers or affecting the browser. Isolation limits further damage, prevents possible spread, and gives responders time to inspect the system safely. This is a standard first containment step when a workstation appears compromised but is still active.

Why others are wrong: Keeping the laptop online risks continued malicious activity. Reimaging too early can destroy evidence needed for root-cause analysis. Simply reinstalling the browser may remove a symptom, but it does not address the possibility of a broader endpoint compromise.

Full explanation →

688

MCQmedium

A SOC analyst receives an EDR alert showing a finance laptop creating encrypted archives and then attempting SMB connections to several internal file shares. The user is still logged in, and the business wants to stop possible spread without destroying volatile evidence. What should the analyst do first?

A.Power off the laptop immediately to stop all activity.

B.Isolate the endpoint from the network using the EDR containment feature.

C.Reimage the laptop from a gold image as soon as possible.

D.Disable the user account in Active Directory and wait for the malware to stop.

AnswerB

EDR network containment severs the host's connections while leaving the machine running, halting lateral SMB spread to file shares and preserving volatile memory, running processes and logged-on session state. That satisfies both the stop-spread and evidence-preservation constraints before any remediation.

Why this answer

The EDR containment feature isolates the endpoint from the network while preserving all running processes, memory, and disk state. This stops the encrypted archives from being exfiltrated via SMB and prevents lateral movement, but keeps volatile evidence (e.g., active malware processes, network connections) intact for forensic analysis.

Exam trap

The trap here is that candidates confuse 'stopping the spread' with 'destroying evidence,' and choose power-off or reimage, failing to recognize that containment in EDR is designed specifically to halt network propagation while preserving forensic data.

How to eliminate wrong answers

Option A is wrong because powering off the laptop destroys volatile evidence (e.g., memory-resident malware, active network connections, encryption keys in RAM) and may trigger anti-forensic mechanisms. Option C is wrong because reimaging wipes all data, including critical forensic artifacts like the encrypted archives, malware binaries, and registry changes, making incident response impossible. Option D is wrong because disabling the user account does not stop the malware already running on the laptop from continuing its SMB connections and encryption activity, as the process operates with the user's cached credentials or tokens.

Full explanation →

689

MCQmedium

A finance clerk reports a call from a person who claimed to be from the bank's fraud department. The caller knew the employee's name, referenced a recent invoice, and asked the employee to read back a one-time MFA code to stop a supposed payment block. Which attack is most likely?

A.Vishing, because the attacker is using a voice call to manipulate the target in real time.

B.Smishing, because the attacker requested a code and mentioned a financial problem.

C.Baiting, because the caller offered to fix the payment issue for the employee.

D.Tailgating, because the attacker used a trusted identity to gain access.

AnswerA

Vishing is voice-based phishing. The attacker used a phone call, gained trust with specific details, and pressured the employee to reveal an MFA code. That real-time conversation and the request for a secret value are classic indicators of a voice social engineering attempt.

Why this answer

The attack is vishing (voice phishing) because the attacker uses a telephone call to socially engineer the target into divulging a one-time MFA code. The real-time voice interaction and the specific request for an authentication code are hallmarks of vishing, which exploits human trust rather than technical vulnerabilities.

Exam trap

The trap here is confusing the delivery method (voice vs. text) and focusing on the content (request for a code) rather than the channel, leading candidates to incorrectly choose smishing when the attack is clearly voice-based.

How to eliminate wrong answers

Option B is wrong because smishing uses SMS text messages, not voice calls; the attacker here called the clerk, so the medium is voice, not text. Option C is wrong because baiting involves offering something enticing (e.g., a free USB drive) to lure the victim into an action, not a real-time request for a code over the phone. Option D is wrong because tailgating is a physical security attack where an unauthorized person follows an authorized individual into a restricted area; this scenario involves no physical access, only a phone call.

Full explanation →

690

Multi-Selectmedium

A company is implementing controls to protect against insider threats. Which three of the following controls are most effective for detecting and preventing data exfiltration by a malicious insider? (Choose three.)

Select 3 answers

.Deploying Data Loss Prevention (DLP) solutions to monitor and block sensitive data leaving via email or USB

.Implementing user behavior analytics (UBA) to flag unusual access patterns or large downloads

.Enforcing strict role-based access controls (RBAC) with the principle of least privilege

.Requiring all employees to use complex passwords changed every 30 days

.Installing antivirus software on all endpoints

.Conducting annual security awareness training for all staff

Why this answer

Data Loss Prevention (DLP) solutions are effective because they can inspect content in real time, blocking sensitive data from being sent via email, copied to USB, or uploaded to cloud services. User Behavior Analytics (UBA) detects anomalies such as a user downloading thousands of records at 3 AM, which is a strong indicator of malicious intent. Role-Based Access Control (RBAC) with least privilege limits the data a user can access, reducing the attack surface and making exfiltration harder even if credentials are compromised.

Exam trap

The trap here is that candidates often confuse general security controls (like password policies or antivirus) with controls specifically designed to detect or prevent data exfiltration, leading them to select options that are good security practices but irrelevant to the scenario.

Full explanation →

691

Multi-Selectmedium

A manufacturing company must keep a legacy scheduling application running for 60 days while replacement testing finishes. The application supports production orders, and the business cannot tolerate a shutdown. Which three conditions should be required before approving the temporary exception? Select three.

Select 3 answers

A.Assign a named risk owner who is authorized to accept the residual risk.

B.Set a clear expiration date and mandatory review point before renewal.

C.Implement a compensating control such as network restriction or added monitoring.

D.Rely on the vendor's promise that a better version will be available eventually.

E.Approve an unlimited waiver so operations do not need to revisit the issue.

AnswersA, B, C

Assigning a named risk owner who is authorized to accept the residual risk is essential because it formalizes accountability. Only a business owner with the proper authority can consciously accept the remaining exposure after implementing mitigations, ensuring the decision is documented, understood, and aligned with the organization's risk appetite. Without this explicit acceptance, the residual risk is left unowned, potentially leading to oversight or unintended assumptions of liability.

Why this answer

Assigning a named risk owner who is authorized to accept residual risk is a fundamental requirement for any risk exception. This ensures accountability and that a specific individual with the authority to accept the potential consequences of running an unsupported system is identified. Without a designated owner, the exception lacks governance and could lead to unmanaged exposure.

Exam trap

The trap here is that candidates might think only one or two of these conditions are needed, but the SY0-701 exam expects all three—risk owner, expiration/review, and compensating controls—to be present for a valid risk exception.

Full explanation →

692

Multi-Selecteasy

A DevOps team stores container images in a registry before deployment. Which two practices reduce the chance of deploying a risky image? Select two.

Select 2 answers

A.Scan images for known vulnerabilities before they are promoted to production.

B.Use trusted minimal base images and remove unnecessary packages.

C.Run containers as root by default to simplify troubleshooting.

D.Mount the host operating system filesystem into every container.

E.Deploy images using the latest tag without reviewing version history.

AnswersA, B

Image scanning leverages CVE databases to identify known vulnerabilities in the image's packages and libraries during the CI/CD pipeline. This proactive control ensures that only images passing defined security policies, such as a maximum allowed severity score, are promoted to production. It also enables early remediation at a stage where fixes are relatively inexpensive and before attackers can exploit the flaws.

Why this answer

Scanning container images for known vulnerabilities (e.g., using tools like Trivy or Clair) identifies CVEs in the OS packages or application dependencies before the image reaches production. This proactive check prevents deploying images with exploitable flaws, aligning with secure software supply chain practices. Option B is correct because using trusted minimal base images (e.g., Alpine or distroless) reduces the attack surface, and removing unnecessary packages eliminates potential vulnerabilities from unused components, following the principle of least functionality.

Exam trap

CompTIA often tests the misconception that running containers as root is acceptable for troubleshooting, but the SY0-701 exam emphasizes that containers should always run with the least privileges necessary, and the latest tag is a security anti-pattern because it breaks deterministic deployments.

Full explanation →

693

MCQmedium

An email attachment from an external supplier is not blocked by signature-based AV, but the SOC wants to see whether it drops files, launches child processes, or contacts suspicious domains before delivery to users. Which control best fits?

A.Network IDS, because it passively monitors traffic for known threats.

B.Sandboxing, because it detonates the file in an isolated environment.

C.DLP, because it prevents sensitive data from leaving the organization.

D.NAC, because it controls whether a device can join the network.

AnswerB

Sandboxing detonates the suspicious attachment in a contained virtual machine or emulated operating system with instrumentation that records file drops, registry and process modifications, and outbound callbacks. By observing actual runtime behavior, it can reveal malicious intent even if no signature exists, while isolating any payload from production resources. It is therefore the correct control for inspecting a supplier attachment that an external email filter does not block.

Why this answer

Sandboxing is the correct control because it detonates the file in an isolated, virtualized environment to observe its runtime behavior, such as dropping files, spawning child processes, or making outbound connections to suspicious domains. This goes beyond signature-based AV by analyzing dynamic behavior rather than static file hashes or patterns. The SOC's goal is to assess the file's actions before delivery, which sandboxing directly addresses.

Exam trap

The trap here is that candidates confuse passive monitoring (IDS) with active behavioral analysis (sandboxing), assuming IDS can detect unknown threats by watching traffic, but IDS lacks the ability to execute and observe the file's runtime actions in an isolated environment.

How to eliminate wrong answers

Option A is wrong because Network IDS passively monitors traffic for known threat signatures but cannot detonate or analyze the behavior of an email attachment in isolation; it would only alert on network-level indicators after the file is executed. Option C is wrong because DLP (Data Loss Prevention) focuses on preventing sensitive data from leaving the organization via monitoring content in transit or at rest, not on analyzing file behavior or detecting malicious actions like dropping files or contacting domains. Option D is wrong because NAC (Network Access Control) enforces policies on device compliance and network admission, such as checking for up-to-date antivirus or patch levels, and has no capability to execute or analyze email attachments for behavioral threats.

Full explanation →

694

MCQmedium

An EDR alert shows powershell.exe launching with an encoded command, no new executable written to disk, and a registry run key added for persistence. Outbound HTTPS traffic then begins to a rare external domain. Which type of malware behavior is most likely?

A.Worm behavior, because the malware is automatically spreading across the network.

B.Fileless attack, because the malicious activity is using legitimate tools and memory rather than a dropped payload.

C.Rootkit behavior, because the attacker is hiding from the operating system at a low level.

D.Spyware, because the malware is using HTTPS traffic to contact an external domain.

AnswerB

The alert shows encoded PowerShell, no new file on disk, and persistence through a registry run key. That pattern strongly suggests a fileless attack, where attackers abuse trusted system tools and memory-based execution to avoid traditional file detection.

Why this answer

The EDR alert describes a classic fileless attack: PowerShell.exe executes an encoded command in memory, no new executable is written to disk, and persistence is achieved via a registry run key. The outbound HTTPS traffic to a rare domain indicates command-and-control (C2) communication. Fileless malware leverages legitimate system tools (like PowerShell) and runs entirely in memory, bypassing traditional file-based detection.

Exam trap

The trap here is that candidates see 'HTTPS traffic to an external domain' and jump to spyware (Option D), but the question's emphasis on 'no new executable written to disk' and 'encoded command' points directly to fileless attack, not data exfiltration as the primary behavior.

How to eliminate wrong answers

Option A is wrong because worm behavior requires self-propagating across a network (e.g., exploiting vulnerabilities or copying itself), which is not indicated by a single PowerShell launch and registry persistence. Option C is wrong because rootkit behavior involves hiding from the OS at a low level (e.g., kernel-mode hooks or driver manipulation), not simply using PowerShell and registry keys. Option D is wrong because spyware typically exfiltrates data via HTTP/HTTPS, but the core behavior here—encoded command execution in memory with no file dropped—is the hallmark of a fileless attack, not spyware.

Full explanation →

695

MCQeasy

Users can reach the correct website name, but their browsers are redirected to a fake server after the local DNS cache is altered. What attack is most likely?

A.DNS poisoning

B.Denial of service

C.Replay attack

D.Port scanning

AnswerA

DNS poisoning corrupts the mapping between a domain name and its IP address, typically by injecting forged responses into a DNS resolver's cache. In this attack, users type a legitimate URL, but the resolver returns an attacker-controlled IP address, so the browser displays the correct domain while silently navigating to a fake server. This matches the scenario exactly because the address bar appears unchanged while traffic is misrouted to a malicious destination.

Why this answer

DNS poisoning (also known as DNS cache poisoning) occurs when an attacker inserts forged DNS resource records into the local DNS cache, causing subsequent queries for a legitimate domain to resolve to an attacker-controlled IP address. In this scenario, users type the correct website name, but because the local DNS cache has been altered, their browsers are redirected to a fake server. This directly matches the description of DNS poisoning.

Exam trap

The trap here is that candidates may confuse DNS poisoning with a man-in-the-middle attack or think that altering the local hosts file is the same mechanism, but the question specifically states the local DNS cache is altered, which is the hallmark of DNS cache poisoning.

How to eliminate wrong answers

Option B (Denial of service) is wrong because a denial-of-service attack aims to make a service unavailable by overwhelming it with traffic or exploiting vulnerabilities, not by redirecting users to a fake server after altering DNS cache. Option C (Replay attack) is wrong because a replay attack involves capturing and retransmitting valid network transmissions (e.g., authentication tokens) to impersonate a user or gain unauthorized access, not manipulating DNS resolution. Option D (Port scanning) is wrong because port scanning is a reconnaissance technique used to discover open ports and services on a target system, not an attack that alters DNS cache to redirect users.

Full explanation →

696

MCQmedium

A scanner reports a critical vulnerability on an internal Linux server. The administrator verifies the package is installed, but the vulnerable code path is only present in a plugin that has been disabled and removed from the service startup. The server cannot be patched until a vendor maintenance window next month. What is the best next step?

A.Ignore the finding because the scanner is clearly wrong

B.Create a time-limited exception and apply compensating controls until patching is possible

C.Reinstall the disabled plugin so the scanner output matches the running configuration

D.Expose the server to the internet for faster monitoring and patch testing

AnswerB

Creating a time-limited exception is a recognized risk treatment strategy that acknowledges the need to patch while balancing operational constraints. By formally accepting the risk for a defined period, the team must implement compensating controls such as strict network segmentation, host-based firewall rules, or enhanced logging to reduce the likelihood of exploitation. This approach also sets a clear deadline for a permanent fix, ensuring the vulnerability is not indefinitely deferred.

Why this answer

The vulnerability exists in a disabled plugin, meaning the attack surface is reduced but not eliminated; residual risk remains if the plugin is re-enabled or if other dependencies are affected. Creating a time-limited exception with compensating controls (e.g., firewall rules, file permissions, SELinux policies) allows the organization to formally accept the risk until the vendor patch is applied, which aligns with standard vulnerability management processes.

Exam trap

The trap here is that candidates assume a disabled plugin means zero risk, but the exam expects you to recognize that the package is still installed and could be exploited if re-enabled, so formal risk acceptance with compensating controls is required rather than ignoring or re-enabling the plugin.

How to eliminate wrong answers

Option A is wrong because the scanner is not 'clearly wrong' — it correctly identified that the vulnerable package is installed, even though the vulnerable code path is disabled; ignoring the finding would bypass proper risk acceptance and could lead to compliance issues. Option C is wrong because reinstalling the disabled plugin would reintroduce the vulnerable code path, increasing the attack surface and contradicting the goal of reducing risk; the scanner output already reflects the installed package, and the administrator should not alter the configuration to match a false sense of security.

Full explanation →

697

MCQmedium

A company is concerned about ransomware and insider tampering with backups. It wants daily restore points, monthly archives, and protection if a backup drive is stolen from the storage room. Which backup design is the best answer?

A.Store all backups on a shared file server so administrators can restore them quickly.

B.Use encrypted, immutable backups with an offline or offsite copy and defined retention periods.

C.Keep only the most recent snapshot to reduce storage cost and simplify recovery.

D.Rely on RAID mirroring because it automatically creates a secure archival copy.

AnswerB

Encrypted, immutable backups prevent unauthorized reads via encryption and unauthorized writes via write-once-read-many (WORM) or object lock controls. Keeping an offline or offsite copy provides an air-gapped or geographically separate recovery source that survives ransomware propagation and physical disasters. Defining retention periods ensures you keep enough recovery points for your recovery point objective (RPO) while avoiding indefinite storage growth, and it also supports legal or compliance needs.

Why this answer

Encrypted, immutable backups prevent ransomware from encrypting or modifying backup data, and an offline or offsite copy protects against physical theft of the backup drive. Defined retention periods satisfy the daily restore points and monthly archives requirement, while immutability ensures backup integrity even if an attacker gains access to the backup system.

Exam trap

The trap here is that candidates often confuse high-availability features like RAID with backup security, or assume that network-accessible storage is sufficient, failing to recognize that immutability and offline/offsite copies are essential for ransomware and theft protection.

How to eliminate wrong answers

Option A is wrong because storing backups on a shared file server exposes them to the same ransomware and insider threats as the production environment, and it lacks immutability or offline protection. Option C is wrong because keeping only the most recent snapshot eliminates the ability to restore from daily restore points or monthly archives, violating the stated requirements. Option D is wrong because RAID mirroring provides high availability and redundancy against disk failure, but it does not create immutable or offline copies, nor does it protect against ransomware encryption or theft of the backup drive.

Full explanation →

698

MCQmedium

NetFlow shows one workstation initiating SMB and WinRM sessions to 25 internal servers within 12 minutes, followed by a spike in Kerberos authentication requests and attempts to access admin shares. The user says they only opened an invoice spreadsheet. What is the most likely attacker objective?

A.Distributed denial-of-service activity against the internal network.

B.Lateral movement using compromised credentials to pivot across the environment.

C.Port scanning from an external attacker trying to enumerate exposed services.

D.DNS tunneling used to bypass content filtering and exfiltrate data.

AnswerB

The pattern of SMB, WinRM, Kerberos, and admin-share activity strongly suggests an attacker is using one compromised workstation to move laterally and reach additional systems. That behavior matches post-compromise pivoting, often with stolen credentials or remote execution tooling. The invoice spreadsheet is likely the initial infection vector.

Why this answer

The observed behavior—a single workstation initiating SMB and WinRM sessions to 25 internal servers in rapid succession, followed by a spike in Kerberos authentication requests and attempts to access admin shares—is a classic indicator of lateral movement using compromised credentials. The attacker likely obtained the user's credentials (e.g., via phishing in the invoice spreadsheet) and is using them to authenticate to multiple servers via WinRM for remote command execution and SMB for file access, with the Kerberos spike reflecting TGT/TGS requests as they pivot across the environment to escalate privileges or deploy ransomware.

Exam trap

The trap here is that candidates may mistake the Kerberos spike for a Kerberos-based attack (e.g., Kerberoasting) rather than recognizing it as a natural byproduct of lateral movement, where each new server connection triggers a TGS request, and the admin share access confirms the attacker is using compromised credentials to pivot, not just enumerate services.

How to eliminate wrong answers

Option A is wrong because DDoS activity would involve flooding the network with traffic from multiple sources, not a single workstation initiating authenticated sessions to internal servers; the pattern here is targeted and interactive, not volumetric. Option C is wrong because port scanning from an external attacker would show a broad range of IPs and ports being probed, not authenticated SMB/WinRM sessions followed by Kerberos requests; the use of valid credentials and admin share access indicates the attacker is already inside and moving laterally. Option D is wrong because DNS tunneling would manifest as unusual DNS query patterns (e.g., large or encoded queries) to exfiltrate data, not as SMB/WinRM sessions and Kerberos authentication spikes; the observed activity is about internal authentication and resource access, not data exfiltration via DNS.

Full explanation →

699

MCQeasy

After several rounds of phishing simulations, management wants a metric that best shows employees are improving at recognizing suspicious messages. Which metric should security track?

A.The number of training emails sent to employees each month.

B.The percentage of users who report simulated phishing emails to security.

C.The number of spam emails blocked by the mail gateway.

D.The number of help desk tickets closed within the month.

AnswerB

Reporting suspicious messages is a strong behavioral indicator that users recognize phishing and know what to do with it. An increasing report rate is a practical metric for awareness improvement because it measures real user action, not just training attendance.

Why this answer

The percentage of users who report simulated phishing emails to security directly measures behavioral change, showing that employees are actively recognizing and acting on suspicious messages. This metric reflects the effectiveness of security awareness training by tracking the desired response—reporting—rather than passive metrics like email volume or ticket counts.

Exam trap

CompTIA often tests the distinction between input metrics (e.g., training sent) and outcome metrics (e.g., user reporting), leading candidates to choose a metric that sounds related but does not measure actual behavioral improvement.

How to eliminate wrong answers

Option A is wrong because the number of training emails sent measures only the volume of communication, not whether employees learned or applied the training; it is an input metric, not an outcome. Option C is wrong because spam emails blocked by the mail gateway is a technical control metric, unrelated to employee behavior or phishing recognition skills. Option D is wrong because help desk tickets closed within the month measures operational efficiency, not employee ability to identify phishing attempts.

Full explanation →

700

MCQmedium

Based on the exhibit, what is the best risk response for the security team to recommend before the customer portal goes live?

A.Accept the risk now, because the WAF rule lowers exposure enough for launch.

B.Mitigate the risk by remediating the vulnerability before production release.

C.Transfer the risk to the hosting provider through a service-level agreement.

D.Avoid the risk by permanently canceling the customer portal project.

AnswerB

This is the best choice because the exhibit shows a high-likelihood, high-impact issue with a fix available in time for launch. The policy also says critical internet-facing vulnerabilities should not be accepted when remediation is available. A real fix reduces the underlying exposure more effectively than a temporary control.

Why this answer

The exhibit shows a critical SQL injection vulnerability in the customer portal that has been partially mitigated by a WAF rule. However, WAF rules can be bypassed (e.g., through encoding tricks or HTTP parameter pollution), so the residual risk remains high. The best response is to remediate the vulnerability in the application code before launch, which directly removes the root cause and aligns with the principle of defense in depth.

Exam trap

The trap here is that candidates assume a WAF provides complete protection and thus choose 'accept the risk,' but the SY0-701 exam emphasizes that compensating controls like WAFs are not a substitute for fixing the underlying vulnerability.

How to eliminate wrong answers

Option A is wrong because accepting risk with only a WAF rule in place is insufficient—WAFs are not foolproof and can be evaded by sophisticated SQLi payloads, leaving the database exposed. Option C is wrong because transferring risk to a hosting provider via SLA does not absolve the organization of liability for application-layer vulnerabilities; the provider typically only covers infrastructure uptime, not code-level flaws. Option D is wrong because permanently canceling the project is an extreme avoidance response that ignores the business need and the feasibility of fixing the vulnerability before launch.

Full explanation →

701

MCQeasy

Based on the exhibit, what should the analyst do before opening the forensic image for examination?

A.Mount the image read-write so the analyst can begin searching immediately.

B.Calculate and compare the image hash to the source hash before analysis.

C.Defragment the original SSD so the files will be easier to search later.

D.Compress the image into a ZIP file to reduce storage usage before verifying it.

AnswerB

Hash verification confirms that the forensic image matches the original drive and has not changed during transfer or storage. This is a key evidence-handling step because it supports integrity and admissibility. The analyst should document the result in the case notes and chain of custody before examining the contents.

Why this answer

Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.

Exam trap

The trap here is that candidates may think mounting the image immediately is efficient, but they overlook the critical integrity check required before any analysis to ensure the evidence is unaltered.

How to eliminate wrong answers

Option A is wrong because mounting the image read-write would allow writes to the image, altering its data and breaking the chain of custody; forensic images must always be mounted read-only. Option C is wrong because defragmenting the original SSD would modify the source data, destroying evidence and violating forensic best practices; analysis is performed on the image, not the original drive. Option D is wrong because compressing the image into a ZIP file before verifying its hash would change the file's hash, making it impossible to verify integrity against the source; verification must occur on the uncompressed image.

Full explanation →

702

MCQmedium

A company is signing a contract with a SaaS expense platform. Security wants the vendor to notify the company within 24 hours of a confirmed incident, maintain customer data segregation, and allow the company to verify security commitments if required. Which control should be added to the agreement?

A.A non-disclosure agreement only

B.A security addendum with SLA terms

C.A verbal assurance from the account representative

D.The vendor's standard public terms without changes

AnswerB

A security addendum with SLA terms contractually binds the vendor to the 24-hour breach notification window, enforces logical customer data segregation, and grants audit rights to verify commitments. Embedding these as enforceable service-level obligations satisfies all three stem constraints, unlike generic policy statements or technical controls the company cannot impose on a SaaS provider.

Why this answer

A security addendum with SLA terms is the correct control because it contractually binds the vendor to specific security obligations — 24-hour incident notification, data segregation, and the right to audit or verify security commitments. An addendum supplements the master agreement with enforceable security requirements, and SLA terms define measurable performance and response expectations. This gives the company legal recourse if the vendor fails to meet those commitments.

Exam trap

SY0-701 often tests the difference between an NDA (confidentiality only) and a security addendum/SLA (enforceable security and performance obligations) — candidates who pick the NDA overlook the need for incident notification and audit rights.

How to eliminate wrong answers

Option A is wrong because an NDA only protects confidential information disclosure; it does not impose incident notification timelines, data segregation requirements, or audit rights. Option C is wrong because a verbal assurance is unenforceable and provides no contractual accountability. Option D is wrong because accepting the vendor's standard public terms without modification leaves the company without the specific security guarantees it requires.

Full explanation →

703

MCQeasy

A manager wants files on a stolen laptop to remain unreadable even if the drive is removed and connected to another computer. Which control should be implemented?

A.File compression

B.Full-disk encryption

C.Packet filtering

D.Digital signing

AnswerB

Full-disk encryption protects data stored on the laptop by making the contents unreadable without the proper key or passphrase. If the drive is removed and attached to another computer, the data still remains protected because it is encrypted at rest. This is a common and effective control for portable devices that may be lost or stolen.

Why this answer

Full-disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and all user data. When the drive is removed and connected to another computer, the encrypted data remains inaccessible without the correct decryption key or passphrase, ensuring files stay unreadable. This directly addresses the manager's requirement for data confidentiality even after physical theft.

Exam trap

The trap here is that candidates confuse file compression with encryption, thinking that compressing files makes them unreadable, but compression is a reversible encoding process with no security properties.

How to eliminate wrong answers

Option A is wrong because file compression only reduces file size and does not provide any encryption or access control; compressed files can be read by any system with decompression software. Option C is wrong because packet filtering is a network security mechanism that controls traffic based on IP addresses, ports, or protocols; it has no effect on data at rest on a local drive.

Full explanation →

704

MCQmedium

An internal file server has an administrative web console exposed on the same network as all user laptops. A scan shows that any authenticated employee can reach the console, and several failed login attempts are coming from a workstation that should never manage servers. What is the best hardening action?

A.Move the console to a separate management network and restrict access to admin hosts only.

B.Increase the number of shared passwords so administrators can log in faster.

C.Leave the console exposed but shorten the password expiration period.

D.Disable logging so failed attempts do not generate noise.

AnswerA

Administrative interfaces should not be reachable from ordinary user endpoints. Moving the console to a dedicated management network and allowing access only from approved admin systems reduces the attack surface and limits who can even attempt to log in. That is a strong hardening control because it addresses both exposure and misuse. If a workstation should never manage servers, network-level segmentation is the right place to enforce that boundary before authentication is even attempted.

Why this answer

The administrative web console should be isolated on a separate management network (out-of-band management) with strict access control lists (ACLs) allowing only designated admin hosts. This prevents lateral movement from compromised user workstations and eliminates the attack surface exposed to all authenticated employees. Network segmentation is a fundamental defense-in-depth control for managing critical infrastructure, as it enforces the principle of least privilege at the network layer.

Exam trap

CompTIA often tests the misconception that password policies (rotation, complexity, or expiration) are sufficient hardening for exposed management interfaces, when in fact network segmentation and access control are the primary mitigations.

How to eliminate wrong answers

Option B is wrong because increasing the number of shared passwords does not address the root cause of unauthorized access; it actually weakens accountability and increases the risk of credential theft. Option C is wrong because shortening the password expiration period does not prevent an attacker from reaching the console; it only slightly reduces the window of opportunity for a compromised password, while the console remains exposed to all users. Option D is wrong because disabling logging removes visibility into security events, violating the fundamental security principle of auditability and making incident response impossible.

Full explanation →

705

MCQmedium

A development manager wants to copy a production customer database into a test environment so testers can reproduce a bug. The database contains names, addresses, and payment tokens. What is the best security practice before the copy is made?

A.Copy the production database unchanged and limit access to the QA team.

B.Mask, tokenize, or replace sensitive fields with approved test data before moving it.

C.Compress the database export to reduce storage and transfer time.

D.Encrypt the database backup and give developers the decryption key.

AnswerB

Masking or tokenizing sensitive fields is the best practice because it preserves the data structure needed for testing while reducing privacy risk. The test environment should not contain raw customer information unless there is a strong approved need. Using approved test data limits exposure if the environment is compromised or shared more broadly than intended.

Why this answer

Copying production data containing sensitive information (names, addresses, payment tokens) into a test environment without sanitization violates data minimization and privacy principles (e.g., GDPR, PCI DSS). The best practice is to apply data masking, tokenization, or substitution with realistic but non-sensitive test data before the copy, ensuring that the test environment does not expose real customer data. This prevents accidental data leakage and reduces compliance risk while still allowing testers to reproduce the bug with functionally equivalent data.

Exam trap

The trap here is that candidates may think limiting access (Option A) is sufficient, but the exam emphasizes that data protection must be applied to the data itself, not just to access controls, especially when moving data to a less secure environment.

How to eliminate wrong answers

Option A is wrong because copying the production database unchanged and limiting access to the QA team does not eliminate the sensitive data from the test environment; any access control misconfiguration or insider threat could expose real customer data, and it violates the principle of least privilege and data minimization. Option C is wrong because compressing the database export only reduces storage and transfer time but does nothing to protect sensitive fields; it is a performance optimization, not a security control.

Full explanation →

706

MCQmedium

A payroll SaaS provider has passed initial review, but before contract signing it announces that customer data will be processed by a new subcontractor in another country. The business wants to keep the onboarding timeline short, but security still needs assurance that the change does not increase exposure. What is the BEST next step?

A.Approve the vendor because the primary provider already passed the initial review.

B.Update the third-party risk assessment and require evidence of the subcontractor's controls before approval.

C.Wait until the first quarterly audit to review the subcontractor change.

D.Accept the change if the vendor provides a marketing brochure describing its security program.

AnswerB

This is the best next step because the change in subcontracting materially alters the risk profile. Security should reassess the provider, review the downstream party's controls, and confirm contractual obligations such as incident notification, data handling, and location requirements. This balances speed with due diligence and ensures the organization has current evidence before customer data is exposed to a new party.

Why this answer

The introduction of a new subcontractor in a different country represents a material change to the data processing environment, which invalidates the initial risk assessment. Security must update the third-party risk assessment to evaluate the subcontractor's controls, such as data protection, encryption standards, and compliance with local regulations, before approval. This ensures that the change does not increase exposure, even if the primary provider passed initial review.

Exam trap

The trap here is that candidates assume passing initial review means all future changes are automatically acceptable, overlooking the need for reassessment when the data processing environment changes, especially with a new subcontractor in a different country.

How to eliminate wrong answers

Option A is wrong because approving the vendor solely based on the primary provider's initial review ignores the material change introduced by the subcontractor, which could have weaker security controls or different legal obligations. Option C is wrong because waiting until the first quarterly audit leaves a gap where the subcontractor could be processing data without any assurance of security, increasing exposure during that period. Option D is wrong because a marketing brochure is not a reliable source of evidence; it lacks verifiable details about the subcontractor's actual security controls, such as encryption protocols, access controls, or audit reports.

Full explanation →

707

MCQmedium

An external auditor asks for proof that quarterly privileged access reviews were completed and that any exceptions were tracked to closure during the last year. Which evidence is MOST appropriate to provide?

A.A screenshot of one administrator's account showing current privileges.

B.Signed access review records and remediation tickets from the access management process.

C.The security policy that says access reviews must happen every quarter.

D.An email from the system administrator stating that reviews were completed on time.

AnswerB

This is the best evidence because it directly shows the process was performed and that findings were handled. Signed review records demonstrate that quarterly reviews occurred, and remediation or exception tickets show that identified issues were tracked and resolved. Auditors look for traceable, repeatable evidence rather than isolated screenshots or verbal confirmation, so process records are the strongest support.

Why this answer

Signed access review records provide verifiable proof that quarterly reviews were conducted, and remediation tickets demonstrate that any exceptions (e.g., excessive privileges) were tracked and resolved. This aligns with the principle of audit evidence: it must be objective, verifiable, and show a complete chain of actions from review to closure. A screenshot or policy alone lacks the audit trail of actual completion and exception handling.

Exam trap

The trap here is that candidates confuse policy documentation (Option C) or informal communication (Option D) with actual audit evidence, failing to recognize that only signed records and remediation tickets provide the verifiable, objective proof required by an external auditor.

How to eliminate wrong answers

Option A is wrong because a screenshot of one administrator's current privileges only shows a point-in-time snapshot, not evidence that quarterly reviews were completed or that exceptions were tracked to closure over the last year. Option C is wrong because a security policy stating that reviews must happen every quarter is a directive, not proof that the reviews actually occurred or that exceptions were resolved. Option D is wrong because an email from the system administrator is hearsay evidence; it is not an objective, auditable record and does not provide the signed review records or remediation tickets required for compliance.

Full explanation →

708

Multi-Selectmedium

A company uses a SaaS CRM platform. The provider patches the application and underlying infrastructure. Which two responsibilities remain with the company? Select two.

Select 2 answers

A.Set up MFA, conditional access, and user-role assignments for tenant accounts.

B.Patch the SaaS application's source code on the provider's servers.

C.Decide what customer data is entered into the service and how it is shared.

D.Replace the provider's hypervisors with company-owned hardware.

E.Maintain the provider's network firewalls and datacenter cooling systems.

AnswersA, C

In a SaaS model, the provider owns the application, but the customer remains responsible for tenant-level identity controls. This means configuring multi-factor authentication for every account, setting conditional access rules to restrict sign-ins by device risk or geolocation, and assigning role-based permissions using the app's native admin center or an integrated identity provider like Azure AD. Without these controls, a single compromised credential can expose the entire tenant, regardless of how well the provider patches its code.

Why this answer

In a SaaS model, the customer retains responsibility for securing their tenant accounts, including configuring multi-factor authentication (MFA), conditional access policies, and role-based access control (RBAC) for users. These are identity and access management (IAM) controls that the provider cannot enforce on behalf of the customer, as they depend on the customer's specific user directory and security policies.

Exam trap

The trap here is that candidates confuse the SaaS model with IaaS or PaaS, mistakenly thinking the customer is responsible for patching the application or infrastructure, when in fact the customer's duties are limited to account and data governance.

Full explanation →

709

MCQmedium

A security manager at a hospital is reviewing the annual vendor risk assessment for a cloud-based electronic health record (EHR) provider. The provider's SOC 2 Type II report, issued six months ago, identifies a significant deficiency in logical access controls: the provider failed to revoke access for former employees in a timely manner. The provider's management has asserted that this deficiency has been fully remediated, but the next SOC 2 audit is not scheduled for another eight months. The hospital's data protection policy requires that any vendor handling protected health information (PHI) must have a current SOC 2 Type II report with no unresolved significant deficiencies. Which of the following is the most appropriate next step for the security manager?

A.Accept the vendor's assertion that the deficiency has been remediated and continue the relationship as is.

B.Require the vendor to provide a bridge letter from their external auditor confirming that the remediation has been implemented and is operating effectively.

C.Immediately terminate the contract with the EHR provider and begin the process of selecting a new vendor.

D.Increase the frequency of manual access reviews performed by the hospital's internal IT staff on the vendor's systems.

AnswerB

A bridge letter is a formal letter issued by the vendor's external service auditor that addresses the period between the original SOC 2 report's end date and the current date. It provides independent, auditor-attested confirmation that the previously identified significant deficiency has been remediated and that the controls were operating effectively during the interim period. This is the standard industry practice for accepting client remediation when a full new SOC 2 report is not yet available, because it gives the hospital third-party assurance rather than relying solely on the vendor's own claim. Requiring this letter satisfies the policy's demand for independent verification while avoiding unnecessary contract termination.

Why this answer

The hospital's policy requires a current SOC 2 Type II report with no unresolved significant deficiencies. Since the deficiency was reported but is claimed to be fixed, a bridge letter from the external auditor provides independent assurance that the remediation is effective and operating as intended, bridging the gap until the next formal audit. This is the most appropriate step because it maintains compliance without prematurely terminating a critical vendor relationship.

Exam trap

The trap here is that candidates may think a vendor's self-attestation (Option A) is sufficient, but the SY0-701 exam emphasizes that independent third-party verification (like a bridge letter) is required when a significant deficiency exists and the next audit is months away.

Why the other options are wrong

The hospital's policy requires a current SOC 2 Type II report with no unresolved significant deficiencies. Accepting the vendor's assertion without independent verification violates this policy and exposes the hospital to compliance risk.

Immediate termination is too drastic; the vendor has asserted remediation and a bridge letter can provide interim assurance without disrupting healthcare operations.

When would these options actually be correct?

If the hospital's policy allowed reliance on vendor assertions for remediated findings, or if the vendor provided a detailed remediation report with evidence that was independently verified by the hospital's own audit team, then accepting the assertion could be appropriate.

If the vendor had a history of non-compliance, refused to provide evidence of remediation, or the deficiency posed an imminent risk to patient safety or data integrity, immediate termination might be justified.

Why candidates pick the wrong answer

Candidates may assume that a vendor's assertion is sufficient, especially if the vendor is trusted or the deficiency seems minor, but they overlook the policy requirement for independent verification.

Candidates may overreact to the significant deficiency and believe that any unresolved issue requires immediate contract termination, ignoring the possibility of interim controls or remediation verification.

Full explanation →

710

MCQmedium

A cloud support team is changing the way employees access an internal finance portal. Instead of trusting the user's initial login for the rest of the session, the portal now checks identity, device posture, and request context again before allowing access to payroll data or download actions. Which security concept is being implemented?

A.Defense in depth

B.Zero trust

C.Need-to-know

D.Least privilege

AnswerB

Zero trust assumes that no user, device, or network path should be trusted by default, even after initial authentication. Each access request is evaluated using identity, device health, and context before the action is allowed. That approach fits the scenario because sensitive actions are rechecked instead of relying on a one-time login event.

Why this answer

The scenario describes a shift from implicit trust (trusting the initial login for the entire session) to continuous verification of identity, device posture, and request context before granting access to sensitive actions. This is the core principle of Zero Trust, specifically the 'never trust, always verify' model, which treats every access request as if it originates from an untrusted network. The portal is enforcing a policy that re-evaluates trust at each sensitive operation, not just at session start.

Exam trap

The trap here is that candidates confuse Zero Trust with defense in depth, thinking that multiple security layers automatically mean continuous verification, but Zero Trust specifically requires re-authentication and re-authorization at each access request, not just layered controls.

How to eliminate wrong answers

Option A is wrong because defense in depth is a layered security strategy using multiple controls (e.g., firewall, antivirus, IDS) to protect assets, but it does not inherently require re-verification of identity and device posture for each request within a session. Option C is wrong because need-to-know is an access control principle that restricts data access to users who require it for their job functions, but it does not address continuous verification of device posture or request context. Option D is wrong because least privilege limits user permissions to the minimum necessary, but it does not involve re-checking identity or device posture during an active session; it is a static permission model.

Full explanation →

711

MCQmedium

A legacy reporting application cannot be modified this quarter, but users still need access from the corporate network. Security adds a hardened jump server, tighter monitoring, and manual approval for each session because MFA cannot be built into the app yet. What type of control is this?

A.Compensating control

B.Detective control

C.Corrective control

D.Deterrent control

AnswerA

A compensating control is an alternative safeguard that provides equivalent risk reduction when the preferred security control cannot be implemented due to technical or operational constraints. In this case, the legacy application cannot be modified to support MFA, so the organization deploys alternate measures—such as network segmentation, IP allowlisting, or out-of-band verification—to satisfy the security objective and maintain an acceptable risk posture.

Why this answer

A compensating control is an alternative security measure implemented when the primary control cannot be applied due to technical or operational constraints. In this scenario, the legacy application cannot be modified to support MFA, so the organization deploys a hardened jump server, enhanced monitoring, and manual session approval as compensating controls to reduce risk. These controls do not eliminate the vulnerability but provide an equivalent level of protection until the application can be updated.

Exam trap

The trap here is that candidates often confuse compensating controls with detective controls because monitoring is involved, but the primary purpose of compensating controls is to provide an alternative security function, not just to detect events.

How to eliminate wrong answers

Option B is wrong because detective controls are designed to identify and log security events after they occur (e.g., audit logs, IDS alerts), whereas the described controls (jump server, monitoring, manual approval) are proactive measures that enforce access restrictions and prevent unauthorized sessions. Option C is wrong because corrective controls are applied after an incident to restore normal operations (e.g., patching, system recovery), not to mitigate an existing vulnerability before an incident occurs. Option D is wrong because deterrent controls aim to discourage malicious behavior through fear of consequences (e.g., warning banners, guards), not to provide an alternative technical mechanism for secure access when a primary control is unavailable.

Full explanation →

712

MCQmedium

A security analyst observes a critical server generating unusually high outbound traffic to an external IP address that is listed on a threat intelligence feed as a known command-and-control server. The analyst suspects the server is compromised. According to standard incident response procedures, what should the analyst do NEXT?

A.Reboot the server to clear any malicious processes from memory

B.Isolate the server from the network to stop the communication

C.Apply the latest security patches to the server

D.Ignore the alert because the external IP might be a false positive

AnswerB

Containment is the immediate priority in incident response. Isolating the server — by disabling the switch port, unplugging the network cable, or enforcing a host-based firewall rule — cuts off the established C2 channel, halts data exfiltration in progress, and prevents the attacker from pivoting laterally or issuing additional commands. This action preserves volatile evidence (memory, active connections, running processes) for forensic acquisition, unlike destructive measures such as rebooting, and aligns with the NIST SP 800-61 containment strategy, ensuring the threat is neutralized before any eradication or recovery steps are taken.

Why this answer

Isolating the server from the network immediately stops the outbound command-and-control (C2) communication, preventing data exfiltration and further compromise. This aligns with the first step in the NIST SP 800-61 incident response process—containment—before any eradication or recovery actions are taken. Rebooting or patching without isolation could destroy volatile evidence (e.g., memory-resident malware) and allow the attacker to persist or escalate.

Exam trap

The trap here is that candidates confuse the containment phase with eradication or recovery, choosing to reboot or patch immediately instead of isolating the system to stop the active threat and preserve evidence.

Why the other options are wrong

Rebooting the server may temporarily disrupt malicious processes, but it does not stop the ongoing command-and-control communication and could destroy forensic evidence. The immediate priority is to contain the threat by isolating the server from the network.

Applying patches is a remediation step that should occur after containment; the immediate priority is to stop the active C2 communication by isolating the server.

Ignoring the alert based on a potential false positive is inappropriate because the traffic matches a known C2 indicator, and the high outbound volume suggests active compromise. Incident response requires immediate action to contain the threat.

When would these options actually be correct?

This option would be correct in a scenario where the server is experiencing a non-persistent memory-only attack (e.g., a fileless malware) and the goal is to quickly restore operations while preserving the ability to analyze the attack from memory dumps taken before reboot.

A question where a vulnerability scan reveals a critical unpatched flaw on a non-critical system, and the scenario asks for the best next step to reduce risk before an exploit occurs.

This option would be correct if the question stated that the traffic was to a commonly used benign service (e.g., a CDN) and the threat feed had a high false-positive rate, and the analyst had verified no other indicators of compromise.

Why candidates pick the wrong answer

Candidates may think rebooting is a quick fix to remove malware, but they overlook that it does not address active network communication and can hinder forensic investigation.

Candidates often confuse remediation with containment, thinking patching will fix the issue, but it does not stop ongoing malicious traffic and may alert the attacker.

Candidates may think that threat intelligence feeds are not always accurate and that ignoring the alert avoids unnecessary disruption, but standard procedure requires verification, not dismissal.

Full explanation →

713

MCQmedium

A cloud-hosted invoicing app has a critical vulnerability, but the vendor says a patch will not be available for six weeks. The team adds a web application firewall rule, restricts access to the app subnet, and increases monitoring until the patch arrives. What is this best described as?

A.Risk avoidance, because the system is being shut down permanently.

B.Risk transfer, because the vendor is responsible for the vulnerability.

C.Compensating control, because temporary safeguards reduce exposure until the patch is available.

D.Residual risk acceptance, because the vulnerability is being ignored until next quarter.

AnswerC

A compensating control is an alternative safeguard deployed when the primary control—here, the vendor's patch—cannot be implemented immediately. Examples include a web application firewall rule to block exploit attempts, network segmentation to isolate the app, or enforced multi-factor authentication to reduce compromise likelihood. These temporary measures reduce residual exposure, which is exactly the correct risk treatment until the official fix is applied.

Why this answer

The team deployed temporary security measures—a web application firewall (WAF) rule, subnet access restrictions, and enhanced monitoring—to reduce the risk exposure while waiting for the vendor's patch. These are compensating controls, which are alternative safeguards that mitigate a vulnerability when the primary control (the patch) cannot be implemented immediately. The scenario explicitly states the patch is six weeks away, making these interim measures a textbook compensating control.

Exam trap

The trap here is that candidates confuse 'compensating control' with 'risk acceptance' because both involve living with a vulnerability, but compensating controls actively reduce risk through temporary safeguards, whereas risk acceptance means no additional controls are applied.

How to eliminate wrong answers

Option A is wrong because risk avoidance would mean permanently shutting down or removing the invoicing app, but the team kept it running with additional safeguards. Option B is wrong because risk transfer involves shifting the financial impact of a risk to a third party (e.g., cyber insurance), not assigning responsibility for a vulnerability to the vendor. Option D is wrong because residual risk acceptance implies knowingly tolerating the remaining risk after controls are applied, but here the team actively implemented controls to reduce exposure, not ignored the vulnerability until next quarter.

Full explanation →

714

MCQeasy

An employee receives an email that appears to be from the CEO and asks for gift cards before a meeting. What should the employee do first?

A.Report the message through the approved security channel and verify the request by a separate method.

B.Buy the gift cards immediately so the CEO is not delayed.

C.Forward the email to coworkers so they can watch for the same request.

D.Reply to the sender and ask for more details in the same email thread.

AnswerA

This is correct because urgent gift card requests are a common social engineering tactic. The safest first step is to report the message and verify the request using a known, separate contact method. That prevents accidental compliance and helps the security team evaluate whether the email is fraudulent.

Why this answer

The first action in response to a suspected phishing or social engineering attack is to report it through the approved security channel, which ensures the incident is logged and can be investigated. Separately verifying the request—such as by calling the CEO or using a known, trusted contact method—confirms the legitimacy of the request without relying on the potentially compromised email thread. This aligns with security policy best practices for incident response and prevents unauthorized disclosure of funds or credentials.

Exam trap

The trap here is that candidates may think immediate action (buying gift cards) shows responsiveness, but the exam emphasizes that verification and reporting are the mandatory first steps in any social engineering incident response.

How to eliminate wrong answers

Option B is wrong because immediately purchasing gift cards based on an unsolicited email bypasses all verification and security controls, directly enabling a common social engineering scam. Option C is wrong because forwarding the email to coworkers could spread the phishing attempt, potentially compromising additional accounts or systems, and violates the principle of containment. Option D is wrong because replying in the same email thread keeps the attacker in the communication loop and does not verify the sender's identity; the attacker may simply provide more convincing details to manipulate the employee.

Full explanation →

715

MCQmedium

The help desk can patch endpoints only after testing on a few pilot systems because one legacy app sometimes breaks after updates. What patching approach is most secure and least disruptive?

A.Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.

B.Wait until all applications are fully modernized before installing any security updates.

C.Patch every endpoint immediately at the same time without testing to reduce management overhead.

D.Disable automatic updates permanently and patch only after a confirmed incident.

AnswerA

Deploying to a small pilot group first lets IT validate the update against representative hardware and the legacy application before broader exposure. Staged rings then increase the population gradually, so if a compatibility issue emerges the blast radius is limited and the deployment can be paused or rolled back. This approach balances patch latency with stability, ensuring known vulnerabilities are remediated without risking fleet-wide outages.

Why this answer

It follows a phased rollout strategy: testing on a small pilot group first validates compatibility with the legacy app, then staged deployment minimizes disruption while ensuring security patches are applied promptly. This balances the need for security updates with the operational requirement to avoid breaking critical legacy software.

Exam trap

The trap here is that candidates may choose immediate patching (Option C) thinking speed is always best for security, ignoring the real-world need for compatibility testing to prevent operational disruption.

How to eliminate wrong answers

Option B is wrong because waiting for full modernization leaves endpoints vulnerable to known exploits indefinitely, violating the principle of timely patch management. Option C is wrong because immediate, untested patching risks breaking the legacy app across the entire fleet, causing widespread disruption and potential data loss. Option D is wrong because disabling automatic updates and patching only after an incident creates a reactive security posture, leaving systems exposed to attacks that could have been prevented.

Full explanation →

716

MCQeasy

A company uses MFA, endpoint protection, firewalls, and network segmentation together to protect a customer portal. Which security principle does this best illustrate?

A.Need-to-know, because users only see the data assigned to them.

B.Separation of duties, because no single person performs every security task.

C.Defense in depth, because multiple layers protect the same asset.

D.Zero trust, because the portal is hosted in the cloud.

AnswerC

Defense in depth is the correct principle because it employs multiple independent layers of security so that if one control fails, another continues to protect the asset. MFA verifies identity, endpoint protection blocks malicious software, firewalls filter network traffic, and segmentation limits lateral movement—each addresses a different attack vector. This redundancy and diversity of controls means a single vulnerability or bypass does not compromise the entire system. The scenario explicitly lists these layered safeguards working together to reduce overall risk.

Why this answer

Defense in depth is the correct principle because the company is deploying multiple, overlapping security controls—MFA, endpoint protection, firewalls, and network segmentation—to protect the same customer portal. This layered approach ensures that if one control fails (e.g., a firewall rule is misconfigured), other controls (e.g., endpoint detection or segmentation) still provide protection, reducing the overall risk of a single point of compromise.

Exam trap

The trap here is that candidates confuse 'defense in depth' with 'zero trust' because both involve multiple controls, but zero trust specifically requires continuous verification and least-privilege access for every request, whereas defense in depth is simply the layering of independent controls without necessarily requiring per-request verification.

How to eliminate wrong answers

Option A is wrong because need-to-know is an access control principle that restricts data access based on job function, not a strategy for layering multiple security technologies; the scenario describes multiple controls, not data access restrictions. Option B is wrong because separation of duties divides critical tasks among different people to prevent fraud or error, whereas the question lists technologies, not roles or personnel assignments. Option D is wrong because zero trust is a security model that assumes no implicit trust and requires continuous verification for every request, regardless of location; the scenario does not mention cloud hosting as a factor, and simply hosting a portal in the cloud does not automatically implement zero-trust principles like micro-segmentation or continuous authentication.

Full explanation →

717

MCQmedium

A security analyst is monitoring logs from the cloud access security broker (CASB) and observes that a user account downloaded 500 GB of data from a highly sensitive SharePoint document library within a single hour. The user's historical baseline shows an average daily download of less than 10 MB. Additionally, the log shows the session originated from an IP address in a country where the company has no employees or business operations. Which of the following actions is the most appropriate for the analyst to take?

A.Immediately block the user account and the source IP address at the CASB.

B.Contact the user directly by phone to verify whether they initiated the download.

C.Initiate the organization's incident response process for a potential data exfiltration event.

D.Disable the SharePoint document library and remove all user permissions to prevent further data loss.

AnswerC

Correct. The combination of anomalous data volume and unusual geolocation strongly suggests a security incident. The analyst should follow the incident response plan, which typically includes preserving logs, engaging the incident response team, and escalating per policy.

Why this answer

The combination of a massive data download (500 GB vs. a 10 MB baseline) and a session originating from a country with no business presence strongly indicates a potential data exfiltration event. Initiating the incident response process ensures that the organization follows a structured, documented procedure to contain, analyze, and remediate the threat, preserving forensic evidence and coordinating response actions. The CASB log provides the initial indicators, but the incident response plan is the appropriate framework for handling such high-risk anomalies.

Exam trap

The trap here is that candidates may choose to immediately block or contact the user, failing to recognize that the incident response process is the systematic, first-step action for potential data exfiltration, as it balances containment with forensic preservation and legal considerations.

Why the other options are wrong

Immediately blocking the user and IP without investigation could destroy evidence and alert a potential attacker, hindering forensic analysis. The analyst should first initiate the incident response process to contain and investigate properly.

The indicators (500 GB download vs. 10 MB baseline, foreign IP) strongly suggest a security incident, not a benign anomaly. Contacting the user first could waste critical time and alert a potential attacker, violating incident response best practices.

Disabling the SharePoint library and removing permissions is too drastic and disruptive; it could halt legitimate business operations and does not follow a proper incident response procedure. The analyst should first initiate the incident response process to investigate and contain the threat methodically.

When would these options actually be correct?

This option would be correct if the question stated that the CASB has a predefined automated response policy for high-risk anomalies, and the analyst is required to execute that policy immediately to stop an active, confirmed attack with no time for investigation.

This would be correct if the question described a moderate anomaly (e.g., 50 MB download from an unusual but known location) and the organization's policy required user verification before escalating to incident response.

This option would be correct if the question described an immediate, ongoing data exfiltration with no time to follow standard procedures, and the organization's policy mandates immediate isolation of the affected resource to prevent further loss, even at the cost of business disruption.

Why candidates pick the wrong answer

Candidates may think that stopping the data loss as quickly as possible is the top priority, overlooking the need for a structured incident response to preserve evidence and avoid alerting the attacker.

Candidates often default to verifying with the user as a quick, non-disruptive step, underestimating the severity of data exfiltration indicators and the need for immediate incident response.

Candidates may think that stopping the data loss as quickly as possible is the top priority, and disabling the library seems like a direct way to prevent further downloads, overlooking the need for a coordinated incident response and the potential business impact.

Full explanation →

718

MCQmedium

After hours, EDR alerts show a finance laptop encrypting local files and trying SMB connections to nearby workstations. The user is still logged in, and management wants the fastest step that limits spread while preserving evidence. What should the SOC do first?

A.Shut down the laptop immediately to stop any further activity.

B.Use EDR to isolate the laptop from the network.

C.Run a full antivirus scan before making any network changes.

D.Reimage the laptop right away from a standard corporate image.

AnswerB

EDR-based isolation is the correct first move because it enforces a logical network quarantine at the host, blocking outbound SMB, RDP, and other propagation paths while keeping the system powered on. This preserves volatile memory for acquisition, prevents the malware from completing encryption over mapped drives, and allows the incident responder to collect IOCs and determine scope without alerting the attacker. EDR isolation is reversible and granular, so it is preferred over physical disconnection.

Why this answer

EDR isolation immediately blocks all network communication (including SMB) while preserving the endpoint's state for forensic analysis. This stops lateral movement and further encryption without losing volatile data like memory or running processes, which a shutdown would destroy.

Exam trap

The trap here is that candidates confuse 'stopping the activity' with 'shutting down,' not realizing that isolation halts network propagation without destroying the evidence needed for root-cause analysis.

How to eliminate wrong answers

Option A is wrong because shutting down the laptop destroys volatile evidence (e.g., memory-resident malware, encryption keys, active network connections) and may trigger anti-forensic routines. Option C is wrong because running a full antivirus scan while the system is still on the network allows the ransomware to continue encrypting files and spreading via SMB, and scans can be evaded by modern malware. Option D is wrong because reimaging wipes all evidence of the attack, including the ransomware binary, logs, and artifacts needed for incident response and attribution.

Full explanation →

719

MCQmedium

A help desk agent receives a phone call from someone claiming to be a regional sales manager who says they are locked out before a customer demo. The caller knows a few employee names and asks the agent to reset the account and temporarily bypass MFA. What attack is most likely?

A.Spear phishing, because the caller used specific employee details to appear credible.

B.Vishing, because the attacker is using a voice call to pressure support staff into changing access.

C.Pretexting, because the attacker is creating a false identity and believable story.

D.Baiting, because the attacker offered a tempting opportunity tied to a customer demo.

AnswerB

Vishing, or voice phishing, is a social engineering technique that exploits the telephone to trick victims into divulging sensitive information or performing actions that compromise security. The attacker here uses a voice call to impersonate an employee, creates urgency to pressure the help desk agent, and requests that access credentials be changed and MFA controls be weakened. Because the entire attack hinges on a live voice interaction, vishing is the most precise label for this scenario, distinguishing it from email-based phishing or in-person social engineering.

Why this answer

Vishing (voice phishing) specifically involves using a phone call to socially engineer a target into performing an action, such as resetting credentials and bypassing MFA. The attacker pressures the help desk agent by creating urgency around a customer demo, which is a classic vishing tactic to bypass security controls.

Exam trap

The trap here is that candidates confuse pretexting (the false identity) with the delivery method (vishing), but the exam expects you to identify the specific attack vector—voice call—as the defining characteristic of vishing.

How to eliminate wrong answers

Option A is wrong because spear phishing is an email-based attack that uses personalized content to trick the recipient into clicking a link or opening an attachment, not a voice call. Option C is wrong because while pretexting involves creating a false identity and story, the specific attack vector here is a voice call, making vishing the more precise classification under social engineering. Option D is wrong because baiting involves offering something enticing (e.g., a free USB drive or download) to lure the victim, not using a fabricated story over the phone.

Full explanation →

720

MCQmedium

After a phishing campaign, 18 employees entered credentials on a fake login page. Management wants a program that both reduces future click rates and provides measurable improvement over time. What should security implement?

A.A one-time company email reminding employees to be careful

B.Simulated phishing with targeted follow-up training and metrics

C.An updated password complexity rule for all users

D.A banner that all external email is untrusted

AnswerB

A simulated phishing program uses realistic, safe phishing tests that measure employees' real-world click and reporting behavior. Failing users are automatically enrolled in targeted, just-in-time follow-up training that explains the specific cues they missed, turning an error into a learning moment. Over time, the program produces quantitative metrics—click rates, reporting rates, and repeat offenders—that allow the security team to track improvement and adjust training. This aligns with security awareness best practices and specifically addresses the human factor that allowed 18 employees to enter credentials.

Why this answer

Simulated phishing campaigns directly address the human factor by providing a controlled, repeatable test that measures click rates over time. When an employee falls for the simulation, targeted follow-up training (e.g., micro-learning modules) reinforces secure behavior, and the metrics (e.g., click-through rate, reporting rate) allow management to track improvement. This aligns with the security program management goal of continuous improvement through measurable security awareness.

Exam trap

The trap here is that candidates often choose a technical control (like password complexity or email banners) thinking it addresses phishing, but the question specifically asks for a program that reduces click rates and provides measurable improvement—which requires a behavioral, training-based approach with metrics, not a static technical fix.

How to eliminate wrong answers

Option A is wrong because a one-time email reminder provides no mechanism to measure improvement over time and does not actively test or reinforce behavior; it is a static, non-iterative control. Option C is wrong because password complexity rules do not address phishing click rates—they mitigate credential strength but do not prevent users from entering credentials on a fake page. Option D is wrong because an external email banner is a passive indicator that relies on user attention and does not provide training or metrics to reduce click rates or measure improvement.

Full explanation →

721

MCQmedium

Based on the exhibit, what is the most likely issue with the software component being built?

A.Supply-chain compromise, because the dependency may have been altered before it reached the build pipeline.

B.Cross-site scripting, because the package name suggests the application handles web content.

C.Credential stuffing, because automated systems frequently reuse credentials during updates.

D.Replay attack, because the nightly pipeline used an old copy of the package request.

AnswerA

A checksum or integrity mismatch during an automated dependency pull is a strong sign that the package may have been tampered with in transit or replaced in the software supply chain. Because the build pipeline trusted the registry source automatically, the control failure is around dependency integrity and third-party trust.

Why this answer

The exhibit shows a build pipeline that fetches a dependency from a public repository. If the dependency has been tampered with before it reaches the pipeline, this is a classic supply-chain compromise. Attackers often inject malicious code into popular open-source packages, which then gets incorporated into the build, compromising the final software component.

Exam trap

The trap here is that candidates may confuse a supply-chain compromise with a web-specific attack like XSS, but the question's context of a build pipeline and dependency fetching points directly to the integrity of the software supply chain.

How to eliminate wrong answers

Option B is wrong because cross-site scripting (XSS) is a web application vulnerability that allows injection of malicious scripts into web pages, not an issue with a build pipeline or dependency integrity. Option C is wrong because credential stuffing involves using stolen credentials to gain unauthorized access to accounts, not a problem with automated build systems reusing credentials during updates. Option D is wrong because a replay attack involves intercepting and retransmitting a valid data transmission, not using an old copy of a package request in a nightly pipeline.

Full explanation →

722

MCQmedium

Based on the exhibit, what is the best risk treatment recommendation for the security manager?

A.Accept the risk because backups are already enabled.

B.Mitigate the risk with compensating controls until the migration is complete.

C.Avoid the risk by immediately retiring the portal.

D.Transfer the risk by purchasing cyber insurance only.

AnswerB

Mitigation via compensating controls is the best treatment because the service must remain operational and a permanent fix (migration) is already scheduled. Deploying a web application firewall, enforcing multifactor authentication, segmenting the network, and enabling enhanced monitoring reduce the immediate exposure to a level the organization can tolerate. This approach uses the approved budget effectively and preserves business continuity until the migration removes the underlying vulnerability.

Why this answer

The exhibit shows a legacy portal with known vulnerabilities that is scheduled for migration to a modern platform. Since backups alone do not address the active security weaknesses, the best recommendation is to mitigate the risk with compensating controls (e.g., web application firewall rules, network segmentation, or strict access controls) to reduce the likelihood or impact of exploitation until the migration is complete. This aligns with the risk treatment strategy of mitigation, as it actively reduces the risk without prematurely retiring the service or relying solely on insurance.

Exam trap

The trap here is that candidates often confuse risk acceptance (A) with simply having a backup, failing to recognize that backups address only one aspect of risk (availability) and do not mitigate the active vulnerabilities that could lead to data exposure or system compromise.

How to eliminate wrong answers

Option A is wrong because enabling backups only protects data availability, not the confidentiality or integrity of the portal; it does not address the underlying vulnerabilities that could be exploited. Option C is wrong because immediately retiring the portal would cause significant business disruption and is an extreme measure not justified when a scheduled migration is already planned; risk avoidance is appropriate only when the risk outweighs any benefit. Option D is wrong because purchasing cyber insurance transfers only the financial risk, not the operational or reputational risk, and does not reduce the likelihood of a breach; it should be used in conjunction with other controls, not as a standalone treatment.

Full explanation →

723

MCQmedium

Following a ransomware incident, management wants to verify that backups are usable and that a restored file server will meet recovery expectations before declaring the system trusted again. Which action is best?

A.Review the backup job logs and mark the backups as valid.

B.Perform a documented restore test in an isolated environment and validate the recovered data.

C.Increase the retention period so more restore points are available later.

D.Create a new full backup immediately after the incident and trust that one instead.

AnswerB

A documented restore test in an isolated environment is the definitive verification because it actually exercises the recovery process from the backup media to a fully functional state, proving the data can be recovered and used. Isolating the environment prevents any latent ransomware from spreading into the production network, while validating the recovered data ensures files are uncorrupted and services meet continuity requirements. This aligns with the 3-2-1 rule's recovery objective and provides the evidence management needs.

Why this answer

Performing a documented restore test in an isolated environment is the only action that directly validates the integrity and usability of backups, ensuring the restored file server meets recovery point objective (RPO) and recovery time objective (RTO) expectations. This process verifies that the backup data is not corrupted, encrypted, or incomplete, which is critical after a ransomware incident where backups may have been targeted. Without such a test, management cannot confidently declare the system trusted, as logs or retention changes do not prove data recoverability.

Exam trap

The trap here is that candidates assume backup logs or increased retention are sufficient to prove recoverability, but CompTIA emphasizes that only a documented restore test in an isolated environment provides the empirical evidence needed to declare a system trusted after a security incident.

How to eliminate wrong answers

Option A is wrong because reviewing backup job logs only confirms that the backup process completed without errors, but it does not verify that the actual data is usable, free from ransomware encryption, or restorable to a functional state. Option C is wrong because increasing the retention period merely preserves more restore points for future use, but it does not validate the current backups' integrity or usability, and it may retain compromised backups. Option D is wrong because creating a new full backup immediately after the incident does not guarantee that the backup is free from malware or that the restored system will meet recovery expectations; it only provides a fresh copy without validation.

Full explanation →

724

MCQmedium

A Linux server is being prepared for production as a database host. The build team notices that a graphical desktop environment, an unused FTP service, and an open mail submission port are present on the image, even though none of them are required. The organization wants future builds to be consistent and easy to verify. What is the best approach?

A.Leave the image unchanged so troubleshooting remains easier for administrators.

B.Use the image only for development and skip security review for production.

C.Create and enforce a hardened build standard that removes unnecessary services and ports, then validate future servers against it.

D.Add another firewall rule set and keep every installed service in place.

AnswerC

A hardened build standard defines exactly which services, packages, and ports are allowed on the server. Removing the graphical environment, FTP service, and unnecessary mail port reduces the attack surface. Validating future systems against the standard also makes the build repeatable and helps identify drift quickly.

Why this answer

It establishes a hardened baseline configuration that removes unnecessary services (e.g., FTP on port 21) and closes unused ports (e.g., mail submission port 587), ensuring consistency and simplifying verification. This aligns with the principle of minimizing attack surface by disabling all non-essential components before production deployment. A hardened build standard also enables automated compliance checks (e.g., using CIS benchmarks or OpenSCAP) to validate future servers against the defined secure state.

Exam trap

The trap here is that candidates may think leaving the image unchanged aids troubleshooting (Option A), but in security architecture, consistency and minimal attack surface always take precedence over convenience, and a hardened standard is the only way to ensure repeatable, verifiable builds.

How to eliminate wrong answers

Option A is wrong because leaving the image unchanged with a graphical desktop, unused FTP service, and open mail submission port increases the attack surface and violates the principle of least functionality, making security audits more difficult rather than easier. Option B is wrong because using the image only for development and skipping security review for production introduces unnecessary risk; production systems must undergo security review regardless of their origin, and development images often contain insecure defaults that should not be promoted without hardening.

Full explanation →

725

MCQeasy

A company moves a Linux server to infrastructure as a service (IaaS). Which task remains the customer's responsibility?

A.Patching the guest operating system and installed applications.

B.Replacing failed power supplies in the data center.

C.Maintaining the hypervisor on the host system.

D.Building and securing the provider's network backbone.

AnswerA

This is the best answer because in IaaS the customer still manages the guest operating system and the software running on it. The cloud provider handles the underlying physical infrastructure, but the customer is responsible for keeping the VM patched and hardened. That distinction is a key part of the shared responsibility model.

Why this answer

In an IaaS model, the cloud provider manages the physical infrastructure, hypervisor, and network backbone, while the customer retains responsibility for securing and maintaining the guest operating system and any installed applications. This includes applying security patches, updating software, and configuring the OS-level firewall. For a Linux server, the customer must run commands like `apt update && apt upgrade` or `yum update` to patch the OS and manage application dependencies.

Exam trap

The trap here is that candidates often confuse IaaS with PaaS or SaaS, assuming the provider patches the OS, but in IaaS the customer retains full control and responsibility for the guest operating system and applications.

How to eliminate wrong answers

Option B is wrong because replacing failed power supplies in the data center is the responsibility of the IaaS provider, who manages the physical hardware and facility infrastructure. Option C is wrong because maintaining the hypervisor on the host system is the provider's duty under IaaS, as the hypervisor is part of the virtualization layer that the customer does not control. Option D is wrong because building and securing the provider's network backbone is entirely the provider's responsibility; the customer only manages virtual networks and security groups within their tenant.

Full explanation →

726

MCQmedium

A SOC analyst detects that a user's workstation is sending large volumes of data to an unusual external IP address during non-business hours. The analyst has already isolated the workstation by disconnecting it from the network. What is the NEXT step in the incident response process?

A.Reimage the workstation to remove any malware

B.Perform a forensic analysis of the workstation to collect evidence

C.Reset the user's password to prevent further unauthorized access

D.Notify law enforcement immediately

AnswerB

After containment, performing forensic analysis on the workstation is the correct next step because it preserves volatile data (memory, network connections, running processes) and non-volatile evidence (logs, files, registry) in a forensically sound manner. This process establishes a chain of custody and enables investigators to identify the malware, infection vector, and scope of the exfiltration, which is essential for informed remediation and potential legal action.

Why this answer

After isolating the workstation, the next step in the incident response process is to perform forensic analysis to collect evidence. This aligns with the NIST SP 800-61 framework, where containment (isolation) is followed by eradication and recovery, but evidence collection must occur before any destructive actions like reimaging. The forensic analysis preserves volatile data (e.g., memory, network connections) and non-volatile data (e.g., disk artifacts) to determine the scope and cause of the data exfiltration.

Exam trap

The trap here is that candidates often confuse containment with eradication, selecting reimaging (Option A) prematurely without recognizing that evidence preservation is a mandatory step before any destructive remediation in the incident response process.

Why the other options are wrong

Reimaging the workstation destroys potential evidence before forensic analysis can be performed, violating the preservation step of incident response.

Resetting the user's password is a containment step, but the workstation is already isolated. The next step in the incident response process after containment is eradication or recovery, but more importantly, forensic analysis must be performed before any changes to preserve evidence.

Notifying law enforcement is premature at this stage; the incident response process requires evidence collection and internal investigation first to confirm the incident and gather necessary information before involving external authorities.

When would these options actually be correct?

This would be correct if the question stated that the workstation has already been forensically imaged and analyzed, and the next step is to remediate the infection and restore the system to a known good state.

This would be correct if the question described an active account compromise (e.g., phishing credentials stolen) and the workstation was not yet isolated, requiring immediate password reset to prevent further unauthorized access while other containment measures are taken.

This would be correct if the question stated that the incident involves confirmed illegal activity (e.g., child exploitation, terrorism) and the organization's policy mandates immediate law enforcement notification, or if the question asked for the first step after confirming a crime in progress.

Why candidates pick the wrong answer

Candidates may think that removing malware is the immediate priority after isolation, not realizing that evidence collection must come first to support investigation and legal action.

Candidates may think that resetting the password is a quick way to stop the data exfiltration, especially if they confuse the user's credentials with the cause of the incident, or they skip the forensic step in favor of immediate remediation.

Candidates may believe that any suspicious data exfiltration requires immediate law enforcement involvement, especially if they think the incident is a serious breach, without understanding the standard incident response order of operations.

Full explanation →

727

MCQmedium

A records manager finds a folder of payroll reports on a shared drive. The business says the reports are no longer active, but legal retention rules require keeping them for another two years. What is the best action?

A.Delete the reports immediately because the business no longer uses them

B.Move the reports to an approved archive and retain them for the required period

C.Email the reports to each manager so they can keep their own copy

D.Rename the folder so users do not notice it on the shared drive

AnswerB

Moving the reports to an approved archive—implemented with immutable storage, access logging, and role-based permissions—satisfies the governing retention schedule while also preserving the records' authenticity and metadata for any future audit or e-discovery request. This action removes the sensitive payroll data from the unrestricted shared workspace and places it under formal records management controls, ensuring it remains retrievable for the required period. The archive should also recognize any active legal hold and tag the records for automatic, auditable disposition once that period expires without risk of inadvertent loss.

Why this answer

The reports are subject to a legal retention policy requiring two more years of storage. Moving them to an approved archive ensures they remain accessible for compliance purposes while removing them from the active shared drive, which reduces the risk of accidental modification or deletion. This aligns with data lifecycle management and legal hold procedures.

Exam trap

The trap here is that candidates may assume 'no longer active' means the data can be deleted, ignoring the overriding legal retention requirement, or they may think renaming or distributing files is a valid workaround instead of using a proper archive solution.

How to eliminate wrong answers

Option A is wrong because deleting the reports immediately violates the legal retention requirement, exposing the organization to non-compliance penalties. Option C is wrong because emailing reports to managers creates uncontrolled copies, increases the risk of data leakage, and does not ensure centralized retention or auditability. Option D is wrong because renaming the folder does not address the retention requirement and may lead to data loss or unauthorized access if the folder is still on the shared drive.

Full explanation →

728

MCQmedium

Based on the exhibit, what type of malware is the most likely issue on the workstation?

A.Spyware, because the system appears to be collecting user data silently.

B.Ransomware, because the browser settings changed after installation.

C.Rootkit, because the endpoint security console detected an unknown process.

D.Worm, because the software was installed from an unofficial website.

AnswerA

Spyware is the best fit because the symptoms show covert data collection and tracking behavior. The unwanted browser extension, the repeated outbound traffic to a tracking domain, and the access to saved cookies all point to surveillance and data theft rather than encryption or destructive behavior.

Why this answer

The exhibit shows a browser extension installed from an unofficial website that is silently collecting browsing data, including keystrokes and visited URLs, which is characteristic of spyware. Spyware operates by gathering user information without consent, often through seemingly legitimate software, and the absence of encryption or user notification confirms this classification.

Exam trap

The trap here is that candidates confuse the symptom of changed browser settings with ransomware, but ransomware's primary action is file encryption or system lockout, not silent data collection, and the unofficial website installation is a red herring for worm propagation.

How to eliminate wrong answers

Option B is wrong because ransomware typically encrypts files or locks the system and demands payment, not merely changes browser settings after installation. Option C is wrong because a rootkit is designed to hide its presence and evade detection by security software, so an endpoint security console detecting an unknown process would indicate a different threat, not a rootkit. Option D is wrong because a worm self-replicates and spreads across networks without user interaction, whereas the issue here involves installation from an unofficial website, which is a common vector for spyware, not a worm.

Full explanation →

729

MCQmedium

A vulnerability scan of a branch-office print server finds that its administrative web console is reachable from the internet. The appliance is still using the vendor's default password, and no access control list limits management access to the office subnet or VPN. Which remediation would reduce risk the most with the least disruption?

A.Increase the password length policy and leave the console publicly reachable.

B.Disable the management interface entirely and replace the device immediately.

C.Restrict management access to the office network or VPN and change the default credentials.

D.Apply a patch after the next quarterly maintenance window and keep the current exposure unchanged.

AnswerC

This is the best balance of security and operational impact. Publicly exposed administration interfaces are high-risk, especially when default credentials are still enabled. Limiting access to a trusted management network or VPN immediately reduces attack surface, while changing the vendor defaults removes a common compromise path. Together, these steps address the exposure without requiring a full replacement or major service outage.

Why this answer

Reduces risk the most with the least disruption by immediately addressing the two primary vulnerabilities: the default password and unrestricted internet exposure. Changing the default credentials prevents trivial authentication bypass, while restricting management access to the office subnet or VPN eliminates the attack surface from the public internet. This approach requires no hardware replacement or downtime, and it directly mitigates the highest-severity issues identified in the scan.

Exam trap

The trap here is that candidates may choose Option B (disable and replace) because it seems most secure, but they overlook that configuration changes (ACL and password reset) achieve the same security goal with far less disruption and cost.

How to eliminate wrong answers

Option A is wrong because increasing the password length policy does not address the fact that the default password is still in use; an attacker can still authenticate with the known default credential, rendering the policy change irrelevant. Option B is wrong because disabling the management interface entirely and replacing the device immediately is unnecessarily disruptive and costly; the device can be secured with configuration changes without replacement, and disabling the interface may prevent necessary administrative tasks. Option D is wrong because applying a patch after the next quarterly maintenance window leaves the console publicly reachable with default credentials for an extended period, which is a critical risk that should be remediated immediately, not deferred.

Full explanation →

730

MCQmedium

Several Windows servers were built from the same image, and all of them use the same local Administrator password. What is the best operational hardening change?

A.Keep the shared password but store it in a spreadsheet with restricted access.

B.Implement a tool that automatically sets unique local admin passwords on each server.

C.Remove all administrator accounts from the servers.

D.Change the password manually once a year on one server only.

AnswerB

This is the best hardening change because shared local administrator passwords create an easy lateral-movement path if one server or credential is exposed. A password management solution that generates unique local admin passwords reduces blast radius while preserving administrative access. It also supports safer operational management because the passwords can still be retrieved or rotated through controlled processes instead of being duplicated across systems.

Why this answer

Using a tool like Local Administrator Password Solution (LAPS) automates the rotation of unique, complex passwords for each server's local administrator account. This eliminates the risk of lateral movement if one server's credentials are compromised, as each machine has a distinct password stored securely in Active Directory.

Exam trap

The trap here is that candidates may think storing the password securely (Option A) is sufficient, but the core issue is the shared password itself, not just its storage; the exam emphasizes eliminating shared credentials across systems to prevent lateral movement.

How to eliminate wrong answers

Option A is wrong because storing the shared password in a spreadsheet, even with restricted access, still leaves a single point of failure; if the spreadsheet is breached, all servers are compromised. Option C is wrong because removing all administrator accounts would break essential administrative functions and is not a recommended hardening practice; instead, you should rename or disable the built-in Administrator account. Option D is wrong because manually changing the password once a year on only one server does not address the shared password issue across all servers and leaves the others vulnerable indefinitely.

Full explanation →

731

MCQmedium

A branch office stores nightly backups on a NAS that is joined to the same Active Directory domain as the production servers. After a ransomware incident, management wants a backup design that is much harder for attackers to encrypt or delete. Which approach is the best improvement?

A.Increase the backup frequency to every hour while keeping the same NAS design.

B.Store all backups on the same network segment for faster restore access.

C.Maintain an offline or immutable backup copy in a separate administrative boundary.

D.Use only snapshots on the production storage array because they are instant to restore.

AnswerC

An offline or immutable backup copy in a separate administrative boundary is the correct strategy because it removes the backup from the domain's trust and permission model. Offline backups are physically or logically air-gapped, while immutable backups (e.g., WORM storage or object lock) prevent even a compromised administrator from modifying or deleting data within the retention window. The separate administrative boundary ensures that an attacker who takes over the production domain cannot leverage those credentials to reach the backup, preserving a known-good recovery point for incident response and disaster recovery.

Why this answer

Maintaining an offline or immutable backup copy in a separate administrative boundary ensures that attackers cannot encrypt or delete the backups, even if they compromise the Active Directory domain. An offline backup (e.g., tape or disconnected disk) is physically isolated, while immutable backups (e.g., using S3 Object Lock or a NAS with WORM capabilities) prevent modification or deletion for a defined retention period. This design breaks the attacker's ability to propagate ransomware to the backup repository, addressing the core requirement of making backups much harder to encrypt or delete.

Exam trap

The trap here is that candidates often assume increasing backup frequency or keeping backups on the same network segment improves recovery speed, but they overlook the fundamental need for isolation and immutability to protect against ransomware encryption and deletion.

How to eliminate wrong answers

Option A is wrong because increasing backup frequency to every hour on the same NAS joined to Active Directory does not prevent attackers from encrypting or deleting the backups; if the NAS is compromised via the domain, all copies remain vulnerable. Option B is wrong because storing all backups on the same network segment as production servers increases the attack surface and allows ransomware to spread laterally to the backup storage, defeating the goal of isolation.

Full explanation →

732

MCQeasy

A company wants every corporate laptop to use the same required screen-lock timeout, disk encryption setting, and local administrator restriction. Which document should define these mandatory settings?

A.A guideline, because it offers flexible suggestions for users

B.A standard, because it specifies required configuration values

C.A procedure, because it explains the business reason for security rules

D.A memo, because it is the fastest way to communicate changes

AnswerB

A standard is a formal, mandatory document that defines the exact configuration values (e.g., password policy, OS patch level, encryption settings) that every corporate laptop must adhere to. This creates an enforceable baseline for consistency, compliance, and security audits. Unlike optional recommendations or announcements, a standard is binding and ensures all devices are configured identically.

Why this answer

A standard is the correct document type because it mandates specific, measurable configuration values (e.g., screen-lock timeout of 300 seconds, AES-256 disk encryption, removal of local admin rights) that all corporate laptops must enforce. Standards are binding and establish a baseline for security compliance, unlike guidelines which are advisory. This aligns with the company's requirement for mandatory, uniform settings across all devices.

Exam trap

The trap here is confusing a 'standard' (which sets mandatory, measurable requirements) with a 'guideline' (which is optional and advisory), leading candidates to pick A because they think 'required' implies flexibility, when in fact standards are the only document type that enforces specific configuration values.

How to eliminate wrong answers

Option A is wrong because a guideline offers flexible suggestions or recommendations, not mandatory requirements, so it cannot enforce the required screen-lock timeout, disk encryption, or local administrator restriction. Option C is wrong because a procedure describes step-by-step instructions for performing a task (e.g., how to configure the screen-lock timeout), not the mandatory configuration values themselves; it explains the 'how,' not the 'what must be set.'

Full explanation →

733

Multi-Selectmedium

Employees use a browser SaaS portal, a native mobile app, and an internal API. The company wants one corporate identity, reduced password reuse, and automated removal of access when HR terminates users. Which two solutions best meet the requirement? Select two.

Select 2 answers

A.Create separate local usernames and passwords in each application for every employee.

B.Use federation so the SaaS apps trust the company's identity provider.

C.Store passwords in a shared vault and let users retrieve them when needed.

D.Automate account provisioning and deprovisioning from HR changes with SCIM or an equivalent feed.

E.Allow the mobile app to authenticate only from remembered devices, without central identity controls.

AnswersB, D

Federation lets external SaaS applications delegate authentication to the company's identity provider (IdP) using standards such as SAML 2.0 or OpenID Connect. This centralizes login, MFA, and conditional access policies in one place, eliminates the need for separate per-app credential stores, and ensures that when an employee leaves, their access to all federated apps is immediately cut off at the IdP. It directly addresses the goal of reducing credential sprawl and enforcing consistent access control across the browser portal and mobile app.

Why this answer

Federation (B) allows the SaaS portal, mobile app, and internal API to trust a single corporate identity provider (IdP) using standards like SAML 2.0 or OIDC. This gives employees one set of credentials, reduces password reuse, and enables centralized control. When HR terminates a user, the IdP can revoke access instantly, affecting all federated applications.

Exam trap

The trap here is that candidates often think federation alone solves all identity lifecycle problems, but the question explicitly requires automated removal of access, which demands a provisioning protocol like SCIM in addition to federation.

Full explanation →

734

MCQeasy

A company wants to state that customer data must not be emailed externally unless a manager approves the exception. Which document type should contain this rule?

A.Policy, because it establishes mandatory organizational rules

B.Guideline, because it gives staff flexible suggestions about email use

C.Procedure, because it lists the exact button clicks for sending email

D.Standard, because it provides a general recommendation for communication

AnswerA

A policy is a mandatory, management-approved directive that establishes organization-wide rules for behavior, defining what is required and the consequences of noncompliance. In this scenario, stating that customer data must not be emailed externally unless an approved exception exists creates an enforceable rule, exactly the role of a policy. It compels employees to follow the prescribed action and allows governance over data handling.

Why this answer

A policy is the correct document type because it establishes mandatory organizational rules that must be followed. The requirement that customer data must not be emailed externally without manager approval is a binding directive, not a suggestion or a step-by-step guide. Policies define high-level security requirements that all employees must comply with, making them the appropriate vehicle for this rule.

Exam trap

The trap here is that candidates often confuse 'policy' with 'standard' or 'guideline', mistakenly thinking a rule about data transmission is a technical standard or a flexible suggestion, when in fact it is a mandatory organizational directive that must be enforced.

How to eliminate wrong answers

Option B is wrong because a guideline provides flexible suggestions or best practices, not mandatory rules; this requirement is a strict prohibition, not a recommendation. Option C is wrong because a procedure lists detailed step-by-step instructions (e.g., exact button clicks in an email client), not a high-level rule about data handling. Option D is wrong because a standard specifies technical specifications or configurations (e.g., encryption protocols like TLS 1.2), not a general rule about data transmission approval.

Full explanation →

735

MCQeasy

A scan finds two issues: a critical vulnerability on an internet-facing VPN appliance with public exploit code, and a medium-severity issue on an internal test server. Which should be fixed first?

A.The internal test server issue, because test systems are always higher risk.

B.The VPN appliance issue, because it is critical and publicly exploitable.

C.Both issues at the same time without assigning a priority.

D.Neither issue, because scanners can produce false positives.

AnswerB

The VPN appliance issue should be addressed first because it combines a critical severity rating with direct internet exposure and publicly available exploit code, creating an immediate and realistic attack vector. This scenario represents a high likelihood of compromise with high impact, often allowing full network access. Prioritizing this issue aligns with common frameworks like the CVSS base score and EPSS, where exploitability and network reachability significantly elevate remediation urgency.

Why this answer

The VPN appliance issue should be fixed first because it is a critical vulnerability on an internet-facing system with publicly available exploit code. This combination means an attacker can directly compromise the appliance from the internet with minimal effort, leading to potential network breach and lateral movement. In contrast, the internal test server is less accessible and poses a lower immediate risk, even though it should still be addressed in due course.

Exam trap

The trap here is that candidates assume all vulnerabilities must be fixed in order of severity alone, ignoring the critical factor of asset exposure and exploitability, which CompTIA emphasizes in risk-based prioritization.

How to eliminate wrong answers

Option A is wrong because test systems are not inherently higher risk than internet-facing production systems; the risk is determined by exposure, exploitability, and impact, not by system role alone. Option C is wrong because security resources are finite and prioritization is essential; treating all issues equally ignores the urgency of a critical, publicly exploitable vulnerability on an internet-facing asset.

Full explanation →

736

MCQeasy

A critical patch must be applied to a retail point-of-sale server. What is the best way to reduce business disruption?

A.Apply the patch during the busiest business hours to make the change sooner.

B.Schedule the patch during an approved maintenance window.

C.Skip the patch and rely on hope that the issue will not be exploited.

D.Turn off all backups so the patch process runs faster.

AnswerB

A maintenance window is the best choice because it lets the organization perform the update when user impact is expected to be lowest. This is a core change-control practice for systems that support business operations. It gives the team time to test, monitor, and recover if something goes wrong without affecting customers during peak use.

Why this answer

Scheduling the patch during an approved maintenance window is the best practice to minimize business disruption because it allows the organization to plan for downtime during low-activity periods, coordinate with stakeholders, and ensure rollback procedures are in place. For a retail point-of-sale (POS) server, applying a critical patch outside of business hours prevents transaction interruptions and potential revenue loss, aligning with change management policies that prioritize availability and security.

Exam trap

The trap here is that candidates may choose Option A, thinking that applying a patch sooner reduces risk, but they overlook the immediate business disruption and the importance of change management processes that prioritize availability over speed.

How to eliminate wrong answers

Option A is wrong because applying a patch during busiest business hours would directly disrupt customer transactions, causing immediate revenue loss and potential data integrity issues, which contradicts the goal of reducing business disruption. Option C is wrong because skipping a critical patch leaves the POS server vulnerable to known exploits, such as remote code execution or data breaches, which can lead to greater long-term disruption and regulatory non-compliance. Option D is wrong because turning off backups eliminates the ability to restore the system to a known good state if the patch causes a failure, increasing the risk of extended downtime and data loss.

Full explanation →

737

MCQmedium

A security analyst detects a high volume of failed authentication attempts from IP address 203.0.113.1 against a web application. The attempts use different usernames, such as 'admin', 'root', 'test', and several common names. Account lockout policies are configured to lock an account after five failed attempts. Despite this, the analyst sees the attempts continuing over several hours. Which of the following security controls is most likely missing or improperly configured?

A.Increase the account lockout threshold to a lower number

B.Implement geofencing to block traffic from the attacker's region

C.Configure rate limiting per source IP address

D.Enable detailed failed login attempt logging

AnswerC

Rate limiting on the application or firewall level restricts the number of authentication attempts from a single IP address over a given time period, regardless of the username being tried. This directly counters the attacker's strategy of rotating usernames to bypass account lockout.

Why this answer

Rate limiting per source IP address is the correct control because it restricts the number of authentication requests from a single IP (203.0.113.1) within a given time window, regardless of the usernames used. Account lockout policies are ineffective here because the attacker is rotating through different usernames (e.g., 'admin', 'root', 'test'), so no single account reaches the five-failed-attempt threshold. By limiting the request rate from the source IP, the analyst can throttle the attacker's brute-force attempts without affecting legitimate users.

Exam trap

The trap here is that candidates assume account lockout policies are sufficient for all brute-force attacks, but they fail to recognize that rotating usernames (a 'password spraying' attack) bypasses per-account lockout, making per-source-IP rate limiting the correct mitigation.

Why the other options are wrong

The account lockout threshold is already set to lock after five attempts, but the attack uses different usernames, so lockout per user is ineffective. Lowering the threshold further would not stop the attack since each username is tried only a few times.

Geofencing blocks traffic based on geographic location, but the attacker's IP address 203.0.113.1 is a documentation-only address (not assigned to any real region), and the attack could easily be routed through proxies or VPNs in other regions. The core issue is the volume of attempts from a single source, which rate limiting addresses directly.

When would these options actually be correct?

If the question described a brute-force attack using a single username (e.g., 'admin') with many attempts, then lowering the lockout threshold (e.g., from 5 to 3) would lock the account sooner and reduce successful breaches.

A company wants to restrict access to a sensitive internal application to only employees within the country's borders. The correct answer would be geofencing if the question specifies that all legitimate users are in a known geographic region and the threat is from external IPs outside that region.

Why candidates pick the wrong answer

Candidates may think that reducing the lockout threshold always improves security, not realizing that in a distributed username attack, lockout per user does not prevent the overall volume of attempts.

Candidates may think geofencing is a standard defense against external attackers, but they overlook that attackers can spoof locations or use proxies, and that the question's scenario involves a single IP address rather than a regional threat.

Full explanation →

738

MCQeasy

A company is placing its public web server so internet users can reach it, but the database server must stay hidden from the internet and be reachable only by the web server. Which design best supports this goal?

A.Put both servers on the same flat internal network

B.Place the web server in a DMZ and keep the database server on the internal network

C.Put the database server in the DMZ and the web server on the internal network

D.Disable the firewall so the web server can communicate freely with all hosts

AnswerB

This is the standard DMZ architecture: the web server is placed in a perimeter network (DMZ) that is exposed to the internet but isolated from the internal LAN by firewalls, while the database server remains on the more trusted internal network. Inbound internet traffic is only permitted to the web server, and the web server may establish outbound connections to the database on specific ports or application-level protocols, so even if the web server is compromised, the attacker gains no direct access to the database or other internal resources.

Why this answer

It uses a DMZ (demilitarized zone) to isolate the public-facing web server from the internal network. The web server in the DMZ is accessible from the internet, while the database server remains on the internal network, reachable only by the web server through a firewall rule that permits traffic on the specific database port (e.g., TCP 3306 for MySQL). This layered security design prevents direct internet access to sensitive data.

Exam trap

The trap here is that candidates may think placing the database server in the DMZ is acceptable because it is 'protected' by a firewall, but they overlook that the DMZ is still accessible from the internet, making the database directly reachable and violating the requirement to keep it hidden.

How to eliminate wrong answers

Option A is wrong because placing both servers on the same flat internal network exposes the database server to the internet if the web server is compromised, as there is no network segmentation to restrict lateral movement. Option C is wrong because putting the database server in the DMZ and the web server on the internal network would expose the database directly to the internet, defeating the goal of hiding it, and would require the web server to initiate outbound connections to the DMZ, which is less secure and more complex to manage.

Full explanation →

739

MCQmedium

An IDS generates an alert for possible SQL injection against an internal reporting portal at 02:00. The web logs show the source IP belongs to the company's approved vulnerability scanner, the request path matches the scheduled test window, and the WAF blocked the request. What is the most appropriate analyst conclusion?

A.Treat it as a confirmed intrusion and immediately take the portal offline.

B.Close it as expected activity after validating the scanner schedule and source IP.

C.Classify it as malware because the blocked payload proves the scanner is infected.

D.Disable the WAF rule so the scanner can complete without generating more alerts.

AnswerB

The logs align with an authorized scanner operating during a planned maintenance window, and the WAF successfully blocked the payload. After confirming the scan authorization, the alert can be documented and closed as expected activity rather than escalated as a live attack.

Why this answer

The alert matches expected, authorized activity: the source IP belongs to the approved vulnerability scanner, the request occurred during the scheduled test window, and the WAF blocked the malicious payload. This is a classic false positive triggered by legitimate security testing, not an actual intrusion. The analyst should validate the scanner schedule and source IP, then close the alert as expected activity.

Exam trap

The trap here is that candidates see a blocked SQL injection payload and assume it is a real attack, forgetting to verify whether the source is an authorized vulnerability scanner operating during a scheduled test window.

How to eliminate wrong answers

Option A is wrong because taking the portal offline is an overreaction to a false positive; the request was from an authorized scanner and blocked by the WAF, so there is no confirmed intrusion. Option C is wrong because classifying the scanner as infected based solely on a blocked SQL injection payload is a logical leap; scanners intentionally send malicious payloads to test defenses, and the WAF block proves the control worked, not that the scanner is compromised. Option D is wrong because disabling the WAF rule would remove protection against real attacks, and the scanner can still complete its tests with the WAF blocking its payloads—the alerts can be tuned or suppressed instead.

Full explanation →

740

MCQeasy

A finance application records each approval with the manager's unique user ID and a digital signature. Auditors want proof that the manager cannot later deny approving the transaction. Which security objective is most directly being addressed?

A.Availability

B.Nonrepudiation

C.Confidentiality

D.Accountability

AnswerB

Nonrepudiation is the security goal that provides strong, verifiable evidence that a specific party performed an action, making denial difficult or impossible. In a finance application, applying a manager's digital signature to an approval record binds that manager to the transaction cryptographically, ideally with a trusted timestamp. Because the signature can be verified with the manager's public key and requires possession of the manager's private key, the manager cannot plausibly claim they never approved the transaction. This makes nonrepudiation the correct answer.

Why this answer

Nonrepudiation ensures that a party cannot deny having performed a specific action. By recording the manager's unique user ID and a digital signature, the system provides cryptographic proof that the manager approved the transaction, making it impossible for them to later deny it. This directly addresses the audit requirement for undeniable evidence of approval.

Exam trap

CompTIA often tests the distinction between accountability (logging who did what) and nonrepudiation (cryptographic proof that prevents denial), so candidates may pick 'Accountability' because they see user IDs and logs, missing that the digital signature is the key element for nonrepudiation.

How to eliminate wrong answers

Option A is wrong because availability ensures systems and data are accessible when needed, not that actions cannot be denied. Option C is wrong because confidentiality protects data from unauthorized disclosure, not from denial of actions. Option D is wrong because accountability tracks who performed an action (via user IDs and logs), but without a digital signature, it does not provide cryptographic proof that prevents the manager from repudiating the action; nonrepudiation is the stronger objective that includes accountability plus irrefutable evidence.

Full explanation →

741

MCQmedium

A small company is redesigning its network for a public web application. The web front end must be reachable from the internet, but the database should never be exposed directly to external or general user traffic. Which architecture is the best choice?

A.Place both the web server and database in the same internal subnet and rely on host firewalls.

B.Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.

C.Place the database in the DMZ so the web server can query it directly without internal routing.

D.Keep both systems public but restrict access with NAT and strong administrator passwords.

AnswerB

This separates the internet-facing system from the sensitive backend. The DMZ limits exposure of the web server, while the database remains inaccessible from external networks and is reachable only over tightly filtered application ports from the web tier.

Why this answer

It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) where it is reachable from the internet, while the database is placed in a private internal subnet with strict firewall rules that only allow the required application traffic (e.g., TCP port 3306 for MySQL or 1433 for MSSQL) from the web server. This ensures the database is never directly exposed to external or general user traffic, reducing the attack surface and preventing direct internet-based attacks on the database.

Exam trap

The trap here is that candidates may think host firewalls are sufficient for internal subnet isolation (Option A) or mistakenly believe placing the database in the DMZ simplifies routing (Option C), overlooking the fundamental security principle of defense in depth and the need to keep sensitive data stores off the internet-facing network.

How to eliminate wrong answers

Option A is wrong because placing both the web server and database in the same internal subnet exposes the database to any compromise of the web server or any internal host, and host firewalls alone are insufficient to prevent lateral movement or internal scanning. Option C is wrong because placing the database in the DMZ directly exposes it to the internet, defeating the purpose of isolation and making it vulnerable to direct attacks from external sources.

Full explanation →

742

MCQmedium

Based on the exhibit, which access model best fits the business requirement without creating many custom roles?

A.RBAC, because every user can be placed into a fixed role that never changes.

B.ABAC, because access can be evaluated using user, resource, and environment attributes together.

C.DAC, because each file owner can decide access individually without any central rule engine.

D.MAC, because users should manually grant access to themselves when needed.

AnswerB

The exhibit requires decisions based on attributes such as department, clearance, project tags, and business unit. ABAC is built for that kind of dynamic rule set and avoids creating a separate role for every possible combination.

Why this answer

B is correct because Attribute-Based Access Control (ABAC) evaluates multiple attributes (user, resource, environment) to dynamically determine access, which fits a business requirement that needs flexible, context-aware permissions without creating many custom roles. Unlike RBAC, ABAC avoids role explosion by using policies that combine attributes, making it ideal for environments where access decisions depend on factors like time, location, or data sensitivity.

Exam trap

The trap here is that candidates often default to RBAC as the simplest model, but the question explicitly requires avoiding many custom roles, which RBAC would necessitate if the business needs are complex or dynamic, whereas ABAC provides attribute-based flexibility without role explosion.

How to eliminate wrong answers

Option A is wrong because RBAC requires predefined roles that are static; if the business needs change frequently, RBAC would require creating many custom roles to accommodate new access patterns, contradicting the requirement to avoid custom roles. Option C is wrong because DAC allows file owners to set permissions individually, which lacks centralized control and cannot efficiently enforce business-wide access policies without custom configurations per resource. Option D is wrong because MAC enforces access based on fixed labels (e.g., security clearances) and does not allow users to grant access to themselves; it is rigid and not suitable for dynamic, attribute-driven requirements.

Full explanation →

743

MCQeasy

A user opens an attached document, and the endpoint security tool shows PowerShell running from memory with no new executable file written to disk. What type of attack is most likely?

A.Fileless attack

B.Ransomware

C.Rootkit

D.Logic bomb

AnswerA

This scenario is a classic fileless attack, where the malicious payload is delivered through a document macro or script and then executed in memory using built-in Windows utilities like PowerShell, WMI, or .NET. The attack never writes a separate executable to disk, which is why signature-based antivirus scanning files may miss it. The endpoint security tool likely detected anomalous behavioral indicators, such as an Office application spawning PowerShell or executing suspicious memory-only commands, alerting the user immediately upon opening the document.

Why this answer

The scenario describes PowerShell running from memory without a new executable file written to disk, which is the hallmark of a fileless attack. Fileless attacks leverage legitimate system tools like PowerShell, WMI, or .NET to execute malicious code directly in memory, bypassing traditional file-based detection mechanisms.

Exam trap

The trap here is that candidates may confuse 'fileless' with 'no malware at all' or think that any attack using PowerShell must be a script-based attack, but the key indicator is the lack of a new executable file on disk, which distinguishes fileless attacks from traditional malware that writes files.

How to eliminate wrong answers

Option B (Ransomware) is wrong because ransomware typically encrypts files and demands payment, often writing executable files to disk or dropping a ransom note; the absence of a new executable file on disk makes this unlikely. Option C (Rootkit) is wrong because rootkits are designed to hide their presence and maintain persistent access, often by modifying the operating system kernel or boot process, not by executing solely from memory without any file artifacts. Option D (Logic bomb) is wrong because a logic bomb is a piece of malicious code that executes under specific conditions (e.g., a date or user action) and is usually embedded within a legitimate file or application, not executed purely from memory without a file.

Full explanation →

744

MCQmedium

In a virtualized environment, several workloads share the same physical host and the same IP subnet. After one payroll VM is compromised, the security team wants to prevent that VM from freely scanning or reaching the other workloads on the host. Which control best addresses this lateral-movement risk?

A.Microsegmentation with policy rules applied per workload or per VM

B.Expanding the subnet mask so all workloads are easier to reach

C.Creating a shared administrator account for all virtual machines

D.Disabling DHCP and forcing every VM to use a static IP address

AnswerA

Microsegmentation creates fine-grained trust boundaries between workloads, even when they share the same subnet or host. This limits east-west traffic and reduces the ability of a compromised VM to discover or attack neighboring systems. It is the most direct control for this risk.

Why this answer

Microsegmentation allows granular security policies to be applied per workload or per VM, even within the same subnet and on the same hypervisor. By enforcing firewall rules at the virtual switch or hypervisor level, it prevents a compromised payroll VM from scanning or communicating laterally with other VMs on the same host, directly addressing the lateral-movement risk.

Exam trap

The trap here is that candidates often confuse subnetting or IP addressing changes (like expanding the subnet mask or using static IPs) with actual network security controls, failing to realize that only policy-based segmentation at the hypervisor or virtual switch layer can block lateral traffic within the same broadcast domain.

How to eliminate wrong answers

Option B is wrong because expanding the subnet mask (e.g., from /24 to /16) actually increases the broadcast domain and makes more IP addresses reachable, which would facilitate lateral movement rather than prevent it. Option C is wrong because creating a shared administrator account for all VMs would reduce accountability and provide an attacker with a single set of credentials to compromise all workloads, increasing lateral-movement risk. Option D is wrong because disabling DHCP and forcing static IPs does not restrict network communication between VMs; it only changes how IP addresses are assigned, leaving all traffic unblocked and the VM free to scan the subnet.

Full explanation →

745

Multi-Selecteasy

A company wants employees to use their normal login from managed devices but require extra verification when they sign in from an unmanaged laptop or a new location. Which two controls should the team use? Select two.

Select 2 answers

A.Conditional access

B.Multi-factor authentication

C.DNS filtering

D.Disk encryption

E.Port security

AnswersA, B

Conditional access is an identity-driven policy engine in Microsoft Entra ID that evaluates real-time signals such as user location, device compliance, and risk before granting access. Instead of applying a one-size-fits-all rule, it can require step-up authentication, block access, or restrict sessions based on conditions like a managed or unmanaged device. This makes it the most appropriate control for requiring different sign-in conditions based on context.

Why this answer

Conditional access (A) is correct because it allows the company to define policies that grant or block access based on conditions such as device compliance (managed vs. unmanaged) and location (trusted vs. new). Multi-factor authentication (B) is correct because it provides the extra verification step required when the conditional access policy detects an unmanaged laptop or a new location, ensuring the user proves their identity beyond just a password.

Exam trap

The trap here is that candidates often pick MFA alone, forgetting that MFA is only enforced when a conditional access policy triggers it based on device or location conditions, so both controls are needed together.

Full explanation →

746

MCQmedium

A security analyst is reviewing the source code of a custom authentication service. The service uses a function that compares a user-supplied password to the stored password hash by iterating through each byte and returning false immediately upon the first mismatch. The analyst measures the function's execution time and discovers it varies measurably depending on how many initial bytes match. Which type of attack is this vulnerability most likely to facilitate?

A.Brute-force attack

B.Dictionary attack

C.Replay attack

D.Timing attack

AnswerD

A timing attack exploits measurable variations in the time it takes to execute a cryptographic operation. In this case, the early-exit comparison enables an attacker to deduce the correct secret byte by byte, making it the correct classification.

Why this answer

The vulnerability is a timing attack because the comparison function returns false immediately upon the first mismatched byte, causing execution time to vary based on how many initial bytes match. An attacker can measure these timing differences to iteratively guess each byte of the password hash, effectively reducing the search space from exponential to linear. This is a classic side-channel attack that exploits observable timing variations in cryptographic or authentication operations.

Exam trap

The trap here is that candidates may confuse a timing attack with a brute-force or dictionary attack, not realizing that the key clue is the measurable variation in execution time due to early exit on mismatch, which is a classic side-channel indicator.

Why the other options are wrong

A brute-force attack systematically tries all possible passwords, but the vulnerability here is about exploiting timing variations in password comparison, not about trying many passwords.

A dictionary attack uses a precomputed list of likely passwords, not the timing variation of password comparison. The vulnerability described is about measuring execution time to deduce password bytes, which is a timing attack, not a dictionary attack.

A replay attack involves capturing and retransmitting valid data (e.g., authentication tokens) to impersonate a user, but the vulnerability here is about timing variations in password comparison, not about intercepting and reusing network traffic.

When would these options actually be correct?

A brute-force attack would be correct if the question described a service with no rate limiting or account lockout, allowing an attacker to try all possible passwords until the correct one is found.

A dictionary attack would be correct if the question described an attacker using a list of common passwords (e.g., from a breach) to try against the authentication service, without any mention of timing or byte-by-byte comparison.

A replay attack would be correct if the question described a scenario where an attacker intercepts a hashed password or session token sent over the network and later resends it to gain unauthorized access, without needing to crack the password.

Why candidates pick the wrong answer

Candidates may associate any password-related attack with brute-force, overlooking that the specific timing leak enables a more efficient side-channel attack.

Candidates may confuse 'dictionary attack' with any attack that involves comparing passwords, or they may think the timing variation helps in narrowing down the password, similar to how a dictionary attack narrows down possibilities.

Candidates may confuse any attack that involves authentication bypass with replay attacks, or they might think that timing variations could be used to replay a successful authentication sequence.

Full explanation →

747

Multi-Selectmedium

A security analyst is investigating a potential data exfiltration incident. The analyst has collected network flow data, proxy logs, and endpoint logs. Which two data sources should the analyst correlate to identify the exfiltration channel and the compromised host? (Choose two.)

Select 2 answers

A.Proxy logs to identify HTTP/HTTPS connections to external destinations.

B.Endpoint logs to identify processes that initiated network connections.

C.Firewall logs to identify blocked inbound connection attempts.

D.DNS logs to identify domain name resolutions from internal hosts.

E.DHCP logs to identify IP address assignments to hosts.

AnswersA, B

Proxy logs record outbound web requests, including the source host, destination URL, and amount of data transferred. By analyzing these logs, the analyst can identify unusual connections to external sites, such as large uploads or connections to known malicious domains, which may indicate exfiltration over HTTP/HTTPS. This helps identify both the channel and the compromised host.

Why this answer

Correlating proxy logs with endpoint logs allows the analyst to link outbound web connections to specific processes on specific hosts. Proxy logs show the destination and volume of data, while endpoint logs show which process initiated the connection. Together, they can identify the exfiltration channel (e.g., HTTP POST to a foreign server) and the compromised host (by hostname or IP).

Exam trap

The trap here is focusing on perimeter logs like firewall or DNS, but those may not provide the process-level context needed to definitively identify the compromised host and channel.

Full explanation →

748

MCQmedium

Several employees report receiving SMS messages that appear to come from the corporate service desk. The text says, 'Your password expires today. Review the notice here,' followed by a shortened link that opens a fake sign-in page on a phone browser. Which type of attack is this?

A.Smishing

B.Pretexting

C.Tailgating

D.Spoofing

AnswerA

Smishing is the correct answer because the attack is phishing delivered over SMS/text messaging. The message creates urgency and instructs the recipient to click a link that leads to a fake login page, harvesting credentials. This fits SMiShing exactly: social engineering plus a malicious URL delivered via Short Message Service.

Why this answer

This is smishing because the attack uses SMS messages to deliver a phishing link that directs recipients to a fake sign-in page, attempting to steal their credentials. Smishing is a form of social engineering that exploits the trust in text messaging and the urgency of a password expiration notice to bypass email security filters.

Exam trap

CompTIA often tests the distinction between smishing and spoofing, where candidates mistakenly choose spoofing because the SMS appears to come from the service desk, but the core attack vector is the social engineering via SMS, not just the falsified sender information.

How to eliminate wrong answers

Option B is wrong because pretexting involves fabricating a scenario (pretext) to obtain information or access, often through voice calls or impersonation, not through SMS with a malicious link. Option C is wrong because tailgating is a physical security attack where an unauthorized person follows an authorized individual into a restricted area, not a digital or messaging-based attack. Option D is wrong because spoofing refers to falsifying data (e.g., IP address, email header, caller ID) to impersonate a trusted source, but the attack described is specifically a social engineering technique using SMS, which is classified as smishing, not just spoofing.

Full explanation →

749

MCQeasy

A vendor-supported application cannot be patched for 30 days, but the business must keep it online. What is the best short-term risk treatment?

A.Accept the risk without any additional controls

B.Apply a compensating control, such as restricting access and monitoring traffic

C.Delete the application so the vulnerability no longer exists

D.Transfer the risk by telling users to work faster

AnswerB

Applying a compensating control is the correct approach because it provides interim mitigation while the permanent patch is unavailable. Restricting access, such as through network segmentation, IP allowlisting, or disabling internet-facing exposure, directly reduces the attack surface and makes it harder for an attacker to reach the vulnerable service. Concurrently, monitoring traffic with intrusion detection or continuous log review enables early detection of suspicious activity, giving the security team time to respond. This aligns with risk management best practices and is a recognized alternative when patches cannot be immediately deployed.

Why this answer

When a known vulnerability cannot be patched immediately, applying a compensating control—such as restricting network access via firewall rules (e.g., allowing only specific source IPs) and enabling deep packet inspection (DPI) or an intrusion prevention system (IPS) to monitor for exploit attempts—reduces the risk to an acceptable level without taking the application offline. This approach aligns with the principle of defense in depth, buying time until the vendor patch is available.

Exam trap

The trap here is that candidates often confuse 'risk acceptance' (Option A) as a valid short-term treatment, but the question explicitly requires the best treatment when the business must keep the application online, making compensating controls the correct choice over passive acceptance.

How to eliminate wrong answers

Option A is wrong because accepting the risk without any additional controls ignores the active threat and leaves the organization exposed to exploitation of the unpatched vulnerability, which is not a prudent short-term treatment. Option C is wrong because deleting the application is an extreme measure that eliminates the vulnerability but also removes the business functionality entirely, failing the requirement to keep the application online. Option D is wrong because transferring risk by telling users to work faster is not a valid risk treatment; risk transfer involves insurance or outsourcing, not a behavioral directive, and does nothing to mitigate the technical vulnerability.

Full explanation →

750

Multi-Selectmedium

A customer portal must keep serving users if one application server fails and also remain available if the primary site becomes unreachable. Management prefers automatic recovery over manual intervention. Which two design choices best satisfy the goal? Select two.

Select 2 answers

A.Deploy multiple application servers behind a load balancer across separate availability zones.

B.Use a single high-end server with RAID 10 and a larger power supply.

C.Keep only nightly backups and restore manually after an outage.

D.Store the database on a local disk array attached to the primary server.

E.Replicate the database to a standby site with automatic failover.

AnswersA, E

This design achieves high availability by removing the single point of failure at the application tier. The load balancer distributes traffic across multiple servers and performs periodic health checks, automatically removing any instance that fails. Deploying across separate availability zones (AZs) also protects against an entire data-center outage, because the load balancer can continue routing to healthy instances in the remaining AZs. This is a classic active-active pattern that provides automatic failover and scales horizontally to handle increased user load.

Why this answer

Deploying multiple application servers behind a load balancer across separate availability zones (A) provides redundancy at the application tier: if one server fails, traffic is automatically redirected to healthy servers. Replicating the database to a standby site with automatic failover (E) ensures that if the primary site becomes unreachable, the database can be promoted to active without manual intervention, meeting the requirement for automatic recovery.

Exam trap

CompTIA often tests the misconception that hardware redundancy (like RAID 10) alone is sufficient for high availability, but it ignores site-level failures and automatic recovery requirements.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 676–750