Security+ SY0-701 SY0-701 Questions 751–825 | Page 11/14

751

MCQmedium

Based on the exhibit, which authentication method best meets the stated remote-admin requirement?

A.SMS one-time code, because it is widely supported and easy for users to adopt.

B.Email one-time link, because it can be delivered to any mailbox quickly.

C.Authenticator app TOTP code, because it adds a second factor without special hardware.

D.FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery.

AnswerD

The requirement explicitly calls for a phishing-resistant factor that does not depend on text messages or email. A FIDO2 hardware security key meets that need and is well suited for privileged administrator authentication because it strongly binds the login to the legitimate site.

Why this answer

The remote-admin requirement emphasizes phishing resistance and independence from SMS or email delivery, which are vulnerable to interception or social engineering. FIDO2 hardware security keys use public-key cryptography and origin-bound credentials, making them phishing-resistant and eliminating reliance on potentially compromised communication channels. This aligns with the stated requirement better than the other options.

Exam trap

The trap here is that candidates often choose TOTP (Option C) because it is a common second factor, but they overlook that the question specifically requires phishing resistance, which TOTP does not provide against modern adversary-in-the-middle attacks, whereas FIDO2 does.

How to eliminate wrong answers

Option A is wrong because SMS one-time codes are susceptible to SIM swapping, SS7 attacks, and phishing, and they rely on the mobile carrier network, which does not meet a requirement for phishing resistance. Option B is wrong because email one-time links can be intercepted via mailbox compromise or man-in-the-middle attacks, and they depend on email delivery, which is not phishing-resistant. Option C is wrong because authenticator app TOTP codes, while more secure than SMS, are still vulnerable to real-time phishing attacks (e.g., adversary-in-the-middle) where the user is tricked into entering the code on a fake site, and they do not provide the same level of phishing resistance as FIDO2.

Full explanation →

752

MCQeasy

Employees in a lobby say their phones automatically connected to a wireless network named CorpWiFi, even though the legitimate access point was offline. They were then shown a fake sign-in page. What threat is this?

A.An evil twin access point impersonating the real corporate wireless network

B.A Bluetooth replay attack that reuses captured pairing data

C.A cloud misconfiguration exposing a storage bucket to the internet

D.A dependency compromise in a software library used by the company portal

AnswerA

An evil twin is a rogue access point that advertises the exact service set identifier (SSID) of the legitimate corporate wireless network, often on a stronger signal than the real AP. Because many devices are configured to auto-reconnect to previously joined SSIDs, they will associate with the evil twin without any user intervention. Once connected, the attacker sits in the middle, presenting a phishing login page or harvesting credentials. In a lobby, an attacker can easily deploy this using a small battery-powered Wi-Fi device, making it the correct explanation.

Why this answer

This is an evil twin attack. The attacker sets up a rogue access point broadcasting the same SSID (CorpWiFi) as the legitimate network. When the real access point goes offline, client devices automatically connect to the stronger signal of the rogue AP, allowing the attacker to present a fake captive portal to harvest credentials.

Exam trap

The trap here is that candidates may confuse an evil twin with a rogue access point, but the key distinction is that an evil twin specifically impersonates a legitimate SSID to trick clients into connecting, whereas a rogue AP is simply an unauthorized device on the network.

How to eliminate wrong answers

Option B is wrong because a Bluetooth replay attack involves capturing and retransmitting Bluetooth pairing packets to gain unauthorized access, not connecting to a Wi-Fi network or presenting a fake sign-in page. Option C is wrong because a cloud misconfiguration exposing a storage bucket would allow unauthorized data access via the internet, not cause phones to auto-connect to a rogue Wi-Fi network. Option D is wrong because a dependency compromise in a software library would affect the company portal's code execution or data integrity, not involve wireless network impersonation or captive portal phishing.

Full explanation →

753

Multi-Selecteasy

Which two documents are typically mandatory and organization-wide rather than optional guidance? Select two.

Select 2 answers

A.Security policy

B.Standard

C.Guideline

D.Personal preference note

E.Architecture diagram

AnswersA, B

A security policy is the highest-level governance document that mandates management's intent, scope, and responsibilities for protecting information assets. It is organization-wide, enforceable, and forms the basis for all subordinate controls. Under ISO/IEC 27001, the security policy must be formally approved and communicated, and non-compliance is grounds for disciplinary action.

Why this answer

Security policies are mandatory, high-level documents that define management's intent and direction for security, establishing rules that all employees must follow. They are organization-wide and enforceable, unlike guidelines which are optional. Standards are also mandatory and specify uniform technical controls or configurations (e.g., requiring AES-256 encryption) that must be implemented across the organization to comply with the security policy.

Exam trap

The trap here is that candidates often confuse 'guidelines' with 'standards' because both provide technical details, but guidelines are optional while standards are mandatory, and the exam expects you to distinguish between enforceable documents (policy/standard) and advisory ones (guideline).

Full explanation →

754

MCQmedium

A regulated workload must run in the cloud with the strongest possible isolation from other tenants, and the company wants to avoid managing its own physical hardware. Which placement is the best fit?

A.Use a dedicated host so the underlying hardware is allocated to one customer only.

B.Use a shared tenancy instance with tighter security groups and a private subnet.

C.Move the workload into a public subnet so the provider can inspect traffic more easily.

D.Use a container within a shared platform because containers always isolate tenants completely.

AnswerA

A dedicated host provides the highest level of tenant isolation without requiring the organization to own or maintain the physical server. It is a strong fit for regulated workloads where the business wants reduced sharing at the hardware layer.

Why this answer

A dedicated host provides the strongest possible isolation by ensuring that the physical server is not shared with any other tenant. This meets the requirement for a regulated workload without the company managing its own hardware, as the cloud provider still handles maintenance and patching.

Exam trap

The trap here is that candidates often confuse logical isolation (like security groups or private subnets) with physical isolation, assuming that network controls alone satisfy the requirement for the strongest possible isolation from other tenants.

How to eliminate wrong answers

Option B is wrong because shared tenancy instances, even with tighter security groups and a private subnet, still share the underlying physical hardware with other tenants, which does not meet the requirement for the strongest possible isolation. Option C is wrong because moving the workload into a public subnet exposes it directly to the internet and does not enhance isolation; the provider inspecting traffic does not prevent resource sharing at the hardware level.

Full explanation →

755

Multi-Selectmedium

A security analyst is reviewing the organization’s security awareness program. Which three of the following are key metrics that demonstrate the effectiveness of the program? (Choose three.)

Select 3 answers

.Percentage of employees who complete annual security training

.Number of phishing simulation clicks before and after training

.Total count of security incidents reported by employees

.Average time to patch critical vulnerabilities in production systems

.Number of firewall rule changes approved per quarter

.Percentage of servers with full disk encryption enabled

Why this answer

The percentage of employees who complete annual security training is a key metric because it measures participation in the foundational awareness activity. The number of phishing simulation clicks before and after training directly quantifies behavioral change, showing whether training reduces susceptibility to social engineering. The total count of security incidents reported by employees indicates whether the program has successfully fostered a culture of reporting, which is critical for early threat detection.

Exam trap

The trap here is that candidates confuse operational security metrics (like patch time or encryption coverage) with human-centric awareness metrics, leading them to select technical controls that do not measure employee behavior or program effectiveness.

Full explanation →

756

MCQmedium

A file-conversion API accepts a URL to generate a preview image. An attacker submits a URL for the cloud metadata service at 169.254.169.254 and receives instance credentials in the preview output. What attack is this?

A.SQL injection

B.Server-side request forgery

C.Cross-site request forgery

D.Command injection

AnswerB

Server-side request forgery occurs when an attacker tricks a server into making an unintended request to an internal or privileged resource.

Why this answer

The attack is Server-Side Request Forgery (SSRF) because the attacker manipulates the file-conversion API into making an outbound HTTP request to an internal IP address (169.254.169.254, the cloud metadata service). The API then returns the metadata (including instance credentials) in the generated preview image, exploiting the server's trust to access internal resources that are not directly accessible from the internet.

Exam trap

The trap here is that candidates confuse SSRF with CSRF because both involve 'request forgery,' but SSRF targets server-side requests to internal resources, while CSRF targets user-side requests to perform unauthorized actions.

How to eliminate wrong answers

Option A is wrong because SQL injection involves injecting malicious SQL queries into input fields to manipulate a database, not making the server request internal URLs. Option C is wrong because Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser into performing unwanted actions on a trusted site, not exploiting server-side URL fetching. Option D is wrong because command injection involves injecting operating system commands into input that is executed by the server, not manipulating URL requests to internal services.

Full explanation →

757

MCQeasy

After a phishing account compromise has been contained and the attacker’s mailbox forwarding rule was removed, what should the team do next?

A.Stop the investigation because the forwarding rule was deleted.

B.Reset credentials and verify there are no other persistence methods before recovery.

C.Close the ticket and tell the user to be more careful next time.

D.Wait one week before taking any action so the attacker does not notice.

AnswerB

This option follows the eradication and recovery phases of incident response. Resetting the compromised account's credentials revokes the attacker's direct access, and verifying for other persistence methods (e.g., additional forwarding rules, new admin roles, or scheduled tasks) ensures the intrusion is fully removed before restoring services. It avoids an incomplete recovery that could allow the attacker to slip back in.

Why this answer

After removing a mailbox forwarding rule, the team must reset the compromised account's credentials and verify that no other persistence mechanisms (e.g., additional forwarding rules, OAuth app grants, or mailbox delegation) remain. This ensures the attacker cannot regain access using cached credentials or alternate backdoors, which is critical before returning the account to production.

Exam trap

The trap here is that candidates assume removing the visible persistence mechanism (the forwarding rule) is sufficient, but CompTIA tests the understanding that attackers often deploy multiple backdoors, and credential reset plus full verification is mandatory before recovery.

How to eliminate wrong answers

Option A is wrong because stopping the investigation after deleting a single forwarding rule ignores other potential persistence methods like hidden inbox rules, OAuth tokens, or SMTP auth compromises. Option C is wrong because closing the ticket without remediation leaves the account vulnerable and fails to address the root cause of the compromise. Option D is wrong because waiting a week allows the attacker to re-establish persistence or exfiltrate more data, violating the principle of timely incident response.

Full explanation →

758

MCQmedium

A security manager wants every corporate laptop to use the same mandatory settings, including disk encryption, a 10-minute screen lock, and removal of local administrator rights. Which document should define these specific requirements?

A.Policy

B.Standard

C.Guideline

D.Procedure

AnswerB

A standard is the correct document for exact, mandatory configuration requirements. It provides specific, consistent rules such as encryption requirements, lock timers, and privilege restrictions so administrators can implement the same baseline across all laptops. Standards translate policy intent into enforceable technical expectations and make compliance measurable.

Why this answer

A standard defines mandatory, specific technical requirements that must be uniformly applied across all systems, such as enforcing AES-256 disk encryption, a 600-second screen lock timeout, and removal of local administrator rights. Unlike a policy, which is high-level and goal-oriented, a standard provides the precise configuration settings that implement the policy's intent. This aligns with the CompTIA SY0-701 domain of Security Program Management and Oversight, where standards bridge the gap between policy and technical implementation.

Exam trap

The trap here is confusing the broad, principle-based nature of a policy with the specific, mandatory technical requirements of a standard, leading candidates to choose 'Policy' when the question explicitly asks for a document that defines 'specific requirements'.

How to eliminate wrong answers

Option A is wrong because a policy is a high-level statement of management intent and security goals (e.g., 'all laptops must be secured'), not a document that specifies mandatory technical settings like disk encryption algorithms or exact timeout values. Option C is wrong because a guideline is a set of recommended practices or suggestions that are not mandatory, whereas the question explicitly requires 'mandatory settings' that must be enforced on every corporate laptop.

Full explanation →

759

Matchingmedium

Match each change-management practice to the best description for reducing patching risk in production.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Use a phased rollout to catch compatibility issues early

Provide a rollback or backout plan if the patch fails

Place the work inside a maintenance window

Create a baseline that supports recovery and comparison

Apply change control and obtain approval

Why these pairings

These change-management practices reduce patching risk by ensuring proper review, scheduling, rollback capability, pre-testing, documentation, and automation to minimize errors.

Full explanation →

760

MCQeasy

EDR flags a workstation because a word processor launched an unusual script and then contacted a rare external domain. What is the best immediate action?

A.Isolate the workstation from the network using the EDR tool.

B.Wait for another alert before taking any action.

C.Delete the word processor immediately.

D.Reboot the workstation to see if the behavior happens again.

AnswerA

This is the best immediate containment step because it stops the workstation from communicating with a possible attacker while preserving the system for further analysis. EDR isolation is designed for exactly this type of suspicious endpoint behavior. It limits lateral movement, reduces data exfiltration risk, and gives responders time to investigate before deciding on cleanup or reboot actions.

Why this answer

Isolating the workstation with the EDR tool is the best immediate action because it contains the potential compromise by cutting off network communication, preventing lateral movement or data exfiltration while preserving forensic evidence. The combination of an unusual script execution from a word processor and a connection to a rare external domain strongly suggests a possible malware infection or remote access trojan (RAT) that requires immediate containment.

Exam trap

The trap here is that candidates may think rebooting (Option D) is a safe first step, but it can destroy volatile evidence and does not contain the threat, whereas isolation via EDR is the correct containment action per incident response best practices.

How to eliminate wrong answers

Option B is wrong because waiting for another alert could allow the threat to spread or exfiltrate data, violating the principle of timely containment in incident response. Option C is wrong because deleting the word processor does not address the underlying malicious script or process that may still be running, and it destroys potential forensic evidence. Option D is wrong because rebooting the workstation may terminate the suspicious process but does not prevent the system from being re-infected or the attacker from re-establishing access, and it could also clear volatile memory evidence.

Full explanation →

761

MCQhard

Based on the exhibit, which document type should the service desk use for the locked-account workflow?

A.Policy, because it states broad rules for account access.

B.Standard, because it defines the minimum password requirements for all users.

C.Procedure, because it lists the exact steps analysts must follow in sequence.

D.Guideline, because it gives flexible suggestions for handling locked accounts.

AnswerC

A procedure is the correct document when management wants analysts to perform a task exactly the same way every time. The exhibit contains sequential steps for identity verification, password reset, ticket recording, and user confirmation. That is operational guidance, not a broad policy statement or an optional guideline.

Why this answer

A procedure document is the correct choice because it provides a step-by-step sequence of actions that service desk analysts must follow to unlock an account. The locked-account workflow requires precise, ordered steps (e.g., verifying identity, checking lockout status, resetting the account) to ensure consistency and security, which aligns with the definition of a procedure.

Exam trap

The trap here is confusing a procedure with a policy or standard, as candidates often think 'rules for account access' (policy) or 'password requirements' (standard) apply to the workflow, but only a procedure provides the exact sequential steps needed for operational tasks.

How to eliminate wrong answers

Option A is wrong because a policy states high-level rules and objectives (e.g., 'accounts must be locked after 3 failed attempts') but does not provide the specific steps for unlocking. Option B is wrong because a standard defines mandatory requirements like minimum password length or complexity, not the workflow for handling locked accounts. Option D is wrong because a guideline offers flexible suggestions or best practices, whereas the locked-account workflow requires strict adherence to a defined sequence to avoid security gaps.

Full explanation →

762

MCQmedium

A company uses a third-party expense application and wants employees to sign in with their corporate identity once, then automatically lose access in the expense app when they are terminated in the HR system. Which solution best meets both requirements?

A.Create separate local usernames in the expense app and synchronize passwords weekly.

B.Implement federated single sign-on and automated user provisioning and deprovisioning.

C.Require a VPN connection before users can open the expense app.

D.Use a shared generic account for all employees and rotate the password monthly.

AnswerB

Federated single sign-on, using SAML 2.0 or OIDC, lets employees authenticate with their existing corporate credentials through an identity provider (IdP), so the expense app never stores separate passwords. Automated provisioning via SCIM or similar APIs creates, updates, and disables accounts based on authoritative HR/directory data, ensuring deprovisioning happens in near real-time when an employee leaves or changes roles. This gives the company centralized visibility and control over access, reduces orphaned accounts, and satisfies audit requirements for identity lifecycle management.

Why this answer

Federated single sign-on (SSO) allows users to authenticate once using their corporate identity (e.g., via SAML or OIDC), and automated provisioning/deprovisioning (often via SCIM) ensures that when an employee is terminated in the HR system, their access to the expense app is automatically revoked. This meets both requirements: seamless sign-in and immediate loss of access upon termination.

Exam trap

The trap here is that candidates may think VPN or password synchronization provides adequate access control, but they fail to recognize that only federated SSO combined with automated provisioning/deprovisioning ensures both seamless authentication and immediate revocation tied to the corporate identity lifecycle.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and synchronizing passwords weekly does not provide single sign-on (users still need separate credentials) and weekly sync introduces a delay, so terminated employees could retain access for up to a week. Option C is wrong because requiring a VPN connection controls network access but does not address authentication or automated deprovisioning; a terminated employee could still sign in if their credentials are valid. Option D is wrong because a shared generic account violates the principle of individual accountability, cannot tie access to a specific employee's termination, and monthly password rotation does not automatically revoke access upon termination.

Full explanation →

763

MCQhard

Based on the exhibit, which additional control best reduces the risk of tailgating at the entrance while preserving normal employee flow?

A.Post a security guard at the entrance during business hours.

B.Install a mantrap or anti-passback turnstile that admits one person per badge authorization.

C.Add more CCTV cameras in the lobby and at the parking lot entrance.

D.Send quarterly emails reminding employees not to hold doors open.

AnswerB

This is the best fit because the current controls detect the problem but do not stop it. A mantrap or turnstile is a preventive physical control that enforces single-person entry and directly addresses tailgating while keeping normal employee movement efficient. It reduces reliance on people noticing and reacting in real time.

Why this answer

A mantrap or anti-passback turnstile enforces one-person-per-badge authorization, physically preventing tailgating by only allowing a single individual to pass per valid credential. This preserves normal employee flow because authorized users can enter quickly without manual intervention, unlike guards or awareness campaigns that rely on human compliance.

Exam trap

CompTIA often tests the distinction between preventive controls (mantraps/turnstiles) and detective or administrative controls (CCTV, emails, guards), leading candidates to choose a familiar but ineffective option like CCTV or security guards.

How to eliminate wrong answers

Option A is wrong because posting a security guard is a deterrent, not a technical control; guards can be bypassed or overwhelmed during peak hours and do not scale to maintain normal flow without causing bottlenecks. Option C is wrong because CCTV cameras are detective controls that record incidents after they occur, not preventive controls that stop tailgating in real time. Option D is wrong because quarterly email reminders are administrative controls that rely on employee behavior change; they are ineffective against intentional tailgating and do not enforce physical access restrictions.

Full explanation →

764

MCQmedium

A SOC analyst receives a SIEM alert for a possible brute-force attack against a remote access portal. The alert shows 240 failed logins from the same source IP over 4 minutes, followed by one successful login. Before escalating as an incident, what is the BEST evidence to check to determine whether the alert is a false positive caused by approved activity?

A.Whether the source IP belongs to the company help desk

B.Whether there is a change ticket or test plan for the access portal and the activity matches the approved maintenance window

C.Whether the user account has MFA enabled

D.Whether the firewall is in inline mode

AnswerB

A change ticket or test plan that specifically covers the access portal, combined with the login activity occurring within the approved maintenance window, is the strongest evidence that the SIEM alert is a false positive. This documentation confirms intent and authorization, which no technical indicator can provide. It directly aligns with change management processes and incident response triage best practices, allowing the analyst to close the alert without unnecessary escalation.

Why this answer

A change ticket or test plan that matches the observed activity (240 failed logins followed by a successful login during an approved maintenance window) would indicate that the alert is a false positive caused by authorized testing or maintenance, not a malicious brute-force attack. This is the best evidence because it directly ties the SIEM alert to approved, scheduled activity, which is a standard operational control for change management.

Exam trap

The trap here is that candidates may assume a help desk IP or MFA automatically validates the activity, but only a documented change ticket or test plan provides the necessary evidence to classify the alert as a false positive under standard incident response procedures.

How to eliminate wrong answers

Option A is wrong because the source IP belonging to the company help desk does not automatically make the activity approved; help desk staff could still be performing unauthorized or malicious actions, and the IP alone does not provide evidence of a change ticket or test plan. Option C is wrong because MFA being enabled on the user account does not explain the 240 failed logins from a single source IP; MFA is a security control that would mitigate the impact of a successful login but does not prove the activity was approved or that the alert is a false positive.

Full explanation →

765

MCQmedium

An HR portal has three job functions: HR staff update employee records, managers approve leave requests, and payroll views salary data. The security team wants to prevent any one role from having all capabilities. Which access design is the best fit?

A.Use a single superuser account for the entire department so tasks can be completed quickly.

B.Create role-based access groups aligned to each job function and grant only the permissions needed for that role.

C.Give every employee access to all portal features and depend on audit logs to catch mistakes later.

D.Require the payroll team to share one common password and use it only from the office network.

AnswerB

Role-based access control is the right design because it maps permissions to job responsibilities. HR, managers, and payroll each receive only the access they need, which supports separation of duties and makes access reviews easier. It also reduces the chance that one user or one account can perform every sensitive action in the portal.

Why this answer

Role-based access control (RBAC) is the correct design because it enforces the principle of least privilege by granting each job function only the permissions necessary for its tasks. This prevents any single role from accumulating all capabilities (e.g., HR staff cannot approve leave or view salary data), directly addressing the security team's requirement to separate duties. RBAC aligns with NIST SP 800-53 AC-6 and is a standard access control model for multi-role enterprise applications.

Exam trap

The trap here is that candidates may confuse 'role-based access control' with 'discretionary access control' (DAC) or think that audit logs alone are sufficient for security, but the SY0-701 exam emphasizes that preventive controls (like RBAC) are superior to detective controls (like logging) for enforcing separation of duties.

How to eliminate wrong answers

Option A is wrong because a single superuser account violates separation of duties and least privilege, granting all capabilities to one user and increasing the risk of insider threats or credential compromise. Option C is wrong because giving every employee full access to all portal features removes all access controls, making the system reliant solely on audit logs for detection rather than prevention, which is a security anti-pattern. Option D is wrong because shared passwords eliminate non-repudiation and accountability, and restricting access by network location (e.g., office network) does not prevent a single role from having all capabilities; it only adds a weak perimeter control.

Full explanation →

766

MCQhard

Based on the exhibit, which change best improves both recovery time and recovery point for the ERP database? A mid-sized company has a two-hour RTO and a 30-minute RPO, but its current backup design cannot meet either objective during restore testing.

A.Add a second nightly full backup at 23:30 to the same NAS device.

B.Move the NAS to a different VLAN but keep the backup schedule unchanged.

C.Implement frequent transaction log backups and a pre-staged standby or automated recovery image.

D.Increase backup retention from one month to one year.

AnswerC

Transaction log backups reduce the amount of data lost between full backups, improving the RPO. A pre-staged standby or automated recovery image shortens rebuild time, improving the RTO. Together, these changes directly address both recovery objectives instead of simply storing the same backups more safely or for longer. The test results show that the current restore approach is far too slow and too coarse.

Why this answer

Implementing frequent transaction log backups (e.g., every 5–10 minutes) allows point-in-time recovery, reducing the recovery point objective (RPO) to minutes. A pre-staged standby or automated recovery image reduces recovery time objective (RTO) by eliminating the need to restore from scratch, enabling near-instant failover. This directly addresses the company's inability to meet its 30-minute RPO and 2-hour RTO during restore testing.

Exam trap

The trap here is that candidates confuse backup frequency (e.g., more full backups) with recovery point improvement, failing to recognize that only transaction log backups or incremental changes can reduce RPO below the full backup interval, and that pre-staging is required to meet aggressive RTOs.

How to eliminate wrong answers

Option A is wrong because adding a second nightly full backup to the same NAS device does not reduce the recovery point window (still up to 24 hours of data loss) and does not improve recovery time (restore still takes hours from a full backup). Option B is wrong because moving the NAS to a different VLAN addresses network segmentation or security, not backup performance or recovery objectives; it has no impact on RTO or RPO. Option D is wrong because increasing retention from one month to one year only extends how far back data can be restored, not how quickly or with how little data loss; it does not improve RTO or RPO.

Full explanation →

767

MCQmedium

An HR portal has three groups: HR staff can edit employee records, managers can approve leave, and payroll can view salary data. No one should have all functions. Which access model should the engineer implement?

A.Role-based access control with separate groups mapped to each business function.

B.A single shared admin account so all tasks can be completed quickly.

C.Mandatory access control with all users assigned the same clearance level.

D.Local account creation on the portal for each user, with permissions assigned manually one by one.

AnswerA

RBAC fits business duties well and keeps access aligned to job functions instead of individual exceptions.

Why this answer

Role-Based Access Control (RBAC) allows the engineer to define three distinct roles (HR staff, managers, payroll) with granular permissions mapped to specific business functions, ensuring no single user inherits all privileges. This model enforces the principle of least privilege by separating duties across groups, preventing any user from having full access to the portal's sensitive operations.

Exam trap

The trap here is that candidates may confuse RBAC with MAC or DAC, assuming that any access control model can enforce separation of duties, but only RBAC with distinct role groups directly addresses the requirement of mapping business functions to permissions without granting overlapping privileges.

How to eliminate wrong answers

Option B is wrong because a single shared admin account violates the principle of least privilege and separation of duties, as it would grant all three functions to anyone using the account, making auditing and accountability impossible. Option C is wrong because Mandatory Access Control (MAC) with all users assigned the same clearance level would not differentiate between HR, managers, and payroll functions; MAC relies on labels and clearances, not job roles, so it cannot enforce the required separation of business functions. Option D is wrong because local account creation with manual permissions is not scalable, introduces administrative overhead, and lacks the centralized, role-based grouping needed to enforce consistent separation of duties across the portal.

Full explanation →

768

MCQmedium

A vulnerability scan finds that an administrative SSH service on a Linux server is listening on 0.0.0.0 and is reachable from the internet. The server is meant to be managed only from the internal admin subnet. What is the best remediation?

A.Patch the SSH client on administrator laptops so the server cannot be reached externally.

B.Restrict SSH to the management network and block public access with firewall or host-based rules.

C.Enable a captive portal on the public interface so only authenticated users see the service.

D.Replace SSH with FTP because FTP can be configured to allow administrative access more easily.

AnswerB

Restricting SSH to the management network and blocking public access at the firewall or with host-based rules is the appropriate least-exposure control. This ensures only trusted administrative workstations can reach the SSH service, reducing the attack surface and preventing external brute-force or exploitation attempts. This approach aligns with secure administrative practices by providing network-level access control.

Why this answer

The vulnerability is that SSH is exposed to the internet on 0.0.0.0, which violates the principle of least privilege and exposes the administrative interface to unauthorized access. The best remediation is to restrict SSH to the internal management subnet using firewall rules (e.g., iptables, security group ACLs) or host-based rules (e.g., tcpwrappers, /etc/hosts.allow), ensuring only trusted internal IPs can reach the service. This directly addresses the exposure without changing the protocol or client configuration.

Exam trap

The trap here is that candidates may think patching the client (Option A) or adding authentication (Option C) solves the exposure, but the core issue is network-level access control—no amount of client-side patching or portal authentication can prevent an attacker from reaching the open SSH port from the internet.

How to eliminate wrong answers

Option A is wrong because patching the SSH client on administrator laptops does nothing to prevent external attackers from reaching the server; the server is still listening on 0.0.0.0 and accessible from the internet. Option C is wrong because a captive portal is a web-based authentication mechanism typically used for guest networks, not for securing an SSH service; SSH does not support captive portal redirection, and this would not prevent direct TCP access to port 22. Option D is wrong because FTP transmits credentials and data in cleartext by default, which is far less secure than SSH; replacing SSH with FTP would increase the attack surface and violate security best practices for administrative access.

Full explanation →

769

MCQhard

Based on the exhibit, what is the best next request before approving the vendor?

A.Ask for a fresh marketing brochure that describes the vendor's security controls in detail.

B.Accept the internal penetration test summary because it proves the controls were tested recently.

C.Request only the shared responsibility matrix again, since it covers all security responsibilities.

D.Request a current SOC 2 Type II report or equivalent independent operating-effectiveness attestation.

AnswerD

The business specifically wants independent evidence that controls operated effectively during a recent period. A SOC 2 Type II report is designed for that purpose, whereas a Type I report only addresses control design at a point in time. Because the current packet lacks both timely independent assurance and contractual safeguards, the SOC 2 Type II request is the most defensible next step.

Why this answer

A SOC 2 Type II report provides an independent, third-party attestation of the effectiveness of a vendor's security controls over a period of time (typically 6–12 months). This is the most reliable evidence for verifying that the vendor's operational security controls are working as intended, which is critical before approving a vendor. The internal penetration test summary (Option B) lacks independence and may not cover all relevant controls, while a marketing brochure (Option A) is not a verifiable audit artifact.

The shared responsibility matrix (Option C) defines roles but does not attest to control effectiveness.

Exam trap

The trap here is that candidates may think an internal penetration test summary (Option B) is sufficient because it 'proves the controls were tested recently,' but the exam emphasizes that independence and sustained operational effectiveness (as shown in a SOC 2 Type II) are required for vendor approval, not just a point-in-time internal test.

How to eliminate wrong answers

Option A is wrong because a marketing brochure is a self-promotional document with no independent verification or audit rigor; it cannot substitute for a formal attestation report like SOC 2. Option B is wrong because an internal penetration test summary is not independent—it was performed by the vendor's own team or a hired firm without the objectivity of a third-party auditor, and it only tests a snapshot in time rather than sustained operational effectiveness. Option C is wrong because a shared responsibility matrix only clarifies which party is responsible for which security controls; it does not provide any evidence that those controls are actually implemented or operating effectively.

Full explanation →

770

MCQeasy

A vulnerability scan finds a critical flaw on a public-facing server and a medium flaw on a lab system that is not connected to the production network. Which issue should be fixed first?

A.The medium flaw on the isolated lab system, because all vulnerabilities should be fixed in alphabetical order.

B.The critical flaw on the public-facing server, because it has higher business risk.

C.Both systems can wait until the next quarterly patch cycle.

D.The lab system, because internal systems always outrank external systems.

AnswerB

The critical flaw on the public-facing server is the clear first priority because the combination of high severity and direct internet exposure dramatically increases both the probability of exploitation and the potential business impact. Critical vulnerabilities often have publicly available proof-of-concept exploits or are leveraged in automated attacks, so the remediation window is short. Addressing this server first reduces the likelihood of a successful attack that could affect customers, brand reputation, or regulatory compliance.

Why this answer

The critical flaw on the public-facing server should be fixed first because it presents a higher business risk. A public-facing server is directly accessible from the internet, making it a prime target for attackers. Exploiting a critical vulnerability could lead to data breaches, service disruption, or unauthorized access, with immediate and severe business impact.

In contrast, the medium flaw on an isolated lab system poses no direct threat to production operations or sensitive data.

Exam trap

The trap here is that candidates may assume all vulnerabilities must be fixed in order of severity alone, ignoring the crucial factor of asset exposure and business context, or they may mistakenly believe that internal systems are always more critical than external ones.

How to eliminate wrong answers

Option A is wrong because fixing vulnerabilities in alphabetical order is not a valid prioritization method; risk-based prioritization based on severity and exposure is the industry standard. Option C is wrong because delaying remediation of a critical flaw on a public-facing server until the next quarterly patch cycle could leave the organization exposed to exploitation for an unacceptable period; critical vulnerabilities often require immediate patching or compensating controls. Option D is wrong because internal systems do not always outrank external systems; in fact, public-facing systems typically have higher risk due to internet exposure, and isolated lab systems have minimal business risk.

Full explanation →

771

MCQmedium

Based on the exhibit, which wireless security change best addresses both unauthorized device access and the risk of a lost laptop connecting to corporate resources?

A.Increase the PSK length and rotate it every 30 days.

B.Move the SSID to WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks.

C.Hide the SSID and enable MAC address filtering on the access points.

D.Keep the current wireless design and rely on a VPN client for all remote access.

AnswerB

Enterprise Wi-Fi uses individual authentication instead of a shared passphrase, so access can be tied to a specific user or device. Device certificates and MDM compliance checks strengthen control over enrolled endpoints and make it easier to revoke access for lost or noncompliant devices. This is the most secure and manageable architecture shown by the exhibit.

Why this answer

WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks provides mutual authentication and per-user, per-session encryption. This eliminates the risk of a lost laptop connecting to corporate resources (since device certificates can be revoked) and prevents unauthorized device access through certificate-based authentication and MDM compliance enforcement, unlike shared PSK which cannot be individually revoked.

Exam trap

The trap here is that candidates often think hiding the SSID or MAC filtering provides meaningful security, but these are easily bypassed and do not address revocation or per-device authentication, while PSK rotation seems proactive but fails to solve the lost-laptop revocation problem.

How to eliminate wrong answers

Option A is wrong because increasing PSK length and rotating it every 30 days still uses a shared pre-shared key, which cannot be individually revoked if a laptop is lost; any device with the current PSK can connect, and rotating the PSK requires reconfiguring all authorized devices, causing operational overhead. Option C is wrong because hiding the SSID and enabling MAC address filtering are trivial security measures: SSID hiding is easily defeated by passive monitoring (the SSID is broadcast in probe requests and beacons), and MAC addresses can be spoofed, so neither prevents a lost laptop from connecting nor stops unauthorized devices. Option D is wrong because relying solely on a VPN client without changing the wireless security leaves the network open to unauthorized devices connecting directly to the wireless LAN; a lost laptop with VPN credentials could still connect to the corporate network via the wireless SSID before the VPN is established, and there is no per-device revocation mechanism.

Full explanation →

772

MCQmedium

A business-critical internal reporting portal is exposed to all employees. A scan finds a high-severity vulnerability, but the vendor says a fix will not be available for 30 days. The application is only used by finance once a month, and the business can tolerate a brief outage if needed. Which risk treatment is the BEST immediate action?

A.Accept the risk because the application is used infrequently and the impact is limited.

B.Apply compensating controls, such as restricting access and adding a temporary control, until the vendor patch is available.

C.Transfer the risk by purchasing cyber insurance for the application.

D.Avoid the risk by permanently decommissioning the reporting portal.

AnswerB

This is the best choice because it reduces the likelihood of exploitation while the patch is unavailable. Restricting access to only the users who truly need the system, adding temporary network or application-layer controls, and documenting the residual risk are practical mitigation steps. The scenario shows the business can tolerate a short interruption, so a short-term reduction in exposure is more appropriate than doing nothing or permanently shutting the system down.

Why this answer

Applying compensating controls—such as restricting access to only the finance team and implementing a temporary web application firewall (WAF) rule—immediately reduces the attack surface while the vendor develops a patch. This aligns with the risk treatment of mitigation, as it lowers the likelihood of exploitation without requiring a full fix. The business can tolerate a brief outage, so a temporary access control list (ACL) or IP whitelist is a practical, immediate measure.

Exam trap

The trap here is that candidates may choose 'Accept the risk' (Option A) because the app is used infrequently, but they overlook that a high-severity vulnerability in an internal portal still poses a significant risk of lateral movement or data exposure, making acceptance inappropriate without compensating controls.

How to eliminate wrong answers

Option A is wrong because accepting the risk ignores the high-severity nature of the vulnerability; even infrequent use can lead to a data breach if exploited, and the impact may be greater than assumed. Option C is wrong because transferring risk via cyber insurance does not prevent the vulnerability from being exploited; it only provides financial reimbursement after an incident, which is not an immediate security control. Option D is wrong because permanently decommissioning the portal is an extreme measure that would disrupt the monthly finance reporting, and the business only tolerates a brief outage, not permanent loss of the application.

Full explanation →

773

MCQeasy

During a disaster recovery test, what is the most important thing to confirm about the backup?

A.That the backup files exist in storage.

B.That the data can be restored and is usable after recovery.

C.That the backup system uses encryption.

D.That the backup is stored on tape instead of disk.

AnswerB

The real purpose of a backup is successful recovery. During testing, the team should verify that the data restores correctly and that applications or users can actually use it afterward. This confirms the backup supports business continuity and is not merely sitting in storage as an unreadable copy.

Why this answer

The most important thing to confirm about a backup during a disaster recovery test is that the data can be restored and is usable after recovery. This validates the integrity and completeness of the backup, ensuring that the recovery point objective (RPO) and recovery time objective (RTO) can be met. Simply verifying that backup files exist does not guarantee they are not corrupted or that the restoration process will succeed, which is why a full restore test is critical.

Exam trap

The trap here is that candidates often confuse backup existence with backup usability, assuming that if the backup file is present and encrypted, it must be restorable, but CompTIA emphasizes that only a successful restore test confirms recoverability.

How to eliminate wrong answers

Option A is wrong because merely confirming that backup files exist in storage does not validate their integrity, consistency, or ability to be restored; a backup file could be present but corrupted or incomplete. Option C is wrong because encryption protects data at rest or in transit but has no bearing on whether the backup can be successfully restored and used; encryption is a security control, not a recovery validation. Option D is wrong because the storage medium (tape vs. disk) is irrelevant to the core requirement of recoverability; both media can hold valid or invalid backups, and the choice depends on factors like speed, cost, and retention, not on the ability to restore.

Full explanation →

774

MCQmedium

A security analyst discovers that an organization's web application is vulnerable to SQL injection. The application uses a legacy database driver that does not support parameterized queries. Which of the following is the BEST mitigation to prevent this vulnerability?

A.Implement a web application firewall (WAF) to filter malicious input.

B.Update the database driver to a version that supports parameterized queries.

C.Encode all user input using HTML encoding.

D.Disable error messages that reveal database schema.

AnswerB

Parameterized queries, also known as prepared statements, separate the SQL statement structure from user-supplied data by sending the query template to the database first and then binding input values as parameters. This ensures that even if an attacker submits malicious SQL fragments, they are treated strictly as data values, never as executable command text. Updating the database driver to a version that fully supports these APIs is the definitive root-cause fix, because it eliminates the injection vulnerability instead of merely detecting or filtering attack payloads.

Why this answer

The root cause of the SQL injection vulnerability is the legacy database driver that does not support parameterized queries. Updating the driver to a modern version that supports parameterized queries (also known as prepared statements) allows the application to separate SQL logic from user-supplied data, effectively preventing SQL injection at the database layer. This addresses the fundamental flaw rather than relying on external filtering or encoding.

Exam trap

The trap here is that candidates often choose a WAF (Option A) as a quick fix, overlooking that it only mitigates symptoms rather than eliminating the root cause, which is the lack of parameterized query support in the database driver.

Why the other options are wrong

A WAF can filter known SQL injection patterns but does not fix the root cause; it can be bypassed with obfuscated payloads. The best mitigation is to use parameterized queries, which the legacy driver does not support.

HTML encoding prevents XSS but does not stop SQL injection, as SQL injection exploits database query structure, not HTML rendering.

Disabling error messages does not prevent SQL injection; it only hides error details from users. The vulnerability remains exploitable via blind SQL injection techniques.

When would these options actually be correct?

A WAF would be the best mitigation if the question stated that the database driver cannot be updated (e.g., due to vendor lock-in or legacy system constraints) and the organization needs a compensating control to reduce risk.

This would be correct if the question asked for the best mitigation against cross-site scripting (XSS) in a web application that reflects user input in HTML output.

This would be correct in a question asking for the best mitigation to prevent information disclosure via database error messages, such as in a scenario where the primary concern is leaking schema details through verbose errors.

Why candidates pick the wrong answer

Candidates may think a WAF is a quick, effective solution without understanding that it only provides partial, bypassable protection, and they may overlook the importance of fixing the root cause.

Candidates confuse input encoding with input sanitization, thinking encoding universally prevents injection attacks, but SQL injection requires query parameterization or escaping, not HTML encoding.

Candidates may think that hiding error messages stops attackers from gathering information, but it does not address the root cause of SQL injection.

Full explanation →

775

MCQmedium

Based on the exhibit, what is the best response to the facilities manager's request?

A.Provide the export because the requester is a manager with a legitimate business relationship to employees.

B.Deny the request and direct the manager to use an approved work-contact list or seek privacy review.

C.Send the data to the manager if the manager promises not to share it externally.

D.Store the export in a shared drive so multiple teams can use it for convenience.

AnswerB

The privacy notice clearly limits home addresses and personal phone numbers to defined HR and payroll purposes. The facilities request exceeds that purpose, so the correct action is to deny the export unless a formal privacy review approves another use. Where possible, use a work-contact list that contains less sensitive information.

Why this answer

The facilities manager's request to export employee contact information for a separate system likely violates data privacy policies and potentially regulations like GDPR or CCPA. Option B is correct because the proper procedure is to deny the ad-hoc export and direct the manager to use an approved work-contact list or seek a privacy review, ensuring data handling complies with organizational data governance and privacy requirements.

Exam trap

The trap here is that candidates may assume a manager's role and business relationship automatically grant data access, overlooking the need for formal privacy review and approved data handling procedures.

How to eliminate wrong answers

Option A is wrong because being a manager with a legitimate business relationship does not automatically authorize bulk export of employee personal data; privacy policies and data classification require a formal review. Option C is wrong because a verbal promise not to share data externally is not a security control; data handling must be enforced through technical and policy mechanisms, not trust. Option D is wrong because storing the export in a shared drive increases exposure risk and violates the principle of least privilege; convenience does not override data protection requirements.

Full explanation →

776

MCQhard

Based on the exhibit, which awareness control best addresses the observed failure pattern?

A.Replace the phone-call simulation with longer monthly policy newsletters.

B.Run targeted vishing exercises and teach a callback verification procedure.

C.Disable MFA so users are not asked for one-time codes.

D.Tell users to ignore all requests from anyone outside the company.

AnswerB

This is the best fit because the failures occurred during a phone-based social engineering attack that asked for one-time codes. Targeted vishing drills train users to recognize voice-based pressure tactics, and a callback verification procedure gives them a safe way to confirm legitimacy without relying on the caller. That directly addresses the observed failure pattern.

Why this answer

The exhibit shows a pattern where users are falling for phone-based social engineering (vishing), not email or general phishing. Option B directly addresses this by running targeted vishing exercises to simulate the real threat and teaching a callback verification procedure, which is a specific technical control to verify the identity of callers before taking action. This is the most effective awareness control because it trains users to recognize and respond to the exact attack vector observed.

Exam trap

The trap here is that candidates may choose Option A (longer newsletters) because they think more information is always better, but the question specifically tests the ability to match the awareness control to the observed attack vector (vishing), not general security awareness.

How to eliminate wrong answers

Option A is wrong because replacing phone-call simulations with longer monthly policy newsletters does not address the specific vishing failure pattern; newsletters are passive and less effective for hands-on behavioral change. Option C is wrong because disabling MFA would actually increase security risk by removing a critical authentication layer, and it does not address the social engineering vector at all. Option D is wrong because telling users to ignore all requests from anyone outside the company is impractical and overly broad; legitimate external communications (e.g., from vendors, customers) would be disrupted, and it does not teach a verifiable procedure.

Full explanation →

777

MCQeasy

Analysts see a malware campaign that changes its command-and-control domain every day, but the executable hash and a unique registry value remain the same across incidents. Which indicator is the best candidate for hunting?

A.The daily domain name used for command and control.

B.The executable hash from the malware sample.

C.The employee's home city where the alert was observed.

D.The brand of the user's keyboard and mouse.

AnswerB

The executable hash, such as a SHA-256 digest, is a deterministic value derived from the malware binary's exact byte sequence, so any system running an identical sample will produce the same hash. This makes it a precise and stable indicator of compromise, assuming the sample has not been repacked or modified, and it enables reliable hash-based hunting across all endpoints and forensic artifacts.

Why this answer

The executable hash (e.g., SHA-256) and the unique registry value are static, immutable artifacts that persist across every incident, regardless of the daily domain rotation. These indicators are far more reliable for hunting since they directly identify the malware binary itself, whereas the domain changes frequently and may be blocked or sinkholed after detection.

Exam trap

The trap here is that candidates focus on the changing domain (a dynamic indicator) because it is directly observable in network traffic, but the exam tests the understanding that static indicators (like the hash) are more persistent and effective for hunting across multiple incidents.

How to eliminate wrong answers

Option A is wrong because the daily domain name is a volatile indicator that changes every day, making it unreliable for long-term hunting; it would require constant updates and may already be taken down by the time it is used. Option C is wrong because the employee's home city is a geographic attribute unrelated to the malware's technical characteristics and cannot be used to identify or track the specific malware campaign. Option D is wrong because the brand of the user's keyboard and mouse is a hardware peripheral detail that has no bearing on the malware's behavior or persistence, and it is not a valid indicator of compromise.

Full explanation →

778

MCQmedium

An administrator notices that a finance file share remained normal for weeks after a former contractor left the company. This morning, multiple PDFs and spreadsheets were deleted, and a scheduled task created months ago is now executing a script that wipes files in the shared folder. Which malware type is most consistent with this behavior?

A.Logic bomb triggered by a time or condition after being planted earlier

B.Worm that is automatically propagating to other endpoints

C.Spyware that is secretly collecting keystrokes and screenshots

D.Rootkit that is hiding itself in the kernel to maintain stealth

AnswerA

A logic bomb is the best fit because malicious code was planted earlier and remained dormant until a trigger condition caused it to execute. The scheduled task and delayed destructive action are classic signs of a hidden payload designed to activate later, sometimes after a user departure, date, or system event. The time gap strongly supports this interpretation.

Why this answer

The behavior matches a logic bomb: malicious code planted in advance (the scheduled task created months ago) that remains dormant until triggered by a specific condition (the passage of time or a date). The file share was normal for weeks because the logic bomb had not yet met its trigger condition; once triggered, it executed the script to delete files. This contrasts with other malware types that require active propagation, continuous monitoring, or kernel-level hiding.

Exam trap

The trap here is that candidates may confuse a logic bomb with a worm because both can cause widespread damage, but the key distinction is the pre-planted, dormant nature of the logic bomb versus the active self-propagation of a worm.

How to eliminate wrong answers

Option B is wrong because a worm self-propagates across networks without user intervention, but here the malware was planted as a scheduled task months ago and only activated recently, with no evidence of lateral movement or replication. Option C is wrong because spyware focuses on covert data collection (keystrokes, screenshots) and does not typically delete files or execute destructive scripts via scheduled tasks. Option D is wrong because a rootkit hides its presence by modifying the OS kernel or system calls, whereas the described behavior involves a visible scheduled task and file deletion without any stealth mechanisms.

Full explanation →

779

MCQmedium

An EDR console reports possible beaconing from a workstation because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The workstation belongs to the patch-management team, and the destination resolves to a vendor update service. Which evidence best supports closing the alert as a false positive?

A.The workstation user says the activity looks normal and no files were encrypted.

B.The source IP appears on a blocklist, so the alert must be malicious.

C.Process lineage and signed agent logs show the patch client initiated the traffic on schedule.

D.The workstation has antivirus installed, which means outbound beaconing is impossible.

AnswerC

Process lineage and agent logs provide strong proof that the traffic came from the approved patch client. When the destination is a known vendor service and the timing matches the expected update schedule, the repeated connections are likely normal behavior. This is exactly the kind of evidence analysts should use to validate a detection instead of escalating a benign operational pattern.

Why this answer

It provides verifiable evidence that the outbound HTTPS connections are legitimate: the process lineage and signed agent logs confirm the patch-management client initiated the traffic on its scheduled update cycle. This aligns with the expected behavior of a patch-management tool, which often uses HTTPS to a vendor update service at regular intervals. The EDR's beaconing detection is a false positive because the traffic is not malicious but rather a routine, authorized activity.

Exam trap

The trap here is that candidates may assume any periodic outbound connection is malicious beaconing, ignoring that legitimate software update services often use scheduled HTTPS connections to the same IP, and that process lineage and signed logs are the definitive evidence to validate the traffic's legitimacy.

How to eliminate wrong answers

Option A is wrong because user testimony and the absence of file encryption are subjective and do not provide technical proof that the network traffic is legitimate; beaconing can occur without immediate encryption events. Option B is wrong because the source IP appearing on a blocklist does not automatically make the alert malicious—blocklists often include legitimate services, and the destination is a known vendor update service. Option D is wrong because having antivirus installed does not prevent outbound beaconing; antivirus software does not block legitimate HTTPS connections initiated by authorized processes, and beaconing can still occur even with AV present.

Full explanation →

780

MCQmedium

An API log shows repeated requests such as `GET /api/orders?orderId=105%20OR%201=1--` followed by responses containing many customers' order records instead of one record. Which attack is most likely?

A.SQL injection, because the attacker is altering the database query through crafted input.

B.Cross-site scripting, because malicious code is being reflected in the browser.

C.Cross-site request forgery, because the request appears to be an unauthorized action.

D.Broken access control, because the API is not validating the user role correctly.

AnswerA

The injected condition `OR 1=1--` is a classic indicator that user input is being interpreted as part of a database query. The application returns too much data because the attacker has manipulated the SQL logic.

Why this answer

The request includes `%20OR%201=1--`, which URL-decodes to ` OR 1=1--`. This is a classic SQL injection payload that appends a tautology (`OR 1=1`) and comments out the rest of the query (`--`). The API log shows that instead of returning a single order record, the response contains many customers' order records, confirming that the injected condition bypassed the intended WHERE clause and returned all rows from the orders table.

Exam trap

The trap here is that candidates may see the word 'API' and assume the attack is related to access control or CSRF, but the presence of SQL comment syntax (`--`) and the tautology (`OR 1=1`) in the request parameter is the definitive indicator of SQL injection.

How to eliminate wrong answers

Option B is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into a web page viewed by other users, not altering database queries to retrieve unauthorized data. Option C is wrong because cross-site request forgery (CSRF) tricks an authenticated user into performing an unintended action, but the log shows direct crafted input in the API request, not a forged request from another site. Option D is wrong because broken access control would involve missing or flawed authorization checks on the API endpoint, but the attack here exploits a database-level injection vulnerability, not a failure to validate user roles or permissions.

Full explanation →

781

MCQhard

A SaaS dashboard invalidates passwords after a forced reset, but a stolen bearer token from a browser cookie still works from a VPN exit node for several hours. SIEM logs show the same token value used from two countries within five minutes, and no MFA prompt appears because the token is already accepted. What attack is most likely?

A.Session hijacking, because a valid session token is being replayed from a different location.

B.Credential stuffing, because the attacker used many passwords against the portal.

C.Cross-site request forgery, because the attacker is making requests on behalf of the user.

D.Phishing, because the attacker likely stole the user's password first.

AnswerA

Session hijacking is the best answer because the attacker is reusing a valid authenticated token rather than logging in normally. The token continues to work after a password reset, and the same token appears from different geographies in a short window. That strongly suggests the session itself was stolen and replayed, which bypasses authentication controls that only protect the login step.

Why this answer

The scenario describes a stolen bearer token (session token) being reused from a different geographic location (VPN exit node) without re-authentication. This is classic session hijacking, where an attacker captures a valid session token (e.g., from a browser cookie) and replays it to impersonate the authenticated user. The fact that the token works even after a password reset and bypasses MFA confirms the attack is session hijacking, not credential theft or request forgery.

Exam trap

The trap here is that candidates confuse session hijacking with CSRF, but CSRF requires the victim's browser to send the request, whereas session hijacking involves the attacker directly using the stolen token from their own machine.

How to eliminate wrong answers

Option B is wrong because credential stuffing involves using many stolen username/password pairs against a login portal, but here the attacker already has a valid bearer token and does not need to guess passwords. Option C is wrong because cross-site request forgery (CSRF) tricks a user's browser into making unintended requests using their existing session, but the attacker here is directly using a stolen token from a different location, not exploiting the user's active session.

Full explanation →

782

MCQmedium

A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?

A.Business impact analysis (BIA)

B.Risk register

C.Security baseline configuration document

D.Incident response plan

AnswerB

Correct. The risk register is used to track identified risks, their characteristics, and the chosen treatment. Updating it with the acceptance decision, rationale, and approval is essential for risk governance.

Why this answer

The risk register is the correct document to update because it formally tracks identified risks, their assessed impact, and the chosen risk response (acceptance). Recording the decision to accept the $50,000 ALE risk and obtaining sign-off ensures auditability and accountability, which is a key requirement in risk management frameworks like NIST SP 800-37.

Exam trap

The trap here is that candidates confuse the risk register with the BIA, mistakenly thinking the BIA is used to document risk acceptance decisions, when in fact the BIA only quantifies impact and does not track risk treatment or sign-off.

Why the other options are wrong

A BIA documents the impact of disruptions on business operations, not the formal acceptance of specific risks. The risk acceptance decision should be recorded in the risk register, which tracks identified risks, their assessments, and management decisions including acceptance and sign-off.

A security baseline configuration document defines secure settings for systems, not risk acceptance decisions. The question asks for recording a formal risk acceptance decision with sign-off, which is a function of the risk register.

The incident response plan outlines procedures for detecting, responding to, and recovering from security incidents, not for formally documenting risk acceptance decisions or obtaining sign-off on risk treatment.

When would these options actually be correct?

A BIA would be the correct document to update when the organization needs to quantify and prioritize the potential business impact of losing critical systems or processes, such as after identifying a new critical application that supports a core business function, to inform disaster recovery and continuity planning.

A security baseline configuration document would be correct if the question asked for the document that specifies mandatory security settings for a system, such as after a vulnerability scan reveals misconfigurations that need to be hardened.

A security manager needs to update the document that defines the steps to take when a security incident occurs, such as a data breach or system compromise, to ensure the organization's response is effective and compliant.

Why candidates pick the wrong answer

Candidates may confuse risk acceptance with business impact analysis because both involve assessing financial consequences, but the BIA focuses on impact quantification for continuity planning, not on recording risk management decisions.

Candidates may confuse compensating controls (like a WAF) with configuration baselines, or think that documenting a control decision belongs in a configuration document rather than a risk management document.

Candidates may confuse risk acceptance with incident response because both involve handling vulnerabilities, but risk acceptance is a proactive decision made before an incident, while incident response is reactive.

Full explanation →

783

MCQeasy

The help desk needs a document that describes the exact steps for verifying a caller and resetting a password. What type of document should they use?

A.Policy

B.Procedure

C.Standard

D.Guideline

AnswerB

A procedure is the correct document because it gives step-by-step instructions for completing a task in a consistent way. In this case, the help desk needs a repeatable method for identity verification, password reset, and ticket documentation. Procedures help reduce errors and ensure staff follow the same approved process each time.

Why this answer

A procedure provides the exact, step-by-step instructions needed for a specific task, such as verifying a caller's identity and resetting a password. This is distinct from a policy, which states high-level rules, or a standard, which defines mandatory technical requirements. The help desk needs a documented sequence of actions, which is the definition of a procedure.

Exam trap

The trap here is confusing a procedure (the 'how') with a policy (the 'what'), as candidates often think a policy document contains step-by-step instructions, but policies only set the rules, not the exact steps.

How to eliminate wrong answers

Option A is wrong because a policy is a high-level statement of management intent (e.g., 'passwords must be reset securely'), not a step-by-step guide. Option C is wrong because a standard defines mandatory technical specifications (e.g., 'passwords must be at least 12 characters'), not the exact steps to perform a task. Option D is wrong because a guideline offers general advice or recommendations (e.g., 'consider using multi-factor authentication'), not the precise, mandatory steps required for a consistent process.

Full explanation →

784

MCQmedium

Based on the exhibit, users report that the new payment portal opens only after they bypass a browser warning. Which remediation best restores secure access without weakening certificate validation?

A.Install the same certificate on every client so the browser warning is suppressed.

B.Reissue the server certificate so the subject or SAN matches pay.example.net and chain it to the trusted CA.

C.Disable certificate name checking in the browser until the certificate expires.

D.Replace TLS with a shared symmetric key configured on the web server and all users.

AnswerB

A valid server certificate must match the hostname users are connecting to, and it must chain to a trusted issuing authority. Reissuing the certificate for pay.example.net resolves the mismatch shown in the exhibit while preserving proper certificate validation.

Why this answer

The browser warning indicates a hostname mismatch or untrusted CA. Reissuing the server certificate with the correct subject or SAN (Subject Alternative Name) matching pay.example.net and chaining it to a trusted CA resolves the warning while maintaining full certificate validation. This ensures the browser can verify both the identity and trustworthiness of the server without weakening security.

Exam trap

The trap here is that candidates may think installing the same certificate on clients (Option A) is a valid fix, but this violates certificate security by exposing the private key and does not address the root cause of the hostname mismatch.

How to eliminate wrong answers

Option A is wrong because installing the same certificate on every client does not fix the server-side hostname mismatch; it would also require distributing the private key, which breaks certificate security and is not a valid remediation. Option C is wrong because disabling certificate name checking in the browser bypasses a critical security validation, leaving the connection vulnerable to man-in-the-middle attacks and does not restore secure access. Option D is wrong because replacing TLS with a shared symmetric key eliminates certificate-based authentication entirely, removing identity verification and introducing key distribution and management risks, which weakens security rather than restoring it.

Full explanation →

785

MCQeasy

A technician restores a file server from backup, but the business wants confidence that the recovery process will work during an outage. What should the team do most often to validate the backups?

A.Review the backup vendor brochure for proof that recovery will work.

B.Perform regular restore tests using sample files or systems.

C.Increase the backup retention period without testing restores.

D.Change the backup password every day and skip verification.

AnswerB

Performing regular restore tests entails recovering sample files or an entire system from backup to a scratch or isolated environment to prove the data is readable and complete. This process validates not only the backup media but also the backup software's ability to reassemble files, directories, and application state correctly. It directly verifies achievement of recovery point and recovery time objectives, giving confidence that a real disaster can be recovered.

Why this answer

The only way to gain confidence that backups can be successfully restored during an actual outage is to perform regular, documented restore tests. This validates the integrity of the backup media, the correctness of the restoration procedure, and the recoverability of data within the required recovery time objective (RTO). Without testing, assumptions about backup reliability remain unverified, which can lead to catastrophic data loss when a real disaster occurs.

Exam trap

The trap here is that candidates assume that simply having backups or extending retention is sufficient, but CompTIA emphasizes that only actual restore testing provides verifiable proof of recoverability, not the presence of backup files or vendor claims.

How to eliminate wrong answers

Option A is wrong because a vendor brochure only describes theoretical capabilities under ideal conditions, not the actual performance or compatibility of the backup solution with the specific server hardware, software, and data sets in use. Option C is wrong because increasing retention without testing does nothing to validate that the stored backup files are not corrupt, incomplete, or incompatible with the current restore environment. Option D is wrong because changing the backup password daily adds unnecessary administrative overhead and skipping verification removes the only automated check for backup integrity, making it impossible to detect silent data corruption or failed backup jobs.

Full explanation →

786

MCQeasy

A person wearing a contractor badge asks reception to let them into the office because they forgot their access card and say they are expected for a server maintenance visit. What social engineering technique is most likely?

A.Pretexting

B.Baiting

C.Smishing

D.Ransomware

AnswerA

Pretexting is a social engineering technique where the attacker constructs a fabricated scenario or false identity to establish trust and gain unauthorized access. In this scenario, the contractor badge is the 'pretext' for an invented maintenance visit, and the claim of having forgotten their ID is a second layer designed to bypass reception's verification procedures. Unlike baiting, no material lure is involved; the entire attack relies on the plausibility of the story and the victim's willingness to help. This exploits the human tendency to comply with perceived authority or urgent requests, making it a direct physical access threat.

Why this answer

Pretexting is correct because the attacker creates a fabricated scenario (the 'pretext') of being a contractor on a server maintenance visit to gain unauthorized physical access. The use of a contractor badge and the claim of a forgotten access card are designed to exploit the receptionist's trust and willingness to help, bypassing security controls without technical hacking.

Exam trap

The SY0-701 exam often tests the distinction between pretexting (fabricated scenario) and baiting (offering a lure), where candidates mistakenly choose baiting because they associate the 'forgotten card' with a 'bait' like a free item, but the core technique is the false identity and story.

How to eliminate wrong answers

Option B (Baiting) is wrong because baiting involves offering something enticing (e.g., a free USB drive or download) to trick a victim into performing an action, not fabricating a story for access. Option C (Smishing) is wrong because smishing is a form of phishing conducted via SMS text messages, not an in-person social engineering technique involving a badge and verbal request.

Full explanation →

787

MCQmedium

A SIEM reports a successful sign-in to a SaaS admin portal from a new country, followed three minutes later by multiple configuration changes to mailbox forwarding rules. The account owner says they were in the office and did not approve any changes. What should the analyst check next?

A.The identity provider and MFA logs to confirm whether the session was legitimately authenticated or hijacked.

B.The office printer logs to see whether the user printed the mailbox rules.

C.The antivirus signature version on the user’s laptop only.

D.The DNS cache on the user’s laptop to find the forwarding rule target.

AnswerA

Because the sign-in succeeded and configuration changes followed quickly, the key question is whether the session was legitimately established or taken over. Identity provider logs, MFA approvals, token issuance, and session details can confirm whether the login came from the owner or from a stolen credential/session. This is the most direct way to validate the alert before taking disruptive action.

Why this answer

The SIEM alert shows a successful sign-in from a new country followed by suspicious configuration changes, which is a classic indicator of session hijacking or credential theft. Checking the identity provider (IdP) and MFA logs allows the analyst to verify if the authentication was legitimate (e.g., from a known device/IP) or if the session token was stolen and reused, as MFA can be bypassed via token replay or consent phishing. This step directly addresses the core question of whether the session was authorized or compromised.

Exam trap

The trap here is that candidates may focus on endpoint indicators (antivirus, DNS) or unrelated logs (printer) instead of recognizing that the core issue is authentication integrity, which must be verified through identity provider and MFA logs.

How to eliminate wrong answers

Option B is wrong because office printer logs are irrelevant to mailbox forwarding rule changes; they record print jobs, not authentication or email configuration events. Option C is wrong because antivirus signature versions on the user's laptop only indicate whether malware definitions are up to date, but they do not provide evidence of session hijacking or unauthorized configuration changes in a cloud SaaS portal. Option D is wrong because the DNS cache on the user's laptop stores domain-to-IP mappings, not the target address of mailbox forwarding rules; forwarding rule targets are stored in the email server's transport rules or mailbox settings, not in local DNS.

Full explanation →

788

Multi-Selecthard

A web server should accept traffic only from a load balancer and a management jump host. The current host firewall allows all inbound ports, and the web service runs as a domain administrator. Which two changes most improve hardening without breaking the required access pattern? Select two.

Select 2 answers

A.Restrict host firewall rules to required source addresses and ports.

B.Run the service under a dedicated nonadministrative service account.

C.Leave SSH open to every subnet and rely on strong passwords.

D.Give the service account local administrator rights so it can restart itself.

E.Disable patching during business hours permanently.

AnswersA, B

Restricting the firewall to only the needed sources and ports reduces the attack surface immediately. It enforces the trust boundary around the server and prevents unnecessary inbound exposure from other networks.

Why this answer

Restricting host firewall rules to only the load balancer and management jump host's source IP addresses and required ports (e.g., HTTP/HTTPS for the load balancer, SSH/RDP for the jump host) enforces the principle of least privilege. This eliminates the risk of exposing unnecessary services to the entire network, which is a common attack vector. The current 'allow all inbound ports' configuration violates basic network segmentation and access control best practices.

Exam trap

The trap here is that candidates often focus on password strength or patching schedules while ignoring the critical need for network segmentation and least-privilege service accounts, which are the foundational controls tested in this question.

Full explanation →

789

Multi-Selecteasy

A workstation is suspected of running malware and contacting an unknown host. Which two actions belong in the containment phase? Select two.

Select 2 answers

A.Isolate the workstation from the network.

B.Block the malicious IP or domain at the firewall or proxy.

C.Reimage the workstation immediately before collecting evidence.

D.Tell the user to keep working until tomorrow.

E.Delete recent logs to reduce noise.

AnswersA, B

Isolating the workstation from the network, by unplugging the cable or disabling the Wi-Fi adapter, immediately severs all communication paths to the unknown host. This stops malicious traffic, prevents lateral movement to other systems, and preserves both memory and disk artifacts in their current state for forensic acquisition, making it the preferred first containment step in incident response.

Why this answer

Isolating the workstation from the network (A) immediately stops the malware's ability to communicate with the command-and-control (C2) server, preventing data exfiltration and further propagation. Blocking the malicious IP or domain at the firewall or proxy (B) is a containment action that prevents any system on the network from reaching the known malicious host, even if other hosts are already compromised. Both actions align with the NIST SP 800-61 containment strategy of stopping the spread and impact of an incident.

Exam trap

The trap here is that candidates confuse the containment phase with the eradication phase, mistakenly thinking that reimaging (Option C) is a containment action when it is actually an eradication step that should only occur after evidence collection and analysis.

Full explanation →

790

MCQmedium

A development team deploys a Linux web server on an IaaS cloud VM. The cloud provider secures the datacenter, hardware, and hypervisor. Which control remains the organization's responsibility?

A.Monitor physical badge access at the provider facility.

B.Apply OS patches and harden services running inside the virtual machine.

C.Replace the provider's network backbone with a private carrier circuit.

D.Ensure the hypervisor is updated before every release cycle.

AnswerB

Under IaaS, the customer retains full administrative control of the guest operating system and all software running inside the virtual machine, which carries the obligation to apply security patches and harden services. This includes updating the OS kernel and installed packages, disabling unnecessary daemons, configuring host-based firewalls, and enforcing least-privilege access to the VM. The provider does not have visibility or responsibility for the guest OS, so any unpatched vulnerability or weak service configuration inside the VM is solely the customer's risk.

Why this answer

In an IaaS model, the provider handles the physical infrastructure, storage, networking foundation, and hypervisor layer. The customer remains responsible for what runs on the VM, including the guest operating system, services, configuration, and application patching. Hardening the server inside the VM is therefore the correct answer because it is one of the core customer responsibilities in this cloud model.

Why others are wrong: Physical badge access and hypervisor patching are provider duties in IaaS, so the customer cannot rely on those as their own control. Replacing the provider backbone is outside the scope of the customer’s operational responsibility and is not how shared responsibility works. The question asks for the organization’s remaining duty, which is securing the guest OS and its applications.

Full explanation →

791

Multi-Selectmedium

Which four of the following are key principles of secure network architecture design that help enforce defense-in-depth? (Choose four.)

Select 4 answers

.Implementing a demilitarized zone (DMZ) for externally facing services

.Segmenting internal networks using VLANs and firewalls

.Using a single, unified security appliance at the network perimeter

.Deploying network access control (NAC) to authenticate devices before granting access

.Placing all servers on the same flat subnet for ease of management

.Utilizing virtual private networks (VPNs) for secure remote access

Why this answer

Implementing a DMZ isolates externally facing services (e.g., web, email) from the internal network, ensuring that if an attacker compromises a public-facing server, they cannot directly pivot to internal resources. This is a foundational defense-in-depth layer that enforces traffic inspection and access controls between zones.

Exam trap

The trap here is that candidates often think a single perimeter appliance is sufficient for security, but CompTIA emphasizes that defense-in-depth requires multiple, diverse controls—not a single device—to avoid a single point of failure.

Full explanation →

792

MCQeasy

After a phishing-awareness campaign, which metric best shows that employees are becoming more resistant to phishing attempts?

A.The number of spam emails received by the mail gateway

B.The average length of employee passwords

C.The count of antivirus alerts on endpoints

D.The percentage of users who click phishing test links

AnswerD

The click-through rate on simulated phishing links directly measures the specific human behavior that awareness training aims to change: whether employees recognize and resist phishing lures. A declining click rate after training demonstrates improved resilience against social engineering and is a commonly accepted key performance indicator for security awareness. This metric is practical, repeatable, and directly attributable to the training program, unlike technical controls or infrastructure statistics.

Why this answer

The percentage of users who click phishing test links directly measures behavioral change in response to simulated phishing attacks. A decreasing click rate indicates that employees are better at recognizing and avoiding phishing attempts, which is the primary goal of a phishing-awareness campaign.

Exam trap

The trap here is that candidates may confuse security awareness metrics with technical controls (e.g., spam filtering or antivirus), but the question specifically asks for a metric showing employee behavioral change, not infrastructure effectiveness.

How to eliminate wrong answers

Option A is wrong because the number of spam emails received by the mail gateway reflects external threat volume, not employee behavior or resistance to phishing. Option B is wrong because password length is a measure of authentication strength, not phishing resistance; phishing bypasses passwords by stealing them directly. Option C is wrong because antivirus alerts on endpoints indicate malware detection, which may result from many causes (e.g., drive-by downloads) and does not specifically measure employee susceptibility to phishing links.

Full explanation →

793

MCQmedium

A systems administrator downloads a patch and a SHA-256 checksum file from the vendor. The administrator hashes the patch locally and the values match. What does the matching hash primarily confirm?

A.The file has not been altered since the vendor published the checksum.

B.The file remains confidential during transmission.

C.The vendor's private key was used to encrypt the patch.

D.The patch will definitely install successfully on every system.

AnswerA

A SHA-256 checksum is a cryptographic hash of the file's contents. Matching the vendor-published hash verifies integrity: the downloaded file is bit-for-bit identical to the file the vendor hashed, so it hasn't been altered (accidentally or maliciously) since publication. However, this only proves integrity, not authenticity unless the hash was obtained over a trusted channel.

Why this answer

A SHA-256 checksum is a cryptographic hash that acts as a fingerprint for the file. When the locally computed hash matches the vendor-published checksum, it confirms the file's integrity — that the patch has not been modified or corrupted since the vendor generated the checksum. This does not verify confidentiality, authenticity of the signer, or installation success.

Exam trap

The trap here is that candidates confuse integrity (hash matching) with authenticity (digital signature) or confidentiality (encryption), leading them to incorrectly select options about private keys or secure transmission.

How to eliminate wrong answers

Option B is wrong because a hash match confirms integrity, not confidentiality; the file could have been transmitted in plaintext and still produce the same hash. Option C is wrong because the hash is computed from the file content, not from a private key; the vendor's private key would be used for a digital signature, not for a checksum. Option D is wrong because a matching hash only verifies the file is unchanged, not that it will install correctly on every system — installation depends on hardware, OS version, dependencies, and other factors.

Full explanation →

794

MCQeasy

A company has two security issues to address this week. One is a public-facing login portal that uses default administrator credentials. The other is an internal lab system used only by one tester. Which issue should be prioritized first?

A.The internal lab system, because it is easier to fix quickly

B.The public-facing login portal, because it has a higher likelihood and impact

C.Both issues have the same priority because they are both vulnerabilities

D.Neither issue should be addressed until the next annual review

AnswerB

A public-facing login portal is directly reachable by any internet user, and default credentials mean an attacker can likely authenticate without any additional effort. This combination dramatically increases both the probability of successful exploitation and the business impact, such as unauthorized access, data breach, or account takeover. Immediate remediation is warranted because the system is exposed to untrusted users, making the risk both urgent and severe.

Why this answer

The public-facing login portal with default administrator credentials is a critical risk because it is exposed to the internet, making it easily discoverable and exploitable by attackers. Default credentials are widely known and often targeted in automated attacks, leading to a high likelihood of compromise and potential impact such as data breach or system takeover. This aligns with risk management principles where priority is given to vulnerabilities with the highest risk score (likelihood × impact).

Exam trap

The trap here is that candidates mistakenly prioritize based on ease of fix or treat all vulnerabilities as equal, rather than applying a formal risk assessment that weighs likelihood and impact to determine priority.

How to eliminate wrong answers

Option A is wrong because prioritizing based on ease of fix ignores risk assessment; the internal lab system is isolated and used by one tester, so its likelihood and impact are low, making it a lower priority. Option C is wrong because not all vulnerabilities have equal priority; risk is calculated by likelihood and impact, and the public-facing portal clearly has higher values in both dimensions. Option D is wrong because delaying remediation until the next annual review violates the principle of timely risk mitigation, especially for an internet-exposed system with default credentials that can be exploited immediately.

Full explanation →

795

MCQmedium

Based on the exhibit, which change best meets the requirement that guest devices can reach the internet but must not reach any internal subnets or printer VLANs?

A.Add more allow rules for the printer VLAN so guests can print without changing routing.

B.Move guests into a dedicated guest zone with outbound NAT and default-deny rules to internal networks.

C.Place guest and corporate devices on the same VLAN and rely on the wireless password for separation.

D.Allow guest traffic to reach internal DNS and DHCP servers across all RFC1918 subnets.

AnswerB

A dedicated guest zone with outbound NAT and default-deny rules to internal networks satisfies the requirement by placing untrusted guests into their own security zone, one that can reach the internet but cannot initiate traffic to any RFC1918 internal address. The stateful firewall performs source NAT to the public interface, so responses return only for established outbound sessions, while explicit deny rules block guest-to-internal traffic. This enforces least privilege, prevents lateral movement, and keeps guest access strictly internet-only.

Why this answer

Placing guest devices in a dedicated guest zone with outbound NAT allows them to access the internet while default-deny rules to internal subnets and printer VLANs enforce network segmentation. This approach uses firewall policies to explicitly block RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from guest traffic, ensuring no Layer 3 connectivity to internal resources.

Exam trap

The trap here is that candidates may think adding more allow rules (Option A) or using a shared VLAN with a password (Option C) provides sufficient isolation, but they fail to recognize that network-layer segmentation via dedicated zones and firewall rules is required to prevent guest-to-internal communication at both Layer 2 and Layer 3.

How to eliminate wrong answers

Option A is wrong because adding more allow rules for the printer VLAN would permit guest traffic to reach printers, directly violating the requirement that guests must not reach printer VLANs; it also does not address blocking access to other internal subnets. Option C is wrong because placing guest and corporate devices on the same VLAN eliminates Layer 2 segmentation, and relying solely on a wireless password provides no network-layer isolation, allowing guests to potentially communicate with corporate hosts via ARP or broadcast traffic. Option D is wrong because allowing guest traffic to internal DNS and DHCP servers across all RFC1918 subnets would create a pathway to internal networks, breaking the requirement that guests must not reach any internal subnets.

Full explanation →

796

Multi-Selectmedium

A help desk technician receives a phone call from someone claiming to be the VP of Finance. The caller says they are in an airport, forgot their phone, and need a password reset immediately. They also ask the technician to skip callback verification because a meeting starts in five minutes. Which two details are the strongest indicators of a pretexting or vishing attempt? Select two.

Select 2 answers

A.the caller claims an executive title and uses authority to pressure the technician

B.the call is routed through the company ticketing system with an approved change record

C.the caller asks the technician to bypass identity verification and callback procedures

D.the caller answers all security questions correctly after being prompted for them

E.the call occurs after normal business hours on a holiday weekend

AnswersA, C

Impersonating a senior executive is a common social engineering tactic because it creates authority pressure and makes the target more likely to comply quickly. In a help desk context, attackers often borrow a title that sounds urgent and important. That pressure is a strong sign the call may be a pretext rather than a legitimate request.

Why this answer

The caller's use of an executive title (VP of Finance) and urgent authority pressure is a classic social engineering tactic known as pretexting. In a vishing (voice phishing) attack, the attacker fabricates a scenario to manipulate the technician into bypassing standard security procedures. This aligns with the SY0-701 domain on threats, vulnerabilities, and mitigations, specifically social engineering techniques.

Exam trap

The trap here is that candidates may confuse a successful security question response (Option D) as a sign of legitimacy, but in vishing attacks, attackers often gather personal data from OSINT or data breaches to answer such questions, making it a weak indicator compared to the direct authority pressure and request to bypass verification.

Full explanation →

797

MCQhard

Based on the exhibit, what is the best-supported conclusion for the SOC analyst?

A.The traffic is normal web browsing to a content delivery network.

B.The host is likely using DNS tunneling or DNS-based command and control.

C.The issue is most likely ARP spoofing on the local switch port.

D.The evidence most strongly indicates a password spraying campaign.

AnswerB

The repeated TXT queries, predictable timing, small UDP payloads, and absence of proxy traffic strongly suggest data or commands are being carried over DNS. The unique subdomains and steady beacon interval are classic indicators of DNS tunneling or DNS-based command-and-control. The signed PDF reader only shows how the activity may have started, not that it is benign.

Why this answer

The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.

Exam trap

The trap here is that candidates may confuse DNS tunneling with normal DNS resolution for CDN services, but the key differentiator is the abnormal volume and structure of the DNS queries, not the destination IP addresses.

How to eliminate wrong answers

Option A is wrong because normal web browsing to a content delivery network (CDN) would generate HTTP/HTTPS traffic to known CDN domains, not an excessive number of DNS queries to obscure, randomly generated subdomains. Option C is wrong because ARP spoofing operates at Layer 2 and would manifest as duplicate IP addresses or unusual ARP traffic, not as a high volume of DNS queries. Option D is wrong because a password spraying campaign involves repeated login attempts across multiple accounts, which would appear as authentication logs (e.g., Windows Event ID 4625) rather than DNS query patterns.

Full explanation →

798

MCQmedium

A security analyst detects that multiple workstations in the finance department are displaying ransom notes and files are being encrypted. The analyst has disconnected the affected workstations from the network. Which of the following should the analyst do next according to the incident response procedure?

A.Reimage all affected workstations immediately to restore operations.

B.Isolate the entire finance department network segment and preserve forensic evidence.

C.Run a full antivirus scan on the workstations to remove the ransomware.

D.Restore the encrypted files from the latest backup without further investigation.

AnswerB

Isolating the segment prevents lateral movement of the ransomware. Preserving forensic evidence allows for a thorough investigation to identify the initial infection vector and prevent future incidents.

Why this answer

The immediate next step in the incident response procedure after containment (disconnecting affected workstations) is to isolate the affected network segment to prevent lateral movement and preserve forensic evidence. This aligns with the NIST SP 800-61 incident response framework, which prioritizes containment, eradication, and recovery in that order, and emphasizes evidence preservation before any remediation actions.

Exam trap

The trap here is that candidates often jump to recovery actions (reimaging or restoring backups) too early, forgetting that the incident response process requires containment and evidence preservation before eradication and recovery.

Why the other options are wrong

Reimaging immediately destroys volatile evidence and may violate forensic chain of custody; the incident response procedure requires preserving evidence before remediation.

Running a full antivirus scan after ransomware has already encrypted files and displayed ransom notes is ineffective because the primary goal is to contain the incident and preserve evidence, not to attempt remediation that may destroy forensic data.

Restoring from backup without further investigation would destroy forensic evidence and skip critical steps like identifying the attack vector and containing the threat, which could allow the ransomware to spread again.

When would these options actually be correct?

If the question stated that the incident has been fully contained, evidence has been collected, and the priority is to restore business operations quickly, then reimaging affected workstations would be appropriate.

This option would be correct in a scenario where a workstation is suspected of being infected with malware but no encryption or ransom note has appeared yet, and the analyst needs to identify and remove the threat before it executes.

In a scenario where the incident response team has already fully contained the threat, collected all necessary forensic evidence, and confirmed that the backup is clean and uncompromised, restoring from backup would be the appropriate recovery step.

Why candidates pick the wrong answer

Candidates may think restoring operations quickly is the top priority, not realizing that forensic preservation is critical for understanding the attack and preventing recurrence.

Candidates may default to a common troubleshooting step (antivirus scan) without recognizing that ransomware incidents require containment and evidence preservation first, as per incident response procedures.

Candidates may think restoring from backup is the fastest way to recover operations, overlooking the need for proper investigation and containment to prevent recurrence.

Full explanation →

799

MCQeasy

An employee receives an email that appears to be from the CEO and asks for an urgent wire transfer. The sender address is slightly different from the real company address. What is the best first action?

A.Complete the transfer because it came from an executive

B.Reply to the email asking if it is real

C.Verify the request using a separate trusted method

D.Forward it to the whole department for awareness

AnswerC

The safest first action is to verify the request through a separate trusted channel, such as calling the CEO using a known internal number or checking with a supervisor. This helps confirm whether the message is legitimate without relying on the suspicious email itself. Urgent money requests are a common social engineering tactic, so independent verification is essential.

Why this answer

The email exhibits classic signs of a business email compromise (BEC) attack, where the sender address is spoofed or slightly altered. Verifying the request through a separate, trusted method—such as calling the CEO directly or using a known internal communication channel—bypasses any compromised email system and confirms the legitimacy of the request. This aligns with the principle of out-of-band verification, which is a key defense against phishing and social engineering.

Exam trap

CompTIA often tests the concept that verifying through the same compromised channel (e.g., replying to the email) is insufficient, and the trap here is that candidates may think replying to ask for confirmation is a safe step, when in fact it only engages with the attacker.

How to eliminate wrong answers

Option A is wrong because it assumes the email is legitimate based solely on the display name or role, ignoring the fact that attackers can easily spoof sender addresses and exploit authority to bypass security controls. Option B is wrong because replying to the email sends the response to the attacker-controlled address, confirming the employee's availability and potentially exposing sensitive information; the attacker may also intercept or manipulate the reply. Option D is wrong because forwarding the email to the entire department spreads the phishing attempt, increasing the risk that other employees might fall for the attack or that the malicious content could trigger additional security incidents.

Full explanation →

800

MCQmedium

A manager asks the security team to let Human Resources inspect the files on a laptop suspected of containing stolen customer data before IT touches it. What is the best response?

A.Let HR browse the files first so they can confirm whether the data is sensitive.

B.Create a forensic image of the device, document the handoff, and maintain chain of custody before any analysis.

C.Copy the files to a shared drive so multiple departments can review them quickly.

D.Factory reset the laptop immediately to prevent further leakage of customer data.

AnswerB

When a device may contain evidence, the priority is to preserve it in a way that supports later analysis and legal defensibility. Creating a forensic image captures the data without modifying the original device, and documenting each transfer maintains chain of custody. This approach protects evidence integrity and allows authorized investigators to review the copy instead of the live system. It is the correct response before HR or others inspect the contents.

Why this answer

The first priority in any investigation involving potential evidence is to preserve the data in its original state. Creating a forensic image (bit-for-bit copy) ensures that the original media is not altered, and documenting the handoff with a chain of custody form provides a verifiable audit trail. This process adheres to forensic best practices and legal requirements, preventing spoliation of evidence before any analysis begins.

Exam trap

The trap here is that candidates may think HR needs immediate access to confirm sensitivity, but they overlook the forensic requirement to preserve the original state of the evidence before any access or analysis occurs.

How to eliminate wrong answers

Option A is wrong because allowing HR to browse the files directly on the live laptop would modify metadata (e.g., file access times, last opened dates) and could potentially alter or delete data, compromising the integrity of the evidence. Option C is wrong because copying files to a shared drive without first creating a forensic image risks altering file timestamps and metadata during the copy process, and it bypasses proper chain of custody, making the evidence inadmissible. Option D is wrong because factory resetting the laptop would destroy all data, including any evidence of the alleged theft, making it impossible to conduct a forensic investigation and potentially violating legal hold requirements.

Full explanation →

801

MCQeasy

A coworker asks for a spreadsheet containing employee home addresses and personal phone numbers so they can build a team contact list. What is the best response?

A.Share the spreadsheet, because the request is from another employee inside the company.

B.Confirm the requester is authorized and only provide the minimum personal data allowed by policy.

C.Email the full spreadsheet, because internal data is not protected by privacy rules.

D.Delete the spreadsheet immediately so the information cannot be misused.

AnswerB

The best response is to verify authorization and limit the data shared to the minimum needed. Privacy and data-handling rules often restrict personal information such as home addresses and personal phone numbers. Even internal requests should follow approved business purpose, least privilege, and data minimization principles before any disclosure occurs.

Why this answer

It aligns with the principle of least privilege and data minimization, which are core to security program management. Even internal requests must be verified for authorization, and only the minimum personal data required for the stated purpose should be shared, as per organizational policy and privacy regulations like GDPR or CCPA.

Exam trap

The trap here is that candidates may assume internal requests are automatically safe, ignoring the need for authorization and data minimization, which is a common misconception tested in SY0-701.

How to eliminate wrong answers

Option A is wrong because it assumes that internal employment automatically grants authorization to access sensitive PII, which violates data access control policies. Option C is wrong because internal data, especially PII like home addresses and phone numbers, is protected by privacy rules and regulations; emailing the full spreadsheet without controls exposes the organization to data breach risks. Option D is wrong because deleting the spreadsheet is an overreaction that does not address the legitimate business need and may violate data retention policies; the correct action is to follow policy for authorized access.

Full explanation →

802

MCQeasy

A help desk technician needs temporary access to read one shared folder to troubleshoot a printer issue. Which access choice best follows least privilege?

A.Grant the technician full control of the entire file server for one day.

B.Give the technician read-only access to the single shared folder needed for the ticket.

C.Add the technician to the domain admins group until the issue is resolved.

D.Allow the technician to use any account in the department for convenience.

AnswerB

Providing read-only access to the specific shared folder needed for the ticket embodies least privilege by restricting both the access level and the scope. With read-only, the technician can view and inspect files to diagnose the issue but cannot alter, delete, or affect any other data. This also supports auditing, as the technician's actions are limited to one resource and can be traced if necessary. After the ticket is resolved, the access can be quickly revoked, leaving no unnecessary residual permissions.

Why this answer

It grants the technician only the minimum permissions (read-only) to the specific resource (single shared folder) required to troubleshoot the printer issue. This adheres to the principle of least privilege by limiting access scope and duration, reducing the risk of unauthorized changes or data exposure.

Exam trap

The trap here is that candidates often confuse 'temporary access' with 'elevated privileges' (like Domain Admins) instead of recognizing that the least privilege principle requires the minimal permission (read-only) to the minimal resource (single folder), not broad administrative roles.

How to eliminate wrong answers

Option A is wrong because granting full control of the entire file server provides far more access than needed, violating least privilege and exposing all files to potential accidental modification or deletion. Option C is wrong because adding the technician to the Domain Admins group grants unrestricted administrative access to the entire domain, which is excessive and introduces significant security risk. Option D is wrong because allowing the technician to use any department account bypasses accountability and audit trails, as actions cannot be tied to the specific technician, and may expose credentials or sensitive data.

Full explanation →

803

MCQeasy

A help desk technician receives a phone call from someone claiming to be a contractor. The caller says their MFA app was lost, asks the technician to enroll a new device immediately, and pressures them to ignore policy. What type of attack is this?

A.Phishing

B.Vishing

C.Smishing

D.Baiting

AnswerB

Vishing, or voice phishing, leverages live or automated phone calls, often using VoIP and caller ID spoofing to appear as a legitimate bank, IT support, or government agency. Vishing uses voice calls to pressure a target into revealing information or changing security settings, such as resetting a password or approving a multi-factor authentication prompt. The direct phone-to-phone interaction makes this the correct classification for the described call.

Why this answer

This is a vishing (voice phishing) attack because the attacker uses a phone call to impersonate a contractor and socially engineer the technician into bypassing MFA enrollment policies. Vishing specifically exploits voice communication to manipulate victims, unlike phishing which uses email or malicious links.

Exam trap

The trap here is confusing vishing with phishing because both involve social engineering, but the key differentiator is the communication medium—voice (phone call) vs. electronic message (email/SMS).

How to eliminate wrong answers

Option A is wrong because phishing involves deceptive emails or messages with malicious links/attachments, not a direct phone call. Option C is wrong because smishing uses SMS text messages to trick victims, not voice calls. Option D is wrong because baiting relies on offering something enticing (e.g., a free USB drive) to lure victims into a trap, not a phone-based social engineering request.

Full explanation →

804

MCQhard

Based on the exhibit, what control type is the automated reapplication of the baseline?

A.Preventive control, because the system prevented the user from changing the firewall profile at all.

B.Corrective control, because the MDM agent restores the approved baseline after the unauthorized change is found.

C.Detective control, because the help desk can review the event later.

D.Deterrent control, because the policy baseline discourages users from making changes.

AnswerB

Corrective control is the best answer because the system repairs the deviation after it has already happened. The user altered the firewall profile, and then the management platform reapplied the approved baseline at the next check-in. This restores the device to the desired secure state, which is exactly what a corrective control is designed to do.

Why this answer

The automatic reapplication of the approved firewall baseline is a corrective control because it fixes a configuration that drifted away from the secure standard. The user was able to make the change, so the control was not preventive. The MDM system then returned the device to its approved state, which is the defining behavior of correction rather than simple detection or deterrence.

Why others are wrong: The user change was already allowed to happen, so the control was not preventive. The log shows an automatic restoration, not just an alert, so it is more than detective. A deterrent would merely discourage changes through warnings or visibility. The key evidence is the platform's automatic rollback to the approved baseline after the deviation was found.

Full explanation →

805

MCQmedium

A project lead needs to send a spreadsheet labeled confidential to an external auditor. The file contains employee names, salaries, and performance notes. Which handling step best protects the data while still supporting the business need?

A.Email the attachment unencrypted if the auditor signed an NDA

B.Use an approved encrypted file-sharing portal with named recipients and access logging

C.Upload the spreadsheet to a public link so the auditor can access it easily

D.Remove the confidential label before sending it to avoid confusion

AnswerB

An approved encrypted file-sharing portal enforces confidentiality through encryption in transit (TLS) and at rest (AES-256), while limiting access to authenticated, named recipients via unique accounts or email invitations. The portal logs every access attempt, download, and interaction, creating a permanent audit trail that satisfies compliance and accountability requirements. It also allows policy controls such as link expiration, download limits, and the ability to revoke access, ensuring that only the intended auditor can view the data and that the exposure window is tightly controlled.

Why this answer

Using an approved encrypted file-sharing portal with named recipients and access logging ensures data-in-transit and data-at-rest encryption, restricts access to only the intended auditor, and provides an audit trail for compliance. This approach meets the business need of securely sharing confidential employee data while supporting regulatory requirements like GDPR or HIPAA, unlike unencrypted email which exposes data to interception.

Exam trap

The trap here is that candidates may think an NDA alone provides sufficient protection, overlooking that encryption and access controls are required to prevent data breaches during transmission and storage.

How to eliminate wrong answers

Option A is wrong because emailing an unencrypted attachment, even with an NDA in place, exposes the data to interception during transit (e.g., via TLS stripping or man-in-the-middle attacks) and does not provide encryption or access controls. Option C is wrong because uploading the spreadsheet to a public link makes the data accessible to anyone with the link, violating confidentiality and lacking authentication or logging. Option D is wrong because removing the confidential label does not change the sensitivity of the data; it merely obscures the classification, leading to potential mishandling and non-compliance with data protection policies.

Full explanation →

806

MCQeasy

A security team wants to reduce repeated user mistakes after a phishing campaign without overwhelming employees with long training sessions. Which approach is best?

A.Send a short, targeted reminder to the affected users with a clear reporting path

B.Require every employee to attend a full-day security class immediately

C.Wait until the next annual training cycle and do nothing now

D.Disable email access for all employees until they pass a new test

AnswerA

This is a focused security awareness intervention that addresses the specific repeated mistake without disrupting productivity. It leverages just-in-time training, reminding users of the correct reporting procedure (e.g., phishing reporting button) at the moment of risk. It also establishes a clear feedback loop so users know how to report future incidents. Unlike blanket training, it targets only affected users, reducing training fatigue and improving compliance.

Why this answer

It applies targeted, immediate reinforcement to the specific users who made mistakes, using a short reminder that clarifies the reporting path. This approach leverages just-in-time training, which has been shown to improve retention and behavior change without overwhelming employees. It directly addresses the root cause—repeated user errors—by providing a clear, actionable step (e.g., 'Report suspicious emails using the PhishAlarm button') rather than generic awareness.

Exam trap

The trap here is that candidates may choose option B (full-day class) because they overestimate the value of comprehensive training, failing to recognize that targeted, immediate reinforcement is more effective for correcting specific, repeated mistakes without causing training fatigue.

How to eliminate wrong answers

Option B is wrong because a full-day security class is overly time-consuming and likely to cause training fatigue, reducing overall effectiveness and not targeting the specific users who made mistakes. Option C is wrong because waiting until the next annual training cycle leaves the repeated mistakes unaddressed, allowing the same vulnerabilities to persist and potentially lead to a successful breach. Option D is wrong because disabling email access for all employees is a drastic, disruptive measure that punishes the entire workforce, including those who did not make mistakes, and does not provide any educational value or fix the underlying behavior.

Full explanation →

807

MCQhard

Based on the exhibit, what is the best handling decision for the requested file?

A.Share the full file by email as Confidential because only the last four digits of the SSN are included.

B.Label it Public because the contractor needs the information to troubleshoot effectively.

C.Mark it Internal and place it on the shared project drive for easy access.

D.Treat it as Restricted, redact unnecessary fields, and provide only the minimum approved dataset through a logged encrypted transfer.

AnswerD

The file contains customer PII, financial information, and case notes, so it should be handled as Restricted rather than merely Confidential. The policy requires minimization, masking where possible, owner approval, time-limited access, and logged sharing. Because the request comes from an external contractor, the organization should provide only the least amount of data needed, with encryption and formal approval.

Why this answer

The file contains personally identifiable information (PII) in the form of a Social Security Number (SSN), which requires handling under a Restricted classification per most data governance frameworks. The correct procedure is to redact unnecessary fields, such as the full SSN, and transmit only the minimum approved dataset via a logged encrypted transfer (e.g., using SFTP or HTTPS with TLS 1.2+) to ensure confidentiality, integrity, and auditability. This aligns with the principle of least privilege and data minimization, which are core to security program management.

Exam trap

The trap here is that candidates may assume that sharing only the last four digits of an SSN makes the data safe to send via email (Option A), but CompTIA tests that any PII, even partial, requires Restricted handling and encrypted transfer to prevent data breaches and comply with regulations like GDPR or HIPAA.

How to eliminate wrong answers

Option A is wrong because sharing the full file by email, even with only the last four digits of the SSN, violates data minimization and exposes residual PII; email is not an approved secure channel for Restricted data and lacks encryption at rest and in transit guarantees. Option B is wrong because labeling the file Public would allow unrestricted access, which is inappropriate for any data containing SSN fragments; the contractor's need to troubleshoot does not override data classification policies. Option C is wrong because marking the file Internal and placing it on a shared project drive does not provide access controls or encryption sufficient for PII, and it fails to redact unnecessary fields, exposing the full SSN to unauthorized personnel.

Full explanation →

808

MCQeasy

A department finished using paper forms that contain customer information, and the retention period has expired. What is the best next step?

A.Store them indefinitely in a cabinet for future reference

B.Dispose of them using approved secure destruction methods

C.Send them to another team without checking the retention schedule

D.Scan them to personal email so the department can keep a copy

AnswerB

Approved secure destruction methods, such as cross-cut shredding, incineration, or pulping, render customer paper records unreadable and non-recoverable before disposal. The organization should follow its records retention policy to confirm the records are eligible for destruction and then execute the disposal through a vetted process, often documenting it with a certificate of destruction. This minimizes the risk of dumpster diving or forensic reconstruction and satisfies both internal governance and regulatory requirements.

Why this answer

Once the retention period has expired, the organization must securely destroy the paper forms to prevent unauthorized access to customer information. Approved secure destruction methods for paper records include cross-cut shredding, incineration, or pulping, which render the data irrecoverable and comply with data protection regulations like GDPR or HIPAA.

Exam trap

The trap here is that candidates may think indefinite storage (A) is acceptable for future reference, but the expired retention period legally requires destruction, not just storage.

How to eliminate wrong answers

Option A is wrong because storing expired records indefinitely violates data minimization principles and retention policies, increasing the risk of data breaches and non-compliance with regulations. Option C is wrong because sending records to another team without verifying the retention schedule could propagate sensitive data beyond its authorized lifecycle, leading to unauthorized access or legal penalties. Option D is wrong because scanning customer information to personal email bypasses organizational controls, creates an unsecured copy, and violates data handling policies, potentially exposing the data to loss or interception.

Full explanation →

809

MCQhard

A records application displays a mandatory notice before login that tells employees exactly which data types they may open, when to lock their screens, and that only assigned work may be processed. The notice is meant to shape behavior before misuse occurs, but it does not technically block any action. Which control type is this notice?

A.Directive control

B.Preventive control

C.Deterrent control

D.Detective control

AnswerA

The notice provides required guidance and expectations before users access the system. It tells them what behavior is allowed and how they should act, but it does not enforce the rule technically. That makes it a directive control because it directs user behavior through instructions and stated requirements rather than by blocking actions.

Why this answer

A directive control is designed to guide or mandate behavior through policies, procedures, or notices without enforcing technical restrictions. This notice explicitly tells employees which data types they may open, when to lock screens, and that only assigned work may be processed, shaping behavior before misuse occurs without blocking any action. It aligns with the definition of a directive control as it provides rules and expectations rather than preventing or deterring actions through technical means.

Exam trap

The trap here is that candidates confuse a directive control with a deterrent control because both involve warnings, but a deterrent control explicitly threatens consequences or punishment to discourage action, whereas a directive control simply instructs on proper behavior without implying enforcement or penalties.

How to eliminate wrong answers

Option B is wrong because a preventive control would technically block unauthorized actions, such as using access control lists (ACLs) or file permissions to prevent opening restricted data types, whereas this notice only advises without enforcing any technical barrier. Option C is wrong because a deterrent control aims to discourage misuse through the threat of consequences or penalties, such as warning banners that imply monitoring or disciplinary action, but this notice simply states allowed behaviors without threatening punishment or creating fear of repercussions.

Full explanation →

810

MCQmedium

A SIEM alert flags an interactive logon to a Windows file server from a service account that normally only runs scheduled tasks. The alert occurred at 01:12, but the maintenance window for that server is every Sunday at 02:00. The account also accessed a different server five minutes later. What should the analyst do first?

A.Ignore the alert because service accounts often authenticate outside normal business hours.

B.Correlate the activity with the change calendar, scheduled-task logs, and ticketing records before escalating.

C.Immediately disable the service account to stop any potential attacker activity.

D.Reimage the file server to remove any possible compromise.

AnswerB

The best first step in triage is to determine whether the activity is authorized or anomalous. Because service-account use can be legitimate, the analyst should correlate the logon with maintenance windows, scheduled-task history, and approved change records. That quickly separates normal administrative activity from suspicious lateral movement without prematurely disrupting operations.

Why this answer

The analyst must first gather context to determine if the alert is a false positive or a genuine security incident. The interactive logon at 01:12 is outside the scheduled maintenance window (Sunday 02:00), and the account’s subsequent access to another server warrants correlation with change calendars, scheduled-task logs, and ticketing records to verify if the activity was authorized. This step prevents unnecessary disruption while ensuring that any anomalous behavior is properly investigated before escalation.

Exam trap

The trap here is that candidates may assume any activity outside business hours is automatically malicious or, conversely, that service accounts always authenticate at odd hours, leading them to ignore the alert—when the key is to recognize that the interactive logon type and the deviation from the maintenance window are the specific anomalies requiring correlation.

How to eliminate wrong answers

Option A is wrong because ignoring the alert based solely on the time of day overlooks the specific anomaly: the account performed an interactive logon (type 2 or 10) rather than its usual scheduled-task logon (type 5), and the activity occurred outside the defined maintenance window. Option C is wrong because immediately disabling the service account without investigation could disrupt legitimate operations and destroy forensic evidence; the analyst should first verify if the activity was authorized via change records. Option D is wrong because reimaging the server is a drastic, irreversible step that should only be taken after confirming compromise through proper forensic analysis and incident response procedures.

Full explanation →

811

MCQeasy

A vendor says a patch for a critical flaw in a public-facing application will not be available for 30 days, but the service must stay online. What is the best short-term risk treatment?

A.Accept the risk without making any changes because the patch is not available yet.

B.Avoid the risk by permanently shutting down the application.

C.Transfer the risk to an insurance policy and wait for the patch.

D.Implement compensating controls, such as tighter filtering and temporary restrictions, until the patch is released.

AnswerD

This is the best option because the business must keep the application online, but the known vulnerability still needs risk reduction. Compensating controls are temporary safeguards that lower exposure when a permanent fix is unavailable. Examples include stricter access filtering, disabling unnecessary features, or adding monitoring until the vendor patch can be applied safely.

Why this answer

When a critical patch is unavailable, the best short-term risk treatment is to implement compensating controls that reduce the likelihood or impact of exploitation. For a public-facing application, this could include deploying a web application firewall (WAF) with tighter rule sets, rate limiting, IP allowlisting, or temporarily disabling non-essential functionality. These controls provide a defense-in-depth layer until the vendor releases the patch, keeping the service online while reducing risk.

Exam trap

CompTIA often tests the misconception that risk acceptance is a valid short-term treatment when a patch is delayed, but the key is that acceptance is only appropriate after evaluating and documenting the risk, not as a default action without controls.

How to eliminate wrong answers

Option A is wrong because accepting the risk without any changes leaves the application fully exposed to a known critical flaw, which is irresponsible and could lead to a breach. Option B is wrong because permanently shutting down the application avoids the risk but disrupts business operations entirely, which is not a short-term treatment and fails the requirement that the service must stay online. Option C is wrong because transferring the risk to an insurance policy does not reduce the technical exposure; insurance covers financial loss after an incident but does not prevent exploitation of the vulnerability.

Full explanation →

812

MCQeasy

During a tabletop exercise, the team realizes no one has a list of who to notify if the online ordering system goes down. Which continuity planning element is missing?

A.Data retention schedule, because it defines how long records are kept.

B.Communication plan, because it defines who must be contacted and how.

C.Asset inventory, because it lists all hardware and software in use.

D.Network segmentation, because it separates sensitive systems from user networks.

AnswerB

A communication plan identifies the people, groups, and channels used during an outage or incident. If no one knows who to notify, the organization lacks a key continuity component that supports coordinated response and stakeholder awareness.

Why this answer

A communication plan is the missing continuity planning element because it specifically defines the stakeholders who must be notified during an outage (e.g., internal teams, vendors, customers) and the methods of contact (e.g., email, SMS, phone tree). Without this plan, the team cannot execute the notification procedures required by the business continuity plan (BCP) to coordinate response and recovery efforts for the online ordering system.

Exam trap

The trap here is that candidates confuse an asset inventory (which lists what you have) with a communication plan (which lists who to call), leading them to pick Option C because they think knowing the system's hardware is necessary for notification, but the question specifically asks about 'who to notify,' not 'what is affected.'

How to eliminate wrong answers

Option A is wrong because a data retention schedule governs how long records are kept (e.g., 90 days for transaction logs per PCI DSS), not who to notify during an outage. Option C is wrong because an asset inventory lists hardware and software (e.g., server models, OS versions) but does not define notification contacts or escalation paths. Option D is wrong because network segmentation (e.g., VLANs, firewall zones) isolates sensitive systems for security, but it does not address the operational need to contact personnel when a system fails.

Full explanation →

813

Multi-Selectmedium

An organization is implementing a new Security Information and Event Management (SIEM) system. Which three of the following are primary capabilities that a SIEM provides to support security operations? (Choose three.)

Select 3 answers

.Correlation of log data from multiple sources to identify patterns of suspicious activity

.Real-time alerting based on predefined security rules and anomalies

.Long-term storage and retention of logs for compliance and forensic analysis

.Automated patching of operating system vulnerabilities across the enterprise

.Blocking malicious network traffic at the perimeter firewall

.Performing vulnerability scans on internal hosts and applications

Why this answer

A SIEM system's primary capabilities include aggregating and correlating log data from diverse sources (servers, firewalls, endpoints) to detect patterns indicative of security incidents. It provides real-time alerting by applying predefined correlation rules and anomaly detection algorithms to streaming log events. Additionally, SIEM solutions offer long-term log storage and retention, which is essential for compliance audits (e.g., PCI DSS, HIPAA) and post-incident forensic analysis.

Exam trap

The trap here is that candidates confuse a SIEM's ability to ingest and analyze data from other security tools with the ability to perform those tools' native functions (like patching, blocking, or scanning), leading them to select options that describe actions a SIEM cannot directly execute.

Full explanation →

814

MCQmedium

A file server in the accounting department begins renaming documents and dropping ransom notes. The SOC confirms encryption is still in progress, and the server hosts a share used by several finance teams. What should the incident response team do first?

A.Disconnect the server from the network to contain the spread.

B.Restore the file share from backup immediately while the server is still connected.

C.Power off the server immediately without any other action.

D.Notify users to change their passwords before any technical action is taken.

AnswerA

Immediately disconnecting the server from the network (unplugging the NIC, disabling the switch port, or isolating the VLAN) contains the active ransomware by stopping it from encrypting additional network shares, communicating with its command-and-control server, or moving laterally to other hosts. This network cutover is the first-priority containment action after active encryption is confirmed because it minimizes blast radius while preserving the machine's volatile memory and running processes for forensic triage. Unlike a hard shutdown, it keeps the host in a state where investigators can later image the disk and extract indicators of compromise.

Why this answer

Disconnecting the server from the network is the immediate containment step to prevent the ransomware from encrypting additional files on the share or spreading laterally to other systems. Since encryption is still in progress, isolating the server stops the attacker's process from accessing more files and blocks any command-and-control (C2) communication. This aligns with the NIST incident response framework's containment phase, prioritizing stopping the spread over recovery or notification.

Exam trap

The trap here is that candidates may prioritize data recovery (Option B) or user notification (Option D) over containment, failing to recognize that the immediate priority is stopping active encryption to limit damage.

How to eliminate wrong answers

Option B is wrong because restoring from backup while the server is still connected risks re-encrypting the restored files if the ransomware process is active, and it violates the containment-first principle. Option C is wrong because powering off the server may cause loss of volatile forensic data (e.g., memory-resident encryption keys, running processes) and can trigger anti-forensic behaviors in some ransomware strains. Option D is wrong because notifying users to change passwords before technical containment wastes critical time; the immediate threat is active encryption, not credential compromise, and password changes should occur after containment and eradication.

Full explanation →

815

MCQmedium

EDR flags encoded PowerShell launched by a spreadsheet application, followed by an attempt to access LSASS and outbound HTTPS traffic to a rare domain. What should the analyst do first from the EDR console?

A.Reboot the endpoint to terminate the suspicious processes

B.Isolate the endpoint from the network while keeping it powered on

C.Uninstall the spreadsheet application immediately

D.Block the rare domain and close the alert

AnswerB

Network isolation stops the endpoint from reaching the attacker's command-and-control server and blocks lateral movement to other systems, while keeping the machine powered on preserves the volatile memory contents needed for forensic analysis (processes, injected code, network connections). This is an active containment action that does not delete on-disk artifacts or kill the live processes prematurely, so the response team can capture a memory dump and inspect the encoded PowerShell payload in its original context. On managed endpoints this is accomplished via EDR-integrated network quarantine, which applies a host firewall deny-all rule at the virtual switch or agent level rather than physically disconnecting the cable.

Why this answer

Isolating the endpoint from the network while keeping it powered on preserves volatile evidence (e.g., running processes, memory contents) and prevents the attacker from exfiltrating data or establishing further C2 communication. The EDR console allows immediate network isolation without losing the ability to perform live forensics or memory analysis. This aligns with the incident response priority of containment before eradication or recovery.

Exam trap

The trap here is that candidates confuse immediate containment (isolation) with eradication (reboot or uninstall), failing to recognize that preserving volatile evidence is critical for understanding the attack vector and scope before taking destructive actions.

How to eliminate wrong answers

Option A is wrong because rebooting the endpoint destroys volatile evidence in memory (e.g., LSASS dump artifacts, injected code) and may allow persistence mechanisms to re-execute on startup, potentially losing the forensic trail. Option C is wrong because uninstalling the spreadsheet application is a premature remediation step that destroys evidence and does not address the active threat; the analyst must first contain the endpoint to prevent lateral movement or data exfiltration.

Full explanation →

816

MCQmedium

Employees must sign in to several SaaS applications with corporate credentials, and terminated users should lose access quickly without manual changes in each app. Which solution best meets the requirement?

A.Create separate local usernames and passwords in each SaaS application.

B.Use federation for sign-on and automated provisioning and deprovisioning through an identity lifecycle process.

C.Require users to share one department password for each SaaS platform.

D.Store the same password in every application vault and sync it nightly.

AnswerB

Federation allows users to authenticate with the corporate identity provider, while automated provisioning helps create, update, and disable accounts across connected SaaS apps. This design supports single sign-on, faster offboarding, and centralized control over access lifecycle changes. It also reduces the risk of forgotten orphaned accounts remaining active after termination.

Why this answer

Federation enables single sign-on (SSO) using standards like SAML 2.0 or OIDC, allowing users to authenticate once with corporate credentials across multiple SaaS apps. Automated provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ensures that when an employee is terminated, their access is revoked from all connected applications instantly without manual intervention, meeting the requirement for rapid access removal.

Exam trap

The trap here is that candidates may confuse federation with simple SSO, overlooking the automated provisioning/deprovisioning component that is essential for the 'lose access quickly' requirement, and instead pick a password-vaulting solution thinking it centralizes credentials.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and passwords in each SaaS app requires manual management for each account, making it impossible to quickly revoke access for terminated users across all apps without individual changes. Option C is wrong because sharing one department password violates the principle of least privilege and non-repudiation, as it prevents individual accountability and does not allow targeted revocation for a single terminated user. Option D is wrong because storing the same password in every application vault and syncing it nightly does not provide immediate access revocation; a terminated user could still authenticate until the next sync, and password reuse across apps increases security risk if one vault is compromised.

Full explanation →

817

MCQeasy

After an employee successfully signs in to a file-sharing portal, the portal checks whether the employee can upload files to a specific project folder. Which AAA concept is being used?

A.Authentication, because the user proved their identity with credentials.

B.Authorization, because the system is deciding what the signed-in user is allowed to do.

C.Accounting, because the portal is recording the folder permissions for later review.

D.Nonrepudiation, because the portal proves the user cannot deny uploading a file.

AnswerB

Authorization is the process of determining permissions after identity has been confirmed. In this case, the portal is checking whether the authenticated user may upload files to a particular folder. That is a classic authorization decision because it controls access to a resource based on assigned rights, roles, or group membership.

Why this answer

After the user successfully signs in (authentication), the portal checks permissions to determine if they can upload files to a specific project folder. This is the definition of authorization: verifying what an authenticated user is allowed to do. The system is enforcing access control based on the user's identity and the folder's permissions.

Exam trap

The trap here is that candidates confuse the initial login (authentication) with the subsequent permission check (authorization), often selecting 'Authentication' because they see 'signs in' and assume the entire process is about identity verification.

How to eliminate wrong answers

Option A is wrong because authentication is the process of verifying identity (e.g., with a password or MFA), which has already occurred before the portal checks upload permissions; the question describes a post-login permission check, not identity verification. Option C is wrong because accounting involves logging and tracking user activities (e.g., upload events, timestamps) for auditing or billing, not checking permissions against a folder. Option D is wrong because nonrepudiation ensures a user cannot deny an action (e.g., via digital signatures or audit logs), but the scenario is about a pre-action permission check, not proving an action occurred.

Full explanation →

818

MCQmedium

A payroll application allows the same user to create a vendor and approve a payment. The security team wants to reduce fraud without adding unnecessary complexity. Which principle should they apply?

A.Separation of duties, so no single person can complete the entire high-risk workflow.

B.Job rotation, so employees periodically switch responsibilities to learn each other’s tasks.

C.Defense in depth, so multiple technical tools inspect every payment form.

D.Least privilege, so the payroll user can create and approve only this one vendor payment.

AnswerA

Separation of duties is the best control when one person should not be able to create and approve the same payment. By splitting responsibilities across different roles or approvals, the organization reduces the chance of fraud, abuse, or accidental misuse. This principle is common in finance and payroll workflows because it provides meaningful risk reduction without requiring a complicated technical redesign of the entire application.

Why this answer

Separation of duties (option A) is the correct principle because it prevents a single user from both creating a vendor and approving a payment, which would allow that user to commit fraud by setting up a fake vendor and authorizing a payment to it. By splitting these high-risk tasks between two or more people, the organization enforces a dual-control mechanism that reduces the risk of internal fraud without adding complex technical controls. This aligns with the security team's goal of reducing fraud while avoiding unnecessary complexity.

Exam trap

The trap here is that candidates often confuse separation of duties with job rotation or defense in depth, mistakenly thinking that rotating employees or adding more technical controls will prevent internal fraud, when in fact only splitting conflicting responsibilities directly addresses the risk of a single user completing a high-risk workflow.

How to eliminate wrong answers

Option B is wrong because job rotation involves periodically rotating employees through different roles to cross-train and detect irregularities, but it does not prevent a single user from completing the entire vendor creation and payment approval workflow at any given time; fraud could still occur during the current assignment. Option C is wrong because defense in depth is a layered security strategy that uses multiple technical controls (e.g., firewalls, IDS, encryption) to protect against external threats, but it does not address the internal segregation of conflicting duties; adding more technical tools to inspect payment forms would increase complexity without directly preventing the same user from performing both actions.

Full explanation →

819

MCQmedium

An EDR alert flags suspicious PowerShell on a finance workstation. Windows logs show the script started immediately after a patch-management tool launched from the software distribution server. The script only queries installed software and writes results to a log file. What is the most likely conclusion?

A.The alert is likely a false positive because the activity matches approved patch-management behavior

B.The workstation is definitely compromised because PowerShell is always malicious

C.The endpoint should be immediately wiped because the script wrote to a log file

D.The software distribution server should be blocked from the network permanently

AnswerA

This alert is best classified as a false positive because the detected PowerShell activity aligns with a known, approved patch-management workflow. In enterprise environments, patch-management platforms routinely execute PowerShell scripts on endpoints to inventory software, check patch status, and install updates, often in coordination with the local distribution server. The existence of a matching policy or change-control record, combined with the script's behavior and the trusted source (the distribution server), strongly indicates legitimate administrative activity rather than malicious code execution. EDR alerts must be correlated with environmental context and known-good baselines before escalating to an incident.

Why this answer

The EDR alert is likely a false positive because the PowerShell script's behavior—querying installed software and writing results to a log file—is consistent with legitimate patch-management inventory tasks. The script's execution immediately after the patch-management tool launched from the software distribution server indicates it was triggered by that tool as part of its normal operations, not by an attacker. Since the activity matches approved patch-management behavior and shows no signs of malicious intent (e.g., data exfiltration, lateral movement, or persistence), the alert should be investigated but is most likely a false positive.

Exam trap

The trap here is that candidates often assume any PowerShell execution is malicious, but the SY0-701 exam tests the ability to correlate process ancestry and script behavior to distinguish legitimate administrative activity from actual threats.

How to eliminate wrong answers

Option B is wrong because it incorrectly assumes PowerShell is always malicious, ignoring that PowerShell is a legitimate administrative tool widely used for automation and inventory tasks in enterprise environments. Option C is wrong because writing to a log file is a standard, non-malicious operation; immediate wiping is an extreme and unnecessary response that would disrupt business operations without evidence of compromise. Option D is wrong because permanently blocking the software distribution server would break critical patch-management workflows; the server is the likely source of the legitimate script, not a threat actor.

Full explanation →

820

MCQmedium

A security analyst observes repeated outbound traffic from a single workstation to a known malicious IP address. The workstation's anti-malware software has reported no alerts, and the user claims to have only downloaded software from the company's approved application store. Which type of malware most likely explains this behavior?

A.Ransomware

B.Rootkit

C.Trojan horse

D.Polymorphic malware

AnswerC

Correct. A Trojan horse masquerades as benign software, often from a seemingly trusted source. It can evade signature-based anti-malware and silently establish outbound connections to a malicious IP for command-and-control, data exfiltration, or further payload delivery.

Why this answer

The Trojan horse is correct because it is a type of malware that disguises itself as legitimate software, often downloaded from trusted sources like an approved application store, to bypass security controls. Once installed, it can silently establish outbound connections to a command-and-control (C2) server, such as the known malicious IP address observed, without triggering anti-malware alerts if the Trojan is not yet in the signature database. This matches the scenario where the user downloaded from an approved store, the anti-malware reported no alerts, and the workstation is communicating with a malicious IP.

Exam trap

The trap here is that candidates may confuse a rootkit's stealth capabilities with the Trojan's social engineering vector, overlooking that the approved store download is a classic Trojan delivery method, not a rootkit's typical infection path.

Why the other options are wrong

Ransomware typically encrypts files and demands payment, often with visible alerts or ransom notes, not silent outbound traffic to a known malicious IP without alerts.

A rootkit is designed to hide its presence and maintain privileged access, but it does not typically generate repeated outbound traffic to a known malicious IP. The observed behavior suggests a trojan horse, which masquerades as legitimate software to establish command-and-control communication.

Polymorphic malware changes its code to evade signature-based detection, but the question states the workstation's anti-malware software reported no alerts, which could also be due to a trojan. However, the key clue is that the user downloaded software from an approved store, suggesting a trojan disguised as legitimate software, not polymorphic behavior.

When would these options actually be correct?

A question where a user reports encrypted files and a ransom note demanding payment, with outbound traffic to a command-and-control server, would make ransomware correct.

A rootkit would be correct in a scenario where a security analyst discovers that malware has hidden itself from the operating system and anti-malware tools, and the user reports no unusual activity, but system performance is degraded or unauthorized access is detected.

A security analyst observes repeated outbound traffic to a known malicious IP, and the anti-malware software fails to detect the malware despite updated signatures. The malware changes its code each time it replicates, evading signature-based detection. Which type of malware is most likely responsible?

Why candidates pick the wrong answer

Candidates may associate any malicious outbound traffic with ransomware, overlooking that ransomware usually shows clear signs of infection rather than stealthy communication.

Candidates may choose rootkit because it is known for stealth and evading detection, similar to the scenario where anti-malware reported no alerts, but they overlook that rootkits do not typically cause repeated outbound traffic to a malicious IP.

Candidates may associate 'no alerts from anti-malware' with malware that evades detection, and polymorphic malware is known for evading signature-based detection, leading them to overlook the social engineering aspect of a trojan.

Full explanation →

821

MCQmedium

Several users on the same subnet report intermittent inability to reach the default gateway. A packet capture shows ARP replies mapping the gateway IP to a different MAC address, and the same host keeps sending those replies every few seconds. What attack is most likely?

A.Replay attack

B.ARP spoofing

C.DNS amplification

D.Man-in-the-middle via TLS downgrade

AnswerB

ARP spoofing, or ARP poisoning, occurs when an attacker sends unsolicited ARP replies or gratuitous ARP packets to associate the gateway's IP address with the attacker's MAC address. This causes hosts on the subnet to update their ARP caches, redirecting traffic meant for the gateway to the attacker, who can then sniff, intercept, or drop packets. The resulting false ARP entries explain the users' intermittent inability to communicate, as traffic is misdirected at the data-link layer.

Why this answer

ARP spoofing. The symptoms—intermittent gateway unreachability, ARP replies mapping the gateway IP to a different MAC address, and repeated unsolicited ARP replies—are classic indicators of an ARP spoofing (also called ARP poisoning) attack. The attacker sends forged ARP replies to associate their own MAC address with the gateway IP, causing traffic destined for the gateway to be sent to the attacker instead, disrupting connectivity.

Exam trap

The trap here is that candidates may confuse ARP spoofing with a man-in-the-middle attack in general, but the question specifically describes ARP-level manipulation (forged ARP replies mapping the gateway IP to a different MAC), which is the defining characteristic of ARP spoofing, not a TLS downgrade or replay attack.

How to eliminate wrong answers

Option A is wrong because a replay attack involves capturing and retransmitting valid data packets (e.g., authentication tokens) to trick a system, not sending forged ARP replies to redirect traffic. Option C is wrong because a DNS amplification attack is a type of DDoS that uses open DNS resolvers to flood a target with large DNS responses, and it does not involve manipulating ARP tables or causing intermittent gateway reachability. Option D is wrong because a man-in-the-middle via TLS downgrade attack forces a connection to use a weaker TLS version or cipher, but it does not involve ARP spoofing or sending forged ARP replies; it operates at the transport/application layer, not the data link layer.

Full explanation →

822

MCQeasy

A firewall rule must be changed to allow a vendor update server. Which step best reduces the chance of an unexpected outage?

A.Make the change directly in production without review to save time.

B.Document the change, get approval, and include a rollback plan.

C.Disable the firewall temporarily while the update is tested.

D.Apply the rule but do not tell anyone so there is less paperwork.

AnswerB

This is the best answer because secure change management uses approval and rollback planning to reduce operational risk. Documenting the requested change ensures the impact is reviewed, and a rollback plan gives the team a way to quickly restore service if the update causes problems. These controls help prevent outages caused by rushed or poorly understood production changes.

Why this answer

Following a formal change management process—documenting the change, obtaining approval, and including a rollback plan—ensures that the firewall rule modification is reviewed for potential impacts, authorized by stakeholders, and can be reverted if it causes an outage. This structured approach minimizes the risk of unexpected downtime by validating the change in a controlled manner and providing a safety net.

Exam trap

CompTIA often tests the misconception that speed or convenience (like disabling the firewall or skipping approval) is acceptable for urgent changes, but the exam emphasizes that proper change management is always required to prevent outages and maintain security.

How to eliminate wrong answers

Option A is wrong because making the change directly in production without review bypasses change management, increasing the risk of misconfiguration or unintended access that could cause an outage. Option C is wrong because disabling the firewall temporarily exposes the network to all traffic, creating a security vulnerability and potentially causing a different type of outage from malicious activity. Option D is wrong because applying the rule without notification violates change control policies, prevents stakeholders from preparing for potential impacts, and eliminates the ability to coordinate a rollback if issues arise.

Full explanation →

823

MCQhard

Based on the exhibit, which action is required to keep the backups restorable after the key-encryption key rotation?

A.Delete vault-kek-v1 immediately so only the newest key remains active.

B.Rewrap or keep access to the old KEK version until existing DEKs are migrated.

C.Re-encrypt the entire backup repository with a single shared password.

D.Export vault-kek-v2 into the backup files so each object stores the new key directly.

AnswerB

This is correct because the backups still depend on the old key-encryption key to unwrap their data-encryption keys. During key rotation, the organization must either keep the old KEK available or rewrap the DEKs with the new KEK before retiring the old one. That preserves restore capability without forcing a full mass re-encryption of the backup data.

Why this answer

When a key-encryption key (KEK) is rotated, existing data-encryption keys (DEKs) that were wrapped with the old KEK version become unreadable unless the old KEK is retained or the DEKs are re-wrapped with the new KEK. Option B ensures that backups remain restorable by either keeping the old KEK version accessible or migrating DEKs to the new KEK, maintaining the chain of trust for decryption.

Exam trap

The trap here is that candidates assume deleting the old key immediately is a best practice for key hygiene, but they overlook that existing encrypted data depends on the old key for decryption until re-wrapping occurs.

How to eliminate wrong answers

Option A is wrong because deleting vault-kek-v1 immediately would render all existing DEKs that were encrypted with that key permanently unrecoverable, breaking backup restorability. Option C is wrong because re-encrypting the entire backup repository with a single shared password violates the principle of key separation and introduces a single point of failure, as a password compromise would expose all backups. Option D is wrong because exporting vault-kek-v2 into backup files defeats the purpose of key management by storing the key alongside the data, eliminating the security benefit of a separate key hierarchy.

Full explanation →

824

MCQeasy

A company wants to make sure it can recover quickly after ransomware, even if the production network is unavailable. Which backup approach is the best choice?

A.Store backups only on the same file server so they are easy to access.

B.Keep an offline copy of backups that is disconnected from production systems.

C.Use a single monthly backup and never test restores to save time.

D.Save backups in the same cloud account using the same admin credentials.

AnswerB

An offline backup, such as a disk disconnected from the network or stored in an air-gapped environment, is not addressable by production systems or the ransomware running on them. Because the attacker cannot reach the media during the encryption or deletion phase, the copy remains intact and provides a clean, authoritative restore source. This directly supports the 3-2-1 backup rule: three copies, two different media, one offsite and offline, ensuring recoverability even when every online copy is compromised.

Why this answer

An offline (air-gapped) backup, such as a tape stored in a safe or a disconnected external drive, ensures that ransomware cannot encrypt or delete the backup data. This approach guarantees recoverability even when the production network is completely compromised or unavailable, aligning with the 3-2-1 backup rule (three copies, two media types, one offsite/offline).

Exam trap

The trap here is that candidates may think 'offline' means simply not connected to the internet, but the key is physical or logical disconnection from the production network to prevent ransomware from reaching the backup during an active attack.

How to eliminate wrong answers

Option A is wrong because storing backups on the same file server means they share the same attack surface; ransomware can encrypt or delete them alongside production data, making recovery impossible. Option C is wrong because a single monthly backup without testing restores violates the principle of recovery point objective (RPO) and recovery time objective (RTO); untested backups may be corrupt or incomplete, and the long interval between backups risks significant data loss.

Full explanation →

825

MCQeasy

A worker receives a text message from someone claiming to be the company's HR partner. The message says a benefits portal issue will be fixed only if the worker clicks a link and logs in right away. What type of attack is this most likely?

A.Smishing, because the attack is delivered by text message.

B.Watering hole, because the attacker compromised the HR partner's website.

C.Spoofing only, because the attacker copied the HR logo in the message.

D.Port scanning, because the attacker wants to find open services on the phone.

AnswerA

Smishing is a form of social engineering delivered via SMS or text-messaging platforms, relying on urgency and a trusted sender identity to prompt action. In this scenario, the attacker impersonates HR and asks the worker to log in, which is a classic credential-phishing pattern. The defining characteristic is the text message delivery vector, making smishing the precise attack classification.

Why this answer

This is smishing because the attack vector is a text message (SMS) that attempts to trick the recipient into clicking a malicious link and providing credentials. Smishing is a form of social engineering that exploits the trust in SMS communications, often impersonating a legitimate entity like HR to create urgency. The goal is credential theft, not technical exploitation of the phone's services.

Exam trap

CompTIA often tests the distinction between the delivery method (SMS = smishing) and the underlying technique (spoofing), so candidates mistakenly choose 'spoofing only' because they see a faked logo or sender ID, ignoring that the attack is defined by its vector.

How to eliminate wrong answers

Option B is wrong because a watering hole attack compromises a website frequently visited by the target group, not by sending a direct text message; the attacker does not compromise the HR partner's website here. Option C is wrong because spoofing alone is a technique (e.g., faking the sender ID or logo), but the full attack is smishing, which includes the social engineering delivery via SMS; the question asks for the attack type, not just one component. Option D is wrong because port scanning is a network reconnaissance technique to find open ports and services, not a method to trick a user into clicking a link via text message.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 751–825