Security+ SY0-701 SY0-701 Questions 826–900 | Page 12/14

826

MCQmedium

Employees must sign in to several SaaS applications with corporate credentials, and terminated users should lose access quickly without manual changes in each app. Which solution best meets the requirement?

A.Create separate local usernames and passwords in each SaaS application.

B.Use federation for sign-on and automated provisioning and deprovisioning through an identity lifecycle process.

C.Require users to share one department password for each SaaS platform.

D.Store the same password in every application vault and sync it nightly.

AnswerB

Federation allows users to authenticate with the corporate identity provider, while automated provisioning helps create, update, and disable accounts across connected SaaS apps. This design supports single sign-on, faster offboarding, and centralized control over access lifecycle changes. It also reduces the risk of forgotten orphaned accounts remaining active after termination.

Why this answer

Federation enables single sign-on (SSO) using standards like SAML 2.0 or OIDC, allowing users to authenticate once with corporate credentials across multiple SaaS apps. Automated provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ensures that when an employee is terminated, their access is revoked from all connected applications instantly without manual intervention, meeting the requirement for rapid access removal.

Exam trap

The trap here is that candidates may confuse federation with simple SSO, overlooking the automated provisioning/deprovisioning component that is essential for the 'lose access quickly' requirement, and instead pick a password-vaulting solution thinking it centralizes credentials.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and passwords in each SaaS app requires manual management for each account, making it impossible to quickly revoke access for terminated users across all apps without individual changes. Option C is wrong because sharing one department password violates the principle of least privilege and non-repudiation, as it prevents individual accountability and does not allow targeted revocation for a single terminated user. Option D is wrong because storing the same password in every application vault and syncing it nightly does not provide immediate access revocation; a terminated user could still authenticate until the next sync, and password reuse across apps increases security risk if one vault is compromised.

Full explanation →

827

MCQeasy

After an employee successfully signs in to a file-sharing portal, the portal checks whether the employee can upload files to a specific project folder. Which AAA concept is being used?

A.Authentication, because the user proved their identity with credentials.

B.Authorization, because the system is deciding what the signed-in user is allowed to do.

C.Accounting, because the portal is recording the folder permissions for later review.

D.Nonrepudiation, because the portal proves the user cannot deny uploading a file.

AnswerB

Authorization is the process of determining permissions after identity has been confirmed. In this case, the portal is checking whether the authenticated user may upload files to a particular folder. That is a classic authorization decision because it controls access to a resource based on assigned rights, roles, or group membership.

Why this answer

After the user successfully signs in (authentication), the portal checks permissions to determine if they can upload files to a specific project folder. This is the definition of authorization: verifying what an authenticated user is allowed to do. The system is enforcing access control based on the user's identity and the folder's permissions.

Exam trap

The trap here is that candidates confuse the initial login (authentication) with the subsequent permission check (authorization), often selecting 'Authentication' because they see 'signs in' and assume the entire process is about identity verification.

How to eliminate wrong answers

Option A is wrong because authentication is the process of verifying identity (e.g., with a password or MFA), which has already occurred before the portal checks upload permissions; the question describes a post-login permission check, not identity verification. Option C is wrong because accounting involves logging and tracking user activities (e.g., upload events, timestamps) for auditing or billing, not checking permissions against a folder. Option D is wrong because nonrepudiation ensures a user cannot deny an action (e.g., via digital signatures or audit logs), but the scenario is about a pre-action permission check, not proving an action occurred.

Full explanation →

828

MCQmedium

A payroll application allows the same user to create a vendor and approve a payment. The security team wants to reduce fraud without adding unnecessary complexity. Which principle should they apply?

A.Separation of duties, so no single person can complete the entire high-risk workflow.

B.Job rotation, so employees periodically switch responsibilities to learn each other’s tasks.

C.Defense in depth, so multiple technical tools inspect every payment form.

D.Least privilege, so the payroll user can create and approve only this one vendor payment.

AnswerA

Separation of duties is the best control when one person should not be able to create and approve the same payment. By splitting responsibilities across different roles or approvals, the organization reduces the chance of fraud, abuse, or accidental misuse. This principle is common in finance and payroll workflows because it provides meaningful risk reduction without requiring a complicated technical redesign of the entire application.

Why this answer

Separation of duties (option A) is the correct principle because it prevents a single user from both creating a vendor and approving a payment, which would allow that user to commit fraud by setting up a fake vendor and authorizing a payment to it. By splitting these high-risk tasks between two or more people, the organization enforces a dual-control mechanism that reduces the risk of internal fraud without adding complex technical controls. This aligns with the security team's goal of reducing fraud while avoiding unnecessary complexity.

Exam trap

The trap here is that candidates often confuse separation of duties with job rotation or defense in depth, mistakenly thinking that rotating employees or adding more technical controls will prevent internal fraud, when in fact only splitting conflicting responsibilities directly addresses the risk of a single user completing a high-risk workflow.

How to eliminate wrong answers

Option B is wrong because job rotation involves periodically rotating employees through different roles to cross-train and detect irregularities, but it does not prevent a single user from completing the entire vendor creation and payment approval workflow at any given time; fraud could still occur during the current assignment. Option C is wrong because defense in depth is a layered security strategy that uses multiple technical controls (e.g., firewalls, IDS, encryption) to protect against external threats, but it does not address the internal segregation of conflicting duties; adding more technical tools to inspect payment forms would increase complexity without directly preventing the same user from performing both actions.

Full explanation →

829

MCQmedium

An EDR alert flags suspicious PowerShell on a finance workstation. Windows logs show the script started immediately after a patch-management tool launched from the software distribution server. The script only queries installed software and writes results to a log file. What is the most likely conclusion?

A.The alert is likely a false positive because the activity matches approved patch-management behavior

B.The workstation is definitely compromised because PowerShell is always malicious

C.The endpoint should be immediately wiped because the script wrote to a log file

D.The software distribution server should be blocked from the network permanently

AnswerA

This alert is best classified as a false positive because the detected PowerShell activity aligns with a known, approved patch-management workflow. In enterprise environments, patch-management platforms routinely execute PowerShell scripts on endpoints to inventory software, check patch status, and install updates, often in coordination with the local distribution server. The existence of a matching policy or change-control record, combined with the script's behavior and the trusted source (the distribution server), strongly indicates legitimate administrative activity rather than malicious code execution. EDR alerts must be correlated with environmental context and known-good baselines before escalating to an incident.

Why this answer

The EDR alert is likely a false positive because the PowerShell script's behavior—querying installed software and writing results to a log file—is consistent with legitimate patch-management inventory tasks. The script's execution immediately after the patch-management tool launched from the software distribution server indicates it was triggered by that tool as part of its normal operations, not by an attacker. Since the activity matches approved patch-management behavior and shows no signs of malicious intent (e.g., data exfiltration, lateral movement, or persistence), the alert should be investigated but is most likely a false positive.

Exam trap

The trap here is that candidates often assume any PowerShell execution is malicious, but the SY0-701 exam tests the ability to correlate process ancestry and script behavior to distinguish legitimate administrative activity from actual threats.

How to eliminate wrong answers

Option B is wrong because it incorrectly assumes PowerShell is always malicious, ignoring that PowerShell is a legitimate administrative tool widely used for automation and inventory tasks in enterprise environments. Option C is wrong because writing to a log file is a standard, non-malicious operation; immediate wiping is an extreme and unnecessary response that would disrupt business operations without evidence of compromise. Option D is wrong because permanently blocking the software distribution server would break critical patch-management workflows; the server is the likely source of the legitimate script, not a threat actor.

Full explanation →

830

MCQmedium

A security analyst observes repeated outbound traffic from a single workstation to a known malicious IP address. The workstation's anti-malware software has reported no alerts, and the user claims to have only downloaded software from the company's approved application store. Which type of malware most likely explains this behavior?

A.Ransomware

B.Rootkit

C.Trojan horse

D.Polymorphic malware

AnswerC

Correct. A Trojan horse masquerades as benign software, often from a seemingly trusted source. It can evade signature-based anti-malware and silently establish outbound connections to a malicious IP for command-and-control, data exfiltration, or further payload delivery.

Why this answer

The Trojan horse is correct because it is a type of malware that disguises itself as legitimate software, often downloaded from trusted sources like an approved application store, to bypass security controls. Once installed, it can silently establish outbound connections to a command-and-control (C2) server, such as the known malicious IP address observed, without triggering anti-malware alerts if the Trojan is not yet in the signature database. This matches the scenario where the user downloaded from an approved store, the anti-malware reported no alerts, and the workstation is communicating with a malicious IP.

Exam trap

The trap here is that candidates may confuse a rootkit's stealth capabilities with the Trojan's social engineering vector, overlooking that the approved store download is a classic Trojan delivery method, not a rootkit's typical infection path.

Why the other options are wrong

Ransomware typically encrypts files and demands payment, often with visible alerts or ransom notes, not silent outbound traffic to a known malicious IP without alerts.

A rootkit is designed to hide its presence and maintain privileged access, but it does not typically generate repeated outbound traffic to a known malicious IP. The observed behavior suggests a trojan horse, which masquerades as legitimate software to establish command-and-control communication.

Polymorphic malware changes its code to evade signature-based detection, but the question states the workstation's anti-malware software reported no alerts, which could also be due to a trojan. However, the key clue is that the user downloaded software from an approved store, suggesting a trojan disguised as legitimate software, not polymorphic behavior.

When would these options actually be correct?

A question where a user reports encrypted files and a ransom note demanding payment, with outbound traffic to a command-and-control server, would make ransomware correct.

A rootkit would be correct in a scenario where a security analyst discovers that malware has hidden itself from the operating system and anti-malware tools, and the user reports no unusual activity, but system performance is degraded or unauthorized access is detected.

A security analyst observes repeated outbound traffic to a known malicious IP, and the anti-malware software fails to detect the malware despite updated signatures. The malware changes its code each time it replicates, evading signature-based detection. Which type of malware is most likely responsible?

Why candidates pick the wrong answer

Candidates may associate any malicious outbound traffic with ransomware, overlooking that ransomware usually shows clear signs of infection rather than stealthy communication.

Candidates may choose rootkit because it is known for stealth and evading detection, similar to the scenario where anti-malware reported no alerts, but they overlook that rootkits do not typically cause repeated outbound traffic to a malicious IP.

Candidates may associate 'no alerts from anti-malware' with malware that evades detection, and polymorphic malware is known for evading signature-based detection, leading them to overlook the social engineering aspect of a trojan.

Full explanation →

831

MCQmedium

Several users on the same subnet report intermittent inability to reach the default gateway. A packet capture shows ARP replies mapping the gateway IP to a different MAC address, and the same host keeps sending those replies every few seconds. What attack is most likely?

A.Replay attack

B.ARP spoofing

C.DNS amplification

D.Man-in-the-middle via TLS downgrade

AnswerB

ARP spoofing, or ARP poisoning, occurs when an attacker sends unsolicited ARP replies or gratuitous ARP packets to associate the gateway's IP address with the attacker's MAC address. This causes hosts on the subnet to update their ARP caches, redirecting traffic meant for the gateway to the attacker, who can then sniff, intercept, or drop packets. The resulting false ARP entries explain the users' intermittent inability to communicate, as traffic is misdirected at the data-link layer.

Why this answer

ARP spoofing. The symptoms—intermittent gateway unreachability, ARP replies mapping the gateway IP to a different MAC address, and repeated unsolicited ARP replies—are classic indicators of an ARP spoofing (also called ARP poisoning) attack. The attacker sends forged ARP replies to associate their own MAC address with the gateway IP, causing traffic destined for the gateway to be sent to the attacker instead, disrupting connectivity.

Exam trap

The trap here is that candidates may confuse ARP spoofing with a man-in-the-middle attack in general, but the question specifically describes ARP-level manipulation (forged ARP replies mapping the gateway IP to a different MAC), which is the defining characteristic of ARP spoofing, not a TLS downgrade or replay attack.

How to eliminate wrong answers

Option A is wrong because a replay attack involves capturing and retransmitting valid data packets (e.g., authentication tokens) to trick a system, not sending forged ARP replies to redirect traffic. Option C is wrong because a DNS amplification attack is a type of DDoS that uses open DNS resolvers to flood a target with large DNS responses, and it does not involve manipulating ARP tables or causing intermittent gateway reachability. Option D is wrong because a man-in-the-middle via TLS downgrade attack forces a connection to use a weaker TLS version or cipher, but it does not involve ARP spoofing or sending forged ARP replies; it operates at the transport/application layer, not the data link layer.

Full explanation →

832

MCQeasy

A firewall rule must be changed to allow a vendor update server. Which step best reduces the chance of an unexpected outage?

A.Make the change directly in production without review to save time.

B.Document the change, get approval, and include a rollback plan.

C.Disable the firewall temporarily while the update is tested.

D.Apply the rule but do not tell anyone so there is less paperwork.

AnswerB

This is the best answer because secure change management uses approval and rollback planning to reduce operational risk. Documenting the requested change ensures the impact is reviewed, and a rollback plan gives the team a way to quickly restore service if the update causes problems. These controls help prevent outages caused by rushed or poorly understood production changes.

Why this answer

Following a formal change management process—documenting the change, obtaining approval, and including a rollback plan—ensures that the firewall rule modification is reviewed for potential impacts, authorized by stakeholders, and can be reverted if it causes an outage. This structured approach minimizes the risk of unexpected downtime by validating the change in a controlled manner and providing a safety net.

Exam trap

CompTIA often tests the misconception that speed or convenience (like disabling the firewall or skipping approval) is acceptable for urgent changes, but the exam emphasizes that proper change management is always required to prevent outages and maintain security.

How to eliminate wrong answers

Option A is wrong because making the change directly in production without review bypasses change management, increasing the risk of misconfiguration or unintended access that could cause an outage. Option C is wrong because disabling the firewall temporarily exposes the network to all traffic, creating a security vulnerability and potentially causing a different type of outage from malicious activity. Option D is wrong because applying the rule without notification violates change control policies, prevents stakeholders from preparing for potential impacts, and eliminates the ability to coordinate a rollback if issues arise.

Full explanation →

833

MCQhard

Based on the exhibit, which action is required to keep the backups restorable after the key-encryption key rotation?

A.Delete vault-kek-v1 immediately so only the newest key remains active.

B.Rewrap or keep access to the old KEK version until existing DEKs are migrated.

C.Re-encrypt the entire backup repository with a single shared password.

D.Export vault-kek-v2 into the backup files so each object stores the new key directly.

AnswerB

This is correct because the backups still depend on the old key-encryption key to unwrap their data-encryption keys. During key rotation, the organization must either keep the old KEK available or rewrap the DEKs with the new KEK before retiring the old one. That preserves restore capability without forcing a full mass re-encryption of the backup data.

Why this answer

When a key-encryption key (KEK) is rotated, existing data-encryption keys (DEKs) that were wrapped with the old KEK version become unreadable unless the old KEK is retained or the DEKs are re-wrapped with the new KEK. Option B ensures that backups remain restorable by either keeping the old KEK version accessible or migrating DEKs to the new KEK, maintaining the chain of trust for decryption.

Exam trap

The trap here is that candidates assume deleting the old key immediately is a best practice for key hygiene, but they overlook that existing encrypted data depends on the old key for decryption until re-wrapping occurs.

How to eliminate wrong answers

Option A is wrong because deleting vault-kek-v1 immediately would render all existing DEKs that were encrypted with that key permanently unrecoverable, breaking backup restorability. Option C is wrong because re-encrypting the entire backup repository with a single shared password violates the principle of key separation and introduces a single point of failure, as a password compromise would expose all backups. Option D is wrong because exporting vault-kek-v2 into backup files defeats the purpose of key management by storing the key alongside the data, eliminating the security benefit of a separate key hierarchy.

Full explanation →

834

MCQeasy

A company wants to make sure it can recover quickly after ransomware, even if the production network is unavailable. Which backup approach is the best choice?

A.Store backups only on the same file server so they are easy to access.

B.Keep an offline copy of backups that is disconnected from production systems.

C.Use a single monthly backup and never test restores to save time.

D.Save backups in the same cloud account using the same admin credentials.

AnswerB

An offline backup, such as a disk disconnected from the network or stored in an air-gapped environment, is not addressable by production systems or the ransomware running on them. Because the attacker cannot reach the media during the encryption or deletion phase, the copy remains intact and provides a clean, authoritative restore source. This directly supports the 3-2-1 backup rule: three copies, two different media, one offsite and offline, ensuring recoverability even when every online copy is compromised.

Why this answer

An offline (air-gapped) backup, such as a tape stored in a safe or a disconnected external drive, ensures that ransomware cannot encrypt or delete the backup data. This approach guarantees recoverability even when the production network is completely compromised or unavailable, aligning with the 3-2-1 backup rule (three copies, two media types, one offsite/offline).

Exam trap

The trap here is that candidates may think 'offline' means simply not connected to the internet, but the key is physical or logical disconnection from the production network to prevent ransomware from reaching the backup during an active attack.

How to eliminate wrong answers

Option A is wrong because storing backups on the same file server means they share the same attack surface; ransomware can encrypt or delete them alongside production data, making recovery impossible. Option C is wrong because a single monthly backup without testing restores violates the principle of recovery point objective (RPO) and recovery time objective (RTO); untested backups may be corrupt or incomplete, and the long interval between backups risks significant data loss.

Full explanation →

835

MCQeasy

A worker receives a text message from someone claiming to be the company's HR partner. The message says a benefits portal issue will be fixed only if the worker clicks a link and logs in right away. What type of attack is this most likely?

A.Smishing, because the attack is delivered by text message.

B.Watering hole, because the attacker compromised the HR partner's website.

C.Spoofing only, because the attacker copied the HR logo in the message.

D.Port scanning, because the attacker wants to find open services on the phone.

AnswerA

Smishing is a form of social engineering delivered via SMS or text-messaging platforms, relying on urgency and a trusted sender identity to prompt action. In this scenario, the attacker impersonates HR and asks the worker to log in, which is a classic credential-phishing pattern. The defining characteristic is the text message delivery vector, making smishing the precise attack classification.

Why this answer

This is smishing because the attack vector is a text message (SMS) that attempts to trick the recipient into clicking a malicious link and providing credentials. Smishing is a form of social engineering that exploits the trust in SMS communications, often impersonating a legitimate entity like HR to create urgency. The goal is credential theft, not technical exploitation of the phone's services.

Exam trap

CompTIA often tests the distinction between the delivery method (SMS = smishing) and the underlying technique (spoofing), so candidates mistakenly choose 'spoofing only' because they see a faked logo or sender ID, ignoring that the attack is defined by its vector.

How to eliminate wrong answers

Option B is wrong because a watering hole attack compromises a website frequently visited by the target group, not by sending a direct text message; the attacker does not compromise the HR partner's website here. Option C is wrong because spoofing alone is a technique (e.g., faking the sender ID or logo), but the full attack is smishing, which includes the social engineering delivery via SMS; the question asks for the attack type, not just one component. Option D is wrong because port scanning is a network reconnaissance technique to find open ports and services, not a method to trick a user into clicking a link via text message.

Full explanation →

836

MCQmedium

A security analyst is investigating a phishing campaign that specifically targets senior executives in a company. The emails appear to come from the CEO and request urgent wire transfers to a fraudulent account. Which of the following best describes this type of attack?

A.Whaling

B.Spear phishing

C.Vishing

D.Pharming

AnswerA

Whaling is a highly targeted form of spear phishing that focuses specifically on senior executives, such as CEOs, CFOs, or other high-value individuals with privileged access to financial systems or sensitive corporate data. Attackers craft meticulously researched emails that impersonate trusted internal or external authorities, often invoking legal, compliance, or urgent transactional pretexts to pressure the victim into actions like wire transfers or credential disclosure. Unlike generic spear phishing, which may target any individual with specific attributes, whaling is defined by the executive-level target and the disproportionate potential impact, making it a distinct and more dangerous subtype.

Why this answer

This attack is whaling because it specifically targets senior executives (the 'big fish') with a fraudulent email impersonating the CEO to request urgent wire transfers. Whaling is a form of phishing that focuses on high-profile individuals within an organization, leveraging their authority and access to sensitive financial operations. The attack exploits the trust and urgency associated with executive communications to bypass standard security controls.

Exam trap

CompTIA often tests the distinction between whaling and spear phishing, where candidates mistakenly choose spear phishing because they overlook that whaling is a specific subtype targeting executives, not just any individual.

Why the other options are wrong

Vishing is a voice-based phishing attack conducted over phone calls, not email. The scenario describes emails requesting wire transfers, which is a text-based attack, not voice.

When would these options actually be correct?

A question describing a phishing attack where the attacker calls a senior executive, impersonates the CEO, and requests an urgent wire transfer over the phone would make vishing the correct answer.

Why candidates pick the wrong answer

Candidates may confuse the term 'vishing' with 'phishing' due to similar names, or mistakenly think any social engineering attack targeting executives is vishing, without recognizing the voice channel requirement.

Full explanation →

837

MCQmedium

A procurement clerk receives a text message from someone claiming to be a supplier account manager. The message says a recent payment failed and asks the clerk to update bank details through a link to a secure portal. What should the clerk do first?

A.Open the link and compare it with the supplier's branding

B.Reply to the text and ask the sender to confirm the request

C.Verify the request using a known supplier contact method before taking action

D.Forward the message to finance so they can decide whether it is legitimate

AnswerC

The defining characteristic of social engineering / business email compromise (BEC) is that the attacker controls the communication channel, so the only robust countermeasure is to confirm the request via a channel that the attacker cannot influence — a phone number on file, a corporate address book entry, or a previously verified supplier portal. This breaks the attacker's control loop and ensures that the request is not acted upon solely on the basis of an unverified SMS. It also aligns with the principle of 'trust, but verify' and prevents invoice redirection or fraudulent payment before any harm occurs.

Why this answer

The clerk should independently verify the request using a known supplier contact method (e.g., a phone number on file) before taking any action. This prevents falling victim to a social engineering attack, such as a phishing or business email compromise (BEC) attempt, where the attacker spoofs the sender's identity to redirect payments. Verifying through an out-of-band channel ensures the request is legitimate, as the link in the message could lead to a credential-harvesting site or malware download.

Exam trap

The trap here is that candidates may choose Option D, thinking that forwarding to finance is a safe escalation, but the SY0-701 exam emphasizes that the first step is always independent verification using a trusted method, not delegating or relying on the suspicious communication channel.

How to eliminate wrong answers

Option A is wrong because opening the link and comparing branding is unsafe; the link could lead to a lookalike domain that mimics the supplier's portal, and merely comparing branding does not verify the sender's identity or the link's authenticity, as attackers can easily replicate logos and styles. Option B is wrong because replying to the text allows the attacker to continue the social engineering; the reply goes to the same compromised channel, and the attacker can simply confirm the request, providing no real verification. Option D is wrong because forwarding the message to finance shifts responsibility without verifying the request first; finance may also be deceived by the same spoofed message, and the clerk should independently verify before escalating.

Full explanation →

838

MCQmedium

Based on the exhibit, which document should be updated first to reflect the new ticketing platform while keeping approval requirements unchanged?

A.Policy, because every tool change requires rewriting the corporate mandate.

B.Standard, because the approval workflow and evidence rules are still the same.

C.Procedure, because the step-by-step instructions and screenshots are now outdated.

D.Guideline, because optional content should always be revised before mandatory content.

AnswerC

Procedures contain the operational steps people follow to complete a task. Since the workflow and approval rules remain the same but the tool interface changed, the step-by-step guide should be updated first. That keeps the control intent intact while preventing user confusion and process errors.

Why this answer

The procedure document contains the step-by-step instructions, including screenshots and specific commands for the old ticketing platform. Since the new platform changes the user interface and workflow steps, the procedure must be updated first to ensure technicians can follow accurate instructions. Policies and standards define high-level rules and approval requirements, which remain unchanged, so they do not need immediate revision.

Exam trap

The trap here is that candidates confuse 'procedure' with 'standard' or 'policy,' assuming any tool change requires updating the highest-level document, when in fact only the detailed implementation steps (procedure) need revision if the rules and requirements remain unchanged.

How to eliminate wrong answers

Option A is wrong because a policy is a high-level mandate that sets overall direction and requirements; changing a specific tool does not automatically require rewriting the entire policy, especially when approval requirements stay the same. Option B is wrong because a standard defines mandatory rules and baselines (e.g., evidence retention periods), and while the approval workflow and evidence rules are unchanged, the standard does not include the step-by-step instructions that are now outdated. Option D is wrong because a guideline is optional and non-binding; revising optional content before mandatory content is not a priority, and the question specifically asks for the document that should be updated first to reflect the new platform.

Full explanation →

839

MCQhard

Based on the exhibit, which control would most effectively reduce the remaining successful attacks? Phishing awareness results: Team A: click rate 8%, report rate 6%, median report time 52 min Team B: click rate 7%, report rate 18%, median report time 14 min Team C: click rate 12%, report rate 21%, median report time 10 min Incident summary: Team C had one mailbox takeover after a user approved an MFA push while traveling.

A.Continue generic awareness posters without changing technical controls.

B.Replace push-based MFA with phishing-resistant MFA and reinforce verification for unusual login prompts.

C.Disable MFA on mobile devices so users can log in faster.

D.Allow employees to approve prompts from any device to reduce help desk calls.

AnswerB

Replacing push-based MFA with phishing-resistant MFA, such as FIDO2 security keys or passkeys, eliminates the possibility of a remote attacker triggering a simple approval prompt, because the MFA secret is bound to the legitimate service's origin. Reinforcing verification for unusual login prompts—for example, requiring the user to confirm a displayed number or to check the sign-in location—adds a human decision layer that catches prompt fatigue even if a prompt somehow appears. This combination directly counters the reported attack: the travelling employee could not have been phished into approving a push because no push exists, and any abnormal sign-in would trigger an explicit verification step instead of a one-tap 'Yes'.

Why this answer

Team C's successful attack was a mailbox takeover resulting from a user approving an MFA push notification while traveling. This indicates that push-based MFA is vulnerable to MFA fatigue attacks, where an attacker bombards the user with prompts until they approve. Replacing push-based MFA with phishing-resistant MFA (e.g., FIDO2/WebAuthn or hardware tokens) eliminates the possibility of approving a prompt from an untrusted device, and reinforcing verification for unusual login prompts adds a critical user behavior layer to detect anomalies.

Exam trap

CompTIA often tests the misconception that any MFA is equally secure; the trap here is that candidates may think push-based MFA is sufficient because it is 'multi-factor,' but the exam expects you to recognize that push-based MFA is vulnerable to fatigue attacks and that phishing-resistant MFA is the appropriate technical control to prevent such successful attacks.

How to eliminate wrong answers

Option A is wrong because generic awareness posters do not address the specific technical vulnerability of push-based MFA being susceptible to fatigue attacks; they are too vague and have already proven ineffective given Team C's high click rate and the successful attack. Option C is wrong because disabling MFA on mobile devices would remove the only authentication factor for mobile users, drastically increasing the risk of account compromise from stolen credentials or session hijacking. Option D is wrong because allowing employees to approve prompts from any device would exacerbate MFA fatigue by removing location/device context, making it easier for attackers to trick users into approving malicious requests.

Full explanation →

840

Matchingeasy

Match each cryptographic concept to its best purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Makes data unreadable to anyone who does not have the correct key.

Creates a fixed-size fingerprint to detect whether data changed.

Adds random data before hashing passwords so identical passwords look different.

Lets others verify who signed the file and that it was not altered.

Replaces an encryption key before its approved lifetime ends.

Why these pairings

Confidentiality protects secrecy, integrity prevents tampering, authentication confirms identity, non-repudiation ensures proof of origin, availability ensures uptime, and accountability enables audit trails.

Full explanation →

841

MCQeasy

A SOC analyst sees 20 failed logins for one user account, followed by a successful login 30 seconds later from the same office subnet. The user confirms they mistyped the password several times. What is the best conclusion?

A.It is definitely a brute-force attack and should be treated as confirmed compromise.

B.It is most likely a false positive caused by user error and should be documented after verification.

C.It is evidence of malware on the user's workstation until the device is rebuilt.

D.It proves the password was changed by an attacker and the account must be disabled immediately.

AnswerB

The most plausible explanation is that the user mistyped their password repeatedly due to human error, such as Caps Lock being active, an expired password, or a typo, and the login attempts originated from a location consistent with the user's typical behavior. The analyst should verify the user's account, correlate the timestamps with the user's reported activity, and document the incident as a false positive for compliance and future correlation. This approach aligns with the incident response principle of validating alerts with context before escalating, avoiding alert fatigue and unnecessary operational disruption.

Why this answer

The scenario shows 20 failed logins followed by a successful login from the same office subnet, and the user confirms they mistyped the password. This pattern is consistent with user error (e.g., Caps Lock or typo), not an automated brute-force attack, which would typically show a much higher volume of attempts from diverse IPs. The best conclusion is a false positive, which should be documented after verification to maintain accurate incident records.

Exam trap

The trap here is that candidates may overreact to multiple failed logins as a brute-force attack, ignoring the user's confirmation and the same-subnet source, which are classic indicators of user error rather than malicious activity.

How to eliminate wrong answers

Option A is wrong because a brute-force attack would involve hundreds or thousands of attempts from multiple IP addresses, not just 20 from the same subnet, and a successful login from the user's own subnet with user confirmation of error makes an attack unlikely. Option C is wrong because there is no evidence of malware; failed logins followed by a successful login from the same subnet are not indicative of malware activity, and rebuilding the device is an extreme, unnecessary response. Option D is wrong because the successful login occurred from the same office subnet, not an attacker's IP, and the user confirmed they mistyped the password; there is no evidence the password was changed, and disabling the account would be premature without further investigation.

Full explanation →

842

MCQmedium

A security team is defining the minimum approved configuration for all new Linux web servers. The document must require specific logging settings, approved packages, and disabled services, and administrators must check servers against it during audits. Which governance artifact best fits this need?

A.Guideline, because it suggests recommended settings without requiring enforcement.

B.Baseline, because it defines the minimum approved configuration that systems should meet.

C.Policy, because it is the high-level statement of intent for the organization.

D.Procedure, because it explains the exact steps to install and configure each server.

AnswerB

A baseline is the correct artifact when an organization wants a documented, measurable starting configuration for systems. It captures the approved minimum settings, such as required services, logging, and packages, and supports consistent builds and compliance checks. Because the question describes a configuration that administrators will audit against, a baseline fits better than a guideline or a general policy.

Why this answer

A baseline is the correct governance artifact because it defines the minimum approved configuration that systems must meet, including specific logging settings, approved packages, and disabled services. In the context of Linux web servers, a baseline ensures consistent security posture by providing a measurable standard that administrators can audit against, such as verifying that rsyslog is configured for remote logging, only packages like Apache or Nginx from approved repositories are installed, and services like Telnet or FTP are disabled. This aligns with the requirement for enforcement and auditability, unlike a guideline which is merely advisory.

Exam trap

The trap here is that candidates confuse 'policy' with 'baseline' because both are governance documents, but a policy is a broad directive (e.g., 'secure all systems') while a baseline provides the specific, auditable technical controls (e.g., 'disable Telnet, enable auditd, use only Apache 2.4') that administrators must enforce.

How to eliminate wrong answers

Option A is wrong because a guideline suggests recommended settings without requiring enforcement, but the scenario explicitly requires administrators to check servers against the document during audits, implying mandatory compliance. Option C is wrong because a policy is a high-level statement of intent (e.g., 'all servers must be secure') that lacks the specific technical details (e.g., exact logging settings, package lists, disabled services) needed for a configuration audit; a baseline operationalizes policy into measurable technical requirements.

Full explanation →

843

MCQmedium

A SOC analyst confirms that an employee entered credentials into a phishing site and that the mailbox now shows a new forwarding rule sending messages to an external address. The account is still signed in on a laptop and a mobile phone. What is the best next action?

A.Wait for the user to log out naturally before taking action.

B.Revoke active sessions and force a password reset for the account.

C.Archive the mailbox and close the ticket after notifying the user.

D.Delete the forwarding rule only and consider the incident closed.

AnswerB

Revoking active sessions immediately invalidates any authentication tokens, cookies, or session identifiers the attacker may have captured, cutting off their current access to the mailbox. Forcing a password reset ensures that the compromised password is no longer valid, preventing the attacker from re-authenticating even if they attempt to log in again. This dual action directly addresses both the active session compromise and the credential compromise, which is essential for containing the incident.

Why this answer

The immediate priority is to contain the compromised account by terminating all active sessions (revoking OAuth tokens, clearing SAML sessions) and forcing a password reset to prevent further unauthorized access. The mailbox forwarding rule indicates the attacker has established persistence, and the active sessions on the laptop and mobile phone mean the attacker could still be using the account. Revoking sessions ensures the attacker cannot continue exfiltration or lateral movement, while the password reset invalidates the stolen credentials.

Exam trap

The trap here is that candidates may think waiting for the user to log out (Option A) is acceptable because the user is still signed in, but in security operations, you must assume the attacker has active access and act immediately to revoke sessions rather than relying on user behavior.

How to eliminate wrong answers

Option A is wrong because waiting for the user to log out naturally gives the attacker continued access to the account, allowing further data exfiltration via the forwarding rule or other malicious actions. Option C is wrong because archiving the mailbox and closing the ticket without revoking sessions or resetting the password leaves the account compromised, the forwarding rule active, and the attacker still able to access the account and modify settings.

Full explanation →

844

MCQhard

Employees use a browser-based SaaS portal, a native expense app, and an internal API. The company wants one corporate identity, API access without separate passwords, and automatic account removal when HR disables a user. Which solution best fits?

A.Use LDAP binds directly against each application and manage local passwords separately.

B.Use OpenID Connect federation with OAuth 2.0 access tokens and SCIM provisioning.

C.Use shared local accounts in each application and sync passwords nightly from the directory.

D.Use Kerberos constrained delegation to each vendor tenant for every application.

AnswerB

OpenID Connect (OIDC) provides a federated identity layer that supports both browser-based SSO through authorization code flows and native mobile app sign-in via PKCE, while OAuth 2.0 access tokens grant the SaaS apps scoped API access on behalf of the user. SCIM (System for Cross-domain Identity Management) automates the creation, update, and deactivation of user accounts in the SaaS applications, ensuring offboarding is immediate and no orphaned accounts linger. Together they give the organization centralized lifecycle control, strong authentication, and least-privilege API access, which is the modern standard for SaaS identity management.

Why this answer

OpenID Connect (OIDC) federation with OAuth 2.0 provides a single corporate identity (federated SSO), allows API access without separate passwords (using access tokens), and SCIM provisioning automates account removal when HR disables a user. This combination meets all three requirements: unified identity, passwordless API access, and lifecycle management.

Exam trap

The trap here is that candidates often confuse LDAP or Kerberos (both legacy on-premises protocols) with modern cloud federation, failing to recognize that OIDC + OAuth 2.0 + SCIM is the only combination that provides SSO, token-based API access, and automated provisioning for SaaS and native apps.

How to eliminate wrong answers

Option A is wrong because LDAP binds require separate password management per application and do not provide API access without passwords, nor do they support automatic account removal via SCIM. Option C is wrong because shared local accounts with nightly password sync violate the requirement for a single corporate identity and do not enable API access without passwords; they also lack automatic provisioning/deprovisioning. Option D is wrong because Kerberos constrained delegation is designed for on-premises Windows environments and does not federate to browser-based SaaS or native apps, nor does it support SCIM-based lifecycle management.

Full explanation →

845

MCQmedium

A SOC analyst confirms that a workstation is encrypting local files and attempting SMB connections to nearby hosts. The user is still logged in, and the business wants to limit spread without destroying evidence. What is the best immediate action?

A.Power the workstation off immediately and leave it in place

B.Quarantine the workstation from the network using EDR or switch port containment

C.Run a full antivirus scan while the workstation remains connected

D.Wipe and reimage the workstation from a standard build image

AnswerB

This is the best immediate containment action because it stops further spread while preserving evidence. EDR quarantine or disabling the switch port isolates the infected host without unnecessarily powering it down. The SOC can then collect volatile and disk evidence, determine the scope of infection, and proceed with eradication and recovery steps in the proper incident response sequence.

Why this answer

Quarantining the workstation via EDR or switch port containment immediately stops the SMB-based lateral movement and further encryption of network shares, while preserving the volatile evidence (memory, running processes, encryption keys) for forensic analysis. This aligns with the business requirement to limit spread without destroying evidence, as powering off or reimaging would lose critical forensic data.

Exam trap

The trap here is that candidates think powering off (Option A) is the fastest way to stop spread, but CompTIA emphasizes preserving evidence and avoiding destruction of volatile data, making network quarantine the correct choice.

How to eliminate wrong answers

Option A is wrong because powering off the workstation destroys volatile evidence (e.g., encryption keys in memory, active network connections) and may trigger anti-forensic mechanisms in the ransomware. Option C is wrong because running a full antivirus scan while the workstation remains connected allows the ransomware to continue encrypting local files and spreading via SMB to nearby hosts, violating the goal to limit spread. Option D is wrong because wiping and reimaging destroys all evidence, including the ransomware binary, encryption artifacts, and forensic traces needed for incident response and attribution.

Full explanation →

846

MCQeasy

A company needs a public website that anyone on the internet can reach, but the application and database servers must stay off the internet. Where should the web server be placed?

A.On the internal user network with the database server.

B.In a DMZ separated from the internal application and database networks.

C.On the same subnet as the firewall management interface.

D.Directly on the database subnet so performance is faster.

AnswerB

A DMZ is the best choice because it allows public access to the web server while keeping the application and database tiers behind additional security controls. If the web server is compromised, the attacker still has to cross another boundary to reach internal systems. This layered zoning is a standard architecture pattern for public-facing services and helps contain risk.

Why this answer

The web server must be placed in a DMZ (demilitarized zone) because this network segment is designed to host publicly accessible services while isolating them from internal networks. The DMZ allows inbound traffic from the internet to the web server, but the application and database servers remain on internal networks with strict firewall rules that block direct internet access, enforcing a layered security architecture.

Exam trap

The trap here is that candidates often confuse a DMZ with a 'public subnet' and think placing the web server directly on the internet-facing side of the firewall is sufficient, but the DMZ is a separate, isolated network segment that enforces strict traffic inspection and prevents direct lateral movement to internal resources.

How to eliminate wrong answers

Option A is wrong because placing the web server on the internal user network with the database server would expose both to direct internet traffic, violating the requirement to keep application and database servers off the internet and creating a single point of compromise. Option C is wrong because the firewall management interface subnet is a highly restricted administrative network; placing a public web server there would expose management interfaces to attack and violate security best practices. Option D is wrong because placing the web server directly on the database subnet would allow internet traffic to reach the database server directly, bypassing the application layer and defeating the purpose of network segmentation.

Full explanation →

847

Matchingeasy

Match each control category to the best example.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

A firewall blocks unauthorized inbound traffic.

A written policy requires manager approval before access is granted.

A badge reader controls entry to a server room.

A SIEM alert notifies the SOC about a failed login pattern.

Restoring a system from a known-good backup after a failure.

Why these pairings

Control categories are matched to examples: preventive controls block, detective controls identify, corrective controls fix, deterrent controls discourage, compensating controls provide alternatives, and directive controls set rules.

Full explanation →

848

Multi-Selectmedium

A security analyst is reviewing the organization's incident response procedures. According to the NIST SP 800-61 framework, which four of the following are recognized phases of the incident response lifecycle? (Choose four.)

Select 4 answers

.Preparation

.Detection and Analysis

.Containment, Eradication, and Recovery

.Post-Incident Activity

.Threat Hunting

.Risk Assessment

Why this answer

The NIST SP 800-61 Revision 2 framework defines the incident response lifecycle as consisting of four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. These phases form a continuous cycle, with lessons learned from Post-Incident Activity feeding back into Preparation. The question asks for the four recognized phases, and these four options directly match the NIST model.

Exam trap

The trap here is that candidates may confuse proactive security activities like Threat Hunting or Risk Assessment with the formal incident response phases, but NIST SP 800-61 strictly lists only the four phases given as correct answers.

Full explanation →

849

MCQeasy

A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?

A.Do nothing until the patch window opens.

B.Add a compensating control such as restricting access to the system.

C.Disable all logging so the system runs faster.

D.Rename the application so attackers cannot find it.

AnswerB

Restricting access is a compensating control: it reduces the exposure window created by the unpatched legacy application without modifying it. Patching is unavailable for two weeks, so access restriction is the only measure that lowers risk during that period.

Why this answer

Implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.

Exam trap

The trap here is that candidates may choose 'Do nothing' assuming patching is the only valid action, but CompTIA expects you to recognize that compensating controls are a standard risk management strategy when immediate patching is not feasible.

How to eliminate wrong answers

Option A is wrong because doing nothing leaves the vulnerability exposed, increasing the risk of exploitation during the two-week window, which violates the security team's goal of risk reduction. Option C is wrong because disabling logging degrades visibility and audit capabilities, making it harder to detect or investigate attacks, and does not address the underlying vulnerability.

Full explanation →

850

MCQeasy

A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?

A.Patching the vendor's application servers.

B.Setting user sharing permissions and access controls for company data.

C.Replacing failed disks in the provider's storage cluster.

D.Maintaining the cloud provider's identity center and hypervisor.

AnswerB

In a SaaS model, the provider manages the application and underlying infrastructure, but the customer remains responsible for how the service is used. That includes user provisioning, access permissions, sharing settings, and data handling decisions. Configuring who can see or edit documents is a customer duty because it directly affects the organization's confidentiality and compliance obligations.

Why this answer

In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.

Exam trap

The trap here is that candidates often confuse the SaaS model with IaaS or PaaS, incorrectly assuming the customer is responsible for patching or hardware maintenance, when in fact the provider handles all infrastructure layers in SaaS.

How to eliminate wrong answers

Option A is wrong because patching the vendor's application servers is the provider's responsibility under the SaaS shared responsibility model, not the customer's. Option C is wrong because replacing failed disks in the provider's storage cluster is an infrastructure maintenance task owned by the SaaS provider. Option D is wrong because maintaining the cloud provider's identity center and hypervisor is part of the provider's responsibility for the underlying platform, not the customer's.

Full explanation →

851

MCQhard

Based on the exhibit, which issue should be remediated FIRST? The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.

A.Internet-facing VPN appliance

B.Internal HR file server

C.Lab workstation

D.DMZ reporting server

AnswerA

This asset should be remediated first because it is directly reachable from the internet, has a publicly known exploit that can be weaponized without authentication, and currently lacks compensating controls such as a WAF, access-control list, or host IPS. That combination yields the highest probability of successful remote compromise in the shortest time, so even if other assets have higher raw CVSS scores, the VPN appliance presents the greatest immediate risk to the organization.

Why this answer

The Internet-facing VPN appliance is the highest priority because it is directly exposed to untrusted networks (the Internet), making it the most likely entry point for attackers. A compromise here could lead to full network access, bypassing all other security controls, which represents the greatest real-world risk regardless of its severity score.

Exam trap

The trap here is that candidates often fixate on the highest CVSS severity score (e.g., a critical vulnerability on the internal server) rather than considering the attack surface and likelihood of exploitation, which is the core of risk-based prioritization.

How to eliminate wrong answers

Option B (Internal HR file server) is wrong because it resides on the internal network and is not directly reachable from the Internet, so its exposure is limited to already-authenticated users; remediating it first would not reduce external attack surface. Option C (Lab workstation) is wrong because it is isolated in a lab environment, typically with restricted network access and no sensitive production data, making its compromise low-impact. Option D (DMZ reporting server) is wrong because while it is in a DMZ, it is not Internet-facing (it is behind the firewall and only accessible from internal or specific external sources), so its risk is lower than a directly exposed VPN gateway.

Full explanation →

852

MCQhard

Based on the exhibit, what is the most likely explanation for the suspicious workstation activity?

A.Ransomware campaign

B.Fileless attack

C.Worm propagation

D.Rootkit persistence

AnswerB

The exhibit shows legitimate Windows tools launching hidden, encoded PowerShell from a scheduled task, with no dropped executable on disk. That pattern strongly suggests a fileless attack, where the payload runs primarily in memory and uses trusted utilities to reduce visibility. The periodic connections after execution also fit a lightweight backdoor or loader rather than a traditional malware binary.

Why this answer

The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.

Exam trap

The trap here is that candidates see a PowerShell command and assume it is a worm or ransomware, but the key detail is the in-memory execution (no file written) which is the hallmark of a fileless attack, not the payload's ultimate goal.

How to eliminate wrong answers

Option A is wrong because ransomware typically encrypts files and leaves ransom notes, but the exhibit shows no evidence of file encryption or ransom demands—only a suspicious PowerShell download cradle. Option C is wrong because worm propagation requires self-replicating code that spreads across networks without user interaction, whereas the exhibit shows a single command executed on one workstation with no lateral movement indicators. Option D is wrong because rootkit persistence involves hiding processes or files at the kernel level (e.g., via driver hooks or MBR modification), but the exhibit shows a one-time in-memory execution with no persistence mechanism like scheduled tasks or registry run keys.

Full explanation →

853

MCQmedium

A weekly scan reports three findings: a medium-severity missing patch on a lab VM with no network access, a high-severity default credential on a management interface reachable from the internet, and a low-severity outdated browser plug-in on a visitor kiosk. Which issue should be remediated first?

A.The medium-severity missing patch on the isolated lab VM.

B.The low-severity outdated browser plug-in on the visitor kiosk.

C.The high-severity default credential on the management interface exposed to the internet.

D.All three issues have the same priority because they were found in the same scan cycle.

AnswerC

Default credentials on a management interface exposed to the internet represent a critical risk because they are publicly known, easily tested by automated tools, and provide immediate administrative access if successfully used. The internet exposure makes the vulnerability remotely exploitable without authentication, and a management interface often has elevated privileges, enabling full system control. This combination of high severity, high exploitability, and direct internet accessibility must be the top priority.

Why this answer

The high-severity default credential on a management interface reachable from the internet represents an immediate, exploitable risk. Default credentials are well-known and can be used by attackers to gain full administrative control over the device, often leading to a complete compromise of the network. In contrast, the other findings have compensating controls (no network access) or lower impact (outdated browser plug-in), making them lower priority in a risk-based remediation strategy.

Exam trap

The trap here is that candidates focus solely on the severity label (high vs. medium vs. low) without considering the compensating controls or exposure, leading them to incorrectly rank the missing patch or outdated plug-in as higher priority.

How to eliminate wrong answers

Option A is wrong because the lab VM has no network access, which means the missing patch cannot be exploited remotely; the risk is contained and can be remediated later. Option B is wrong because an outdated browser plug-in on a visitor kiosk is low severity and typically has limited attack surface (e.g., no saved credentials, restricted user privileges), so it does not pose an immediate threat compared to an internet-exposed default credential. Option D is wrong because not all findings have the same priority; risk severity is determined by both the vulnerability's severity and the exposure/impact, and the high-severity default credential with internet exposure clearly outweighs the others.

Full explanation →

854

MCQhard

A facilities manager receives an SMS from "FedEx Delivery" saying a shipment for the research lab cannot clear security until the recipient verifies the package by signing in. The message includes the manager's initials and the warehouse code, and the link opens a cloned sign-in page. Which attack is most likely?

A.Smishing, because the attacker is using a text message to deliver a targeted credential lure.

B.Vishing, because the attacker is pretending to be a delivery service representative.

C.Spear phishing, because the message is targeted using the recipient's role and location.

D.Baiting, because the message offers a shipment verification reward to encourage action.

AnswerA

Smishing is the best answer because the attack arrives by SMS and is designed to push the victim to a fake login page. The personalized details make it more convincing, but the defining factor is the text-message delivery channel combined with credential harvesting. This is a common real-world approach for bypassing inbox filtering and exploiting mobile trust.

Why this answer

Smishing is a social engineering attack that uses SMS (Short Message Service) to deliver a fraudulent message designed to trick the recipient into revealing sensitive information. In this scenario, the attacker sends a text message impersonating FedEx, includes the manager's initials and warehouse code for personalization, and provides a link to a cloned sign-in page, which is the classic credential-harvesting mechanism of a smishing attack.

Exam trap

The trap here is that candidates confuse the targeted nature of the message (which suggests spear phishing) with the delivery vector (SMS), but the exam specifically tests the distinction between phishing subtypes based on the communication channel used.

How to eliminate wrong answers

Option B is wrong because vishing (voice phishing) involves a phone call, not an SMS text message; the attack described uses a text message with a link, not a voice call. Option C is wrong because spear phishing is a form of email-based phishing that targets a specific individual or organization; while the message is targeted, the delivery method is SMS, not email, making smishing the more precise classification.

Full explanation →

855

MCQmedium

Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?

A.Move every device into a single flat subnet so internal routing is simpler.

B.Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.

C.Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.

D.Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.

AnswerB

Separating device classes into distinct VLANs creates clear trust boundaries and limits what a compromised endpoint can reach. Inter-VLAN ACLs or firewall rules can then enforce only the necessary traffic paths, such as management or service traffic. This reduces lateral movement from a workstation to sensitive building systems like cameras and badge readers.

Why this answer

Segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.

Exam trap

The trap here is that candidates often think antivirus or a flat network simplifies management, but the SY0-701 exam specifically tests the principle of network segmentation to contain lateral movement, not just endpoint protection or network simplicity.

How to eliminate wrong answers

Option A is wrong because a single flat subnet removes all network segmentation, allowing any compromised endpoint to directly communicate with any other device (including building systems) via Layer 2 broadcast or unicast, which maximizes lateral movement risk. Option C is wrong because relying solely on antivirus on workstations does not block network-level access to cameras; antivirus is a host-based detection tool that cannot prevent a compromised workstation from sending malicious traffic to other IP addresses on the same subnet. Option D is wrong because putting all traffic through the guest Wi-Fi VLAN would isolate it from the corporate network, but it would also isolate building systems from necessary management traffic and does not provide granular segmentation between different device types; it also introduces performance and policy issues for non-Wi-Fi devices.

Full explanation →

856

MCQmedium

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

A.A stateless network ACL that allows inbound traffic from the ALB's subnet only.

B.A stateful security group that allows inbound traffic from the ALB's security group only.

C.A web application firewall (WAF) that inspects all traffic for SQL injection.

D.A host-based firewall on each web server that allows traffic from the ALB's private IP address.

AnswerB

Correct. Security groups are stateful and can use another security group as a source. This configuration cleanly allows only traffic originating from the ALB, automatically handles return traffic, and is the recommended cloud-native approach for controlling instance-level access.

Why this answer

A stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.

Exam trap

The trap here is that candidates often confuse stateless network ACLs with stateful security groups, assuming a subnet-based ACL is sufficient, but they overlook that ACLs cannot filter by security group and require bidirectional rule management, making them unsuitable for this precise ALB-only access requirement.

Why the other options are wrong

A WAF inspects application-layer traffic for threats like SQL injection, but it does not restrict traffic sources. The requirement is to limit inbound traffic to only the ALB, which is a network access control, not a web application firewall function.

Using the ALB's private IP address is not scalable because the ALB's IP can change (e.g., after scaling or replacement), and it does not leverage the cloud provider's native security group reference, which automatically tracks the ALB's IP changes.

When would these options actually be correct?

A WAF would be correct if the question asked for a security control to protect the web application from common web exploits (e.g., SQL injection, XSS) at the application layer, without specifying source IP restrictions.

A host-based firewall would be correct if the cloud provider does not support security group references (e.g., in a non-cloud environment) or if the requirement is to allow traffic from a specific static IP address that is guaranteed not to change.

Why candidates pick the wrong answer

Candidates may confuse a WAF's ability to filter malicious traffic with network access control, or they may think a WAF can replace network-level restrictions because it inspects all incoming traffic.

Candidates may think that specifying the ALB's private IP is a precise way to restrict traffic, not realizing that cloud ALBs can have dynamic IPs and that security groups offer a more robust, managed solution.

Full explanation →

857

MCQmedium

A resolver log shows multiple clients querying the correct internal host name, but the DNS server starts returning an unexpected public IP address after a burst of unsolicited DNS responses from outside the network. Users are sent to a lookalike login page. What type of attack is most likely occurring?

A.DNS poisoning

B.Brute-force authentication

C.Port scanning

D.Packet sniffing

AnswerA

DNS poisoning directly corrupts the name resolution process: an attacker either forges a DNS response that arrives before the legitimate answer or tampers with a resolver's cache, causing it to return a fraudulent IP address for a valid domain. This matches the scenario exactly because multiple clients querying the correct record will all receive the malicious answer and be redirected to the counterfeit website, while the resolver log simply shows normal queries.

Why this answer

The scenario describes a DNS poisoning (also known as DNS cache poisoning) attack. The burst of unsolicited DNS responses from outside the network is the attacker injecting forged DNS records into the resolver's cache, causing it to map the correct internal host name to an unexpected public IP address. This redirects users to a lookalike login page, which is the classic outcome of DNS poisoning.

Exam trap

The trap here is that candidates may confuse DNS poisoning with packet sniffing because both involve network traffic, but only DNS poisoning actively modifies cached resolution data to redirect users.

How to eliminate wrong answers

Option B is wrong because brute-force authentication involves repeatedly trying passwords against a login interface, not manipulating DNS responses to redirect traffic. Option C is wrong because port scanning is used to discover open ports on a target system, not to alter DNS resolution or redirect users to a fake site. Option D is wrong because packet sniffing passively captures network traffic for analysis, but it does not inject forged DNS responses or modify the resolver's cache.

Full explanation →

858

MCQhard

Based on the exhibit, which access change best follows least privilege while still allowing the help desk to complete the task?

A.Add helpdesk_27 to Domain_Admin for seven days, since the request is urgent and time-limited.

B.Use a shared administrator password so the technician can finish the ticket without changing group memberships.

C.Grant helpdesk_27 the Helpdesk_Admin role for the ticket and remove it after completion.

D.Ask the user's manager to perform the reset manually so the help desk does not need additional access.

AnswerC

Granting the narrower Helpdesk_Admin role is the best least-privilege choice because it gives the technician only the permissions needed to unlock the account and reset MFA. The role is specific to the job function and can be removed after the ticket is complete. That limits exposure while still allowing the work to be finished efficiently.

Why this answer

It implements Role-Based Access Control (RBAC) by granting the help desk technician a temporary, ticket-specific role (Helpdesk_Admin) that provides just enough privileges to perform the password reset without granting broader administrative rights. This follows the principle of least privilege by limiting the elevated access to the exact scope and duration needed, and the role can be automatically revoked after the ticket is closed, minimizing the attack surface.

Exam trap

The trap here is that candidates may choose Option A because it appears to limit the duration of elevated access, but they overlook that Domain_Admin membership provides far more privileges than needed for a single password reset, violating the core principle of least privilege.

How to eliminate wrong answers

Option A is wrong because adding helpdesk_27 to Domain_Admin grants full domain administrative privileges, which far exceed what is needed for a single password reset and violates least privilege by providing persistent, overly broad access even if time-limited. Option B is wrong because using a shared administrator password violates the principle of non-repudiation (no individual accountability) and introduces a shared credential security risk, as all actions would be attributed to the shared account rather than the specific technician. Option D is wrong because it bypasses the help desk's role entirely and places an operational burden on the user's manager, which is inefficient, not scalable, and does not address the need for the help desk to have appropriate access to perform their job function.

Full explanation →

859

MCQmedium

A company portal lets employees save a short profile bio. One employee enters a string containing script code, and later other users who view that profile are redirected to a fake sign-in page. What vulnerability best explains this behavior?

A.Reflected cross-site scripting, because the payload only appears in the current request response.

B.Stored cross-site scripting, because the malicious script is saved and served to other users later.

C.Command injection, because the script runs inside the web server process.

D.Session fixation, because the attacker wants the victim to use an old session ID.

AnswerB

Stored XSS occurs when malicious script is persisted by the application, such as in a profile field, comment, or message. Every user who later loads the page receives the harmful content. The redirection to a fake sign-in page shows that the script is executing in other users’ browsers, which makes this a stored, not reflected, attack. Proper output encoding and input handling are needed to prevent it.

Why this answer

The employee's profile bio is saved to the server and later served to other users who view the profile. This is the defining characteristic of stored (persistent) cross-site scripting (XSS): the malicious script is permanently stored on the target server and executed in the browsers of other users when they retrieve the stored data.

Exam trap

The trap here is confusing stored XSS with reflected XSS by focusing on the 'current request' aspect rather than recognizing that the payload is saved and served to other users later, which is the key differentiator.

How to eliminate wrong answers

Option A is wrong because reflected XSS requires the payload to be part of the current request (e.g., in a URL parameter or form input) and is not permanently stored; it only affects the user who submits the request. Option C is wrong because command injection targets the server-side operating system by injecting system commands (e.g., via shell metacharacters like ';' or '|'), not client-side script execution in a browser.

Full explanation →

860

MCQmedium

A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?

A.Least privilege

B.Defense in depth

C.Separation of duties

D.Zero trust

AnswerB

Correct. The design uses network segmentation, firewalls, and encryption to create multiple layers of defense. This is the core concept of defense in depth, ensuring that a failure in one layer does not compromise the entire system.

Why this answer

The design enforces defense in depth by layering multiple security controls: a DMZ isolates public-facing web servers from internal networks, a stateful firewall restricts inbound traffic to HTTP/HTTPS only, and outbound connections from web servers to internal application servers are limited to a specific TCP port with TLS encryption. This layered approach ensures that even if one control fails (e.g., a web server is compromised), the attacker still faces additional barriers to reach sensitive internal systems.

Exam trap

The trap here is that candidates confuse 'defense in depth' with 'least privilege' because both involve restricting access, but defense in depth specifically refers to multiple overlapping security layers (network segmentation, firewalls, encryption) rather than minimal permissions for a single component.

Why the other options are wrong

The design restricts web servers to only initiate outbound connections to internal servers on a specific port, which is an example of least privilege, but the question asks for the primary principle. The overall architecture with multiple layers (DMZ, separate network, firewall rules, TLS) is defense in depth, not just least privilege.

The design does not separate duties among different people or roles; it separates network segments and controls traffic, which is about defense in depth, not separation of duties.

The design explicitly uses multiple layers of security (DMZ, separate internal segment, stateful firewall, TLS encryption), which is defense in depth, not zero trust. Zero trust would require continuous verification of every request regardless of network location, which is not described.

When would these options actually be correct?

A question that asks: 'A security policy states that web servers should only be able to communicate with database servers on TCP port 3306 and no other traffic. Which principle is being applied?' Here, the focus is solely on restricting permissions to the minimum necessary, making least privilege the correct answer.

In a scenario where different administrators are responsible for managing web servers versus internal application servers, and policies ensure that no single person has access to both environments, separation of duties would be the correct principle.

A question describing a network architecture where no implicit trust is granted based on network location, every access request is authenticated and authorized regardless of source (e.g., all traffic between internal servers must be authenticated and encrypted, with micro-segmentation enforced).

Why candidates pick the wrong answer

Candidates see the firewall rule that permits only specific outbound connections and mistakenly think that is the core principle, overlooking that the question emphasizes the layered security approach (DMZ, segmentation, encryption) which is defense in depth.

Candidates may confuse 'separation of duties' with 'network segmentation' because both involve dividing resources, but separation of duties specifically refers to dividing responsibilities among people to prevent fraud or error.

Candidates may mistakenly think that restricting traffic between segments and requiring encryption aligns with zero trust, but zero trust is a broader model that includes continuous verification and least privilege, not just network segmentation.

Full explanation →

861

MCQmedium

After a ransomware event, the team restores a file server from backup, but management wants proof that the restore process will work before the backups are declared trusted. What should be done next?

A.Delete the old backup copies to prevent future confusion

B.Perform a test restore in an isolated environment and verify the recovered data

C.Switch to incremental backups only so the next restore is faster

D.Store the backups on the same file server so they are easier to access

AnswerB

A test restore is the best way to validate backup integrity and operational readiness after an incident. Restoring in isolation confirms that the backup can be used successfully without risking production systems. Verification should include checking file integrity, application access if relevant, and whether the restored data meets recovery objectives. This provides evidence that backups remain trustworthy after ransomware.

Why this answer

The only way to prove that backups are trustworthy is to perform a test restore in an isolated environment, verifying the integrity and completeness of the recovered data. This validates that the backup process, media, and software are functioning correctly without risking the production environment. Without a successful test restore, the team cannot confirm that the backups are free from corruption, encryption, or other issues that would prevent a real recovery.

Exam trap

The trap here is that candidates may think simply having backups is sufficient proof of recoverability, but the exam emphasizes that only a successful test restore in an isolated environment can validate the backup's integrity and the restore process itself.

How to eliminate wrong answers

Option A is wrong because deleting old backup copies does not prove the restore process works and actually removes potentially valuable recovery points, violating the 3-2-1 backup rule. Option C is wrong because switching to incremental backups only does not validate the current restore process; it changes the backup strategy without addressing the need for proof of recoverability, and incremental backups actually require a full backup chain to restore, increasing complexity. Option D is wrong because storing backups on the same file server violates the fundamental principle of backup isolation, making them vulnerable to the same ransomware attack that encrypted the original data, and it does not test the restore process at all.

Full explanation →

862

MCQmedium

A cloud-hosted API lets users supply a URL for the service to fetch an image. Shortly after release, logs show requests to 169.254.169.254 and internal admin addresses. What control best reduces this risk?

A.Allow the API to follow any redirect so it works with more image sources.

B.Restrict outbound requests to an allowlist and block internal address ranges.

C.Store the fetched image in encrypted form before sending it to users.

D.Increase the session timeout to reduce repeated logins by legitimate users.

AnswerB

This is a classic server-side request forgery pattern: the server is making attacker-influenced requests to internal or metadata addresses. An allowlist of approved destinations, combined with blocking private and link-local ranges, prevents the service from being used as a proxy into internal systems. That control directly targets the unsafe outbound request behavior and is more effective than trying to clean malicious URLs after the fact. It also reduces exposure to cloud metadata theft and internal service probing.

Why this answer

Restricting outbound requests to an allowlist and blocking internal address ranges directly mitigates the Server-Side Request Forgery (SSRF) vulnerability. The requests to 169.254.169.254 (the AWS/GCP/Azure metadata endpoint) and internal admin addresses indicate an attacker is using the API to probe internal services. An allowlist ensures the API only connects to trusted external hosts, while blocking private and link-local ranges prevents access to internal infrastructure.

Exam trap

The trap here is that candidates may confuse data-at-rest protection (encryption) with access control, or mistakenly think allowing redirects improves functionality without realizing it exacerbates SSRF; The SY0-701 exam often tests the specific cloud metadata endpoint (169.254.169.254) as a classic SSRF indicator.

How to eliminate wrong answers

Option A is wrong because allowing the API to follow any redirect would actually increase the SSRF risk, as an attacker could craft a redirect from an allowed external URL to an internal or metadata endpoint, bypassing initial URL checks. Option C is wrong because storing the fetched image in encrypted form does not prevent the API from making unauthorized requests to internal or metadata endpoints; encryption protects data at rest, not the request origin or destination.

Full explanation →

863

MCQhard

A stateless firewall sits between a DMZ subnet 10.10.10.0/24 and an internal subnet 10.10.20.0/24. Only the web server at 10.10.10.25 should be allowed to initiate TCP sessions to the app server at 10.10.20.20 on port 8443. All other DMZ-to-internal traffic must remain blocked. Which ACL entry is the best fit on the DMZ-facing interface?

A.deny tcp 10.10.10.0/24 10.10.20.0/24 eq 8443 followed by permit ip any any

B.permit tcp host 10.10.10.25 host 10.10.20.20 eq 8443 followed by deny ip any any

C.permit tcp host 10.10.20.20 host 10.10.10.25 eq 8443 followed by deny ip any any

D.permit ip 10.10.10.0/24 10.10.20.0/24 followed by deny ip any any

AnswerB

This rule is the least-privilege match for the stated requirement. It allows only the specific source host, destination host, and destination port needed for the application flow, while the explicit deny blocks all remaining DMZ-to-internal traffic on that interface. Because the firewall is stateless, narrowing the source and destination at the entry point is the safest way to prevent unintended exposure.

Why this answer

It explicitly permits only the web server at 10.10.10.25 to initiate TCP sessions to the app server at 10.10.20.20 on port 8443, then denies all other traffic. Since the firewall is stateless, it cannot track session state, so the ACL must be applied on the DMZ-facing interface to control outbound-initiated traffic from the DMZ to the internal subnet. The permit statement uses the 'host' keyword for precise source and destination, followed by an explicit deny all to block any other DMZ-to-internal traffic.

Exam trap

The trap here is that candidates often reverse the source and destination in the permit statement (as in Option C), mistakenly thinking the ACL should allow the app server to respond, rather than correctly permitting the web server to initiate the connection from the DMZ to the internal subnet.

How to eliminate wrong answers

Option A is wrong because it denies the specific traffic (TCP from 10.10.10.0/24 to 10.10.20.0/24 on port 8443) that should be permitted, and then permits all other traffic, which would allow unauthorized DMZ hosts to reach the internal subnet. Option C is wrong because it reverses the source and destination, permitting the app server at 10.10.20.20 to initiate sessions to the web server on port 8443, which violates the requirement that only the web server should initiate the connection. Option D is wrong because it permits all IP traffic from the entire DMZ subnet to the internal subnet, which would allow any DMZ host to reach any internal host, completely bypassing the restriction to only the web server and only on port 8443.

Full explanation →

864

MCQeasy

A new SIEM rule generates many alerts from a scheduled backup job that is known to be legitimate. What should the analyst do to improve alert quality?

A.Disable all logging for the backup server.

B.Tune the rule to exclude the known backup activity pattern.

C.Ignore the alerts permanently because the job is approved.

D.Reimage the backup server to stop the alerts.

AnswerB

Alert tuning should reduce false positives without losing useful detection. If the backup job is documented and legitimate, the analyst can adjust the rule to exclude that approved activity pattern or server. This keeps the SIEM useful and helps responders focus on real suspicious behavior instead of repeated harmless alerts.

Why this answer

Tuning the SIEM rule to exclude the known backup activity pattern reduces false positives while preserving detection of actual threats. By creating an exception for the specific backup server's IP, schedule, or process hash, the analyst maintains visibility into anomalous behavior without being overwhelmed by noise.

Exam trap

The trap here is that candidates may choose to disable logging or ignore alerts, confusing operational convenience with proper security hygiene, when the correct approach is to refine detection logic through tuning.

How to eliminate wrong answers

Option A is wrong because disabling all logging for the backup server would create a blind spot, preventing detection of real threats like ransomware encrypting backup data or unauthorized access to backup files. Option C is wrong because ignoring alerts permanently violates security monitoring best practices and could allow a malicious actor to hide activity within the backup job's noise. Option D is wrong because reimaging the backup server is an extreme, unnecessary measure that does not address the root cause—the SIEM rule's lack of specificity—and would disrupt operations without solving the alert volume issue.

Full explanation →

865

MCQmedium

An organization is retiring a batch of laptops with SSDs. All of the systems used full-disk encryption and stored sensitive internal documents. What is the best action before the devices leave the company?

A.Run a quick format and remove the asset tags after the files are deleted.

B.Perform a cryptographic erase by destroying the encryption keys and document the sanitization process.

C.Degauss the SSDs and then store them in the disposal room until pickup.

D.Overwrite the drives once with random data and consider the devices ready for resale.

AnswerB

For encrypted SSDs, destroying the encryption keys is an effective and practical sanitization method because the data becomes unreadable even if the drive is later examined. This approach matches the media type and the fact that full-disk encryption was used. Proper documentation also supports accountability and compliance. It is stronger than merely deleting files or performing a superficial format, which may leave recoverable data behind.

Why this answer

A cryptographic erase (also known as a crypto-scrub) renders the encrypted data permanently inaccessible by securely destroying the encryption keys. Since the SSDs used full-disk encryption (FDE), the data is already encrypted at rest, and without the keys, the ciphertext is effectively unrecoverable. This method is fast, reliable, and compliant with sanitization standards like NIST SP 800-88, making it the best action before the devices leave the organization.

Exam trap

The trap here is that candidates often choose degaussing (Option C) for SSDs, mistakenly applying a technique that works only for magnetic media like HDDs, while ignoring that cryptographic erase is the proper and efficient method for encrypted solid-state drives.

How to eliminate wrong answers

Option A is wrong because a quick format only removes the file system pointers, not the actual data; the encrypted content remains on the SSD and could potentially be recovered if the encryption keys are still present. Option C is wrong because degaussing SSDs is ineffective—SSDs use flash memory that is not affected by magnetic fields, and degaussing can physically destroy the drive without guaranteeing data removal. Option D is wrong because overwriting SSDs with random data is unreliable due to wear-leveling and over-provisioning; the SSD firmware may remap bad blocks, leaving remnants of the original encrypted data intact.

Full explanation →

866

MCQmedium

A security analyst receives an automated alert indicating that a standard user account logged in from a geographic location that is unusual for the user, and the login occurred at 3:00 AM local time. The analyst has not yet verified whether this was a successful login or if any additional suspicious activity occurred. According to standard incident response procedures, what should the analyst do NEXT?

A.Disable the user account immediately and reset the password.

B.Conduct a full forensic analysis of the user's workstation.

C.Review the account's recent activity for signs of compromise.

D.Report the incident to law enforcement.

AnswerC

Reviewing recent activity (e.g., successful logins, file access, privilege escalation attempts) is the appropriate analysis step to validate the alert. This helps determine if the account is compromised and guides subsequent containment and eradication actions.

Why this answer

According to standard incident response procedures, after receiving an alert about unusual login activity, the analyst should first review the account's recent activity to determine whether the login was successful and if any compromise occurred. This is part of the identification/validation phase before taking containment actions.

Exam trap

SY0-701 often tests the order of incident response steps — candidates jump to containment (disable account) before validation, but the correct next step is always to verify and scope the incident first.

Why the other options are wrong

Disabling the account and resetting the password is premature because the analyst has not yet confirmed the login was successful or that any compromise occurred. Standard incident response procedures require initial triage and verification before taking containment actions.

Conducting a full forensic analysis of the user's workstation is premature at this stage because the alert only indicates an unusual login; the analyst has not yet verified if the login was successful or if any compromise occurred. Standard incident response procedures require initial triage and verification before escalating to forensic analysis.

Reporting to law enforcement is premature at this stage because the analyst has not yet verified if the login was successful or if any malicious activity occurred. Standard incident response procedures require initial triage and confirmation of a security incident before involving external authorities.

When would these options actually be correct?

This would be correct if the question stated that the account had been confirmed compromised (e.g., multiple failed logins followed by a successful login from an unusual location, and evidence of data exfiltration). In that scenario, immediate containment is necessary to prevent further damage.

This option would be correct in a scenario where the analyst has already confirmed that the user's account was compromised and malicious activity has been detected on the workstation, such as unauthorized file access or malware execution. The question would state that the incident is confirmed and requires in-depth investigation.

This option would be correct if the question stated that the analyst has already confirmed a successful breach involving sensitive data exfiltration or a ransomware attack, and the organization's policy mandates immediate law enforcement notification as part of the incident response plan.

Why candidates pick the wrong answer

Candidates may think that any suspicious login warrants immediate account disablement as a precaution, but they overlook the need to first verify the alert and gather context to avoid unnecessary disruption.

Candidates may think that any suspicious login warrants immediate deep investigation, confusing the urgency of the alert with the need for forensic analysis, rather than following a step-by-step incident response process.

Candidates may think that any unusual login activity, especially from a foreign location, automatically constitutes a crime that must be reported to law enforcement, overlooking the need for verification and internal escalation first.

Full explanation →

867

MCQeasy

A business wants to keep operating even if a supplier-related loss occurs, so it purchases cyber insurance to offset possible costs. Which risk treatment is being used?

A.Avoidance, because the company is eliminating the supplier relationship

B.Mitigation, because insurance removes the risk before it happens

C.Acceptance, because the company is doing nothing about the exposure

D.Transfer, because some financial impact is shifted to another party

AnswerD

This is a textbook risk transfer: the business keeps the supplier and the process but shifts the financial consequences of certain losses to the insurance company via premium payments. The underlying risk (e.g., supplier failure) still exists, but the monetary impact is substantially borne by the insurer, subject to policy terms. Transfer best describes this balance of retaining operational activity while offloading financial risk.

Why this answer

Purchasing cyber insurance transfers the financial risk of a supplier-related loss to the insurance company. This is a classic risk transfer strategy, where the business does not eliminate or reduce the likelihood of the loss but shifts the financial impact to another party via a contractual agreement.

Exam trap

The trap here is confusing risk transfer (shifting financial impact) with risk mitigation (reducing likelihood or impact), leading candidates to incorrectly select mitigation when insurance is involved.

How to eliminate wrong answers

Option A is wrong because avoidance would mean terminating the supplier relationship entirely, not purchasing insurance. Option B is wrong because mitigation involves implementing controls (e.g., firewalls, redundancy) to reduce the likelihood or impact of a risk, not transferring it via insurance. Option C is wrong because acceptance means acknowledging the risk without taking any action, whereas purchasing insurance is an active treatment.

Full explanation →

868

Multi-Selecthard

A SIEM report shows this sequence over 25 minutes: the same public IP submitted one failed password attempt against 53 different accounts, then one account successfully authenticated, created an inbox forwarding rule, and downloaded hundreds of messages through the web portal. Which two conclusions are best supported? Select two.

Select 2 answers

A.The pattern is consistent with a password spraying attack.

B.The attacker is performing a brute-force attack against one account.

C.The activity is most likely credential stuffing with multiple known password pairs.

D.The successful account is likely compromised and being used for persistence or mailbox abuse.

E.The events primarily indicate a denial-of-service attack against the mail system.

AnswersA, D

Password spraying is a low-and-slow attack where an adversary tries a small set of common passwords against many accounts, usually one attempt per account per pass to avoid triggering lockout policies. The SIEM sequence of repeated single failed logins across different users from the same source IP over 25 minutes matches this pattern exactly: no individual account is hammered, yet the cumulative authentication attempt volume is high. The eventual successful login indicates that at least one account was using a weak, predictable password that the attacker had guessed in the spraying cycle.

Why this answer

The SIEM shows a single public IP attempting one failed password against 53 different accounts over 25 minutes. This pattern—low-and-slow, one attempt per account—is the hallmark of a password spraying attack, which avoids account lockout thresholds by never hitting the same account repeatedly. The subsequent successful authentication and mailbox abuse confirm the attacker found a weak password for one account.

Exam trap

The trap here is confusing password spraying (one password, many accounts) with brute-force (many passwords, one account) or credential stuffing (many known pairs), leading candidates to pick B or C despite the single-IP, single-attempt-per-account pattern.

Full explanation →

869

MCQeasy

A security team wants every company laptop to have the same screen-lock timeout, disk encryption setting, and local firewall configuration. Which type of document should define these mandatory settings?

A.A guideline, because employees can decide whether to follow it.

B.A standard, because it specifies mandatory technical requirements.

C.A risk register, because it tracks all security vulnerabilities on laptops.

D.A business impact analysis, because it identifies the most important laptop functions.

AnswerB

A standard is the correct document for mandatory, measurable security settings such as screen-lock timeouts, encryption, and firewall configuration. Standards turn policy intent into specific requirements that can be checked and enforced across devices, which helps keep configurations consistent and easier to audit.

Why this answer

A standard is the correct document type because it defines mandatory technical requirements that must be uniformly enforced across all company laptops. In this scenario, the screen-lock timeout, disk encryption setting (e.g., BitLocker or FileVault), and local firewall configuration (e.g., Windows Defender Firewall with Advanced Security) are non-negotiable controls that must be applied identically to every device to meet security policy. Standards are binding and often reference specific configuration baselines, such as CIS Benchmarks or NIST SP 800-53, ensuring consistent implementation.

Exam trap

The trap here is confusing a standard with a guideline, as many candidates assume any security document is advisory, but standards are explicitly mandatory and enforceable, unlike guidelines which are optional recommendations.

How to eliminate wrong answers

Option A is wrong because a guideline is advisory and suggests best practices that employees may choose to follow or ignore, whereas the scenario requires mandatory settings that must be enforced. Option C is wrong because a risk register is a document that identifies, assesses, and tracks security vulnerabilities and risks, not a document that defines mandatory technical configurations for laptops. Option D is wrong because a business impact analysis (BIA) identifies critical business functions and the impact of their disruption, not the specific technical settings like screen-lock timeout or disk encryption.

Full explanation →

870

MCQeasy

Employees must sign in to several cloud applications with their corporate account, and terminated users should lose access without separate password resets in each app. What is the best solution?

A.Create a separate local username and password in every cloud application.

B.Use federation with single sign-on from a central identity provider.

C.Store the same shared password in a password manager for all applications.

D.Allow each application to authenticate users only by device MAC address.

AnswerB

Federation with SSO is the best option because employees authenticate once with the corporate identity provider and then access multiple applications through trusted token exchange. This reduces password sprawl, improves user convenience, and makes offboarding faster because disabling the central account removes access across connected services. It also supports stronger controls such as MFA at the identity provider rather than repeating them in every application.

Why this answer

Federation with single sign-on (SSO) from a central identity provider (IdP) allows users to authenticate once using their corporate account, and the IdP issues security tokens (e.g., SAML assertions or OIDC tokens) that each cloud application trusts. When a user is terminated, the administrator disables the account in the IdP, and all applications immediately reject the user's tokens, eliminating the need for separate password resets in each app.

Exam trap

The trap here is that candidates confuse password managers (which store credentials but do not provide centralized revocation) with federation, or they mistakenly think MAC address authentication is viable for cloud applications, when in fact MAC addresses are link-layer identifiers not usable over the internet.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and passwords in every cloud application violates the requirement for centralized access control and would require manual password resets in each app upon termination. Option C is wrong because storing the same shared password in a password manager does not provide centralized revocation; the password would still need to be changed in every application individually to block access. Option D is wrong because authenticating by device MAC address is not feasible for cloud applications (MAC addresses are not transmitted over the internet) and does not support user-level identity or termination.

Full explanation →

871

MCQmedium

A legal department needs a contract file that can later prove who signed it and whether the content changed after signing. Which cryptographic mechanism should be used?

A.Digital signature

B.Symmetric encryption

C.Hashing

D.Tokenization

AnswerA

A digital signature applies asymmetric cryptography: the signer's private key encrypts a hash of the document, and the corresponding public key verifies that the hash came from that signer and the document is unchanged. This binds the contract irrevocably to the specific signer, providing authentication, integrity, and non-repudiation. It is precisely the mechanism legal departments need to ensure a contract is legally enforceable and attributable.

Why this answer

A digital signature provides non-repudiation, ensuring the signer cannot deny signing the document, and integrity, detecting any changes after signing. It uses asymmetric cryptography where the signer's private key creates the signature, and the public key verifies it, making it the correct choice for proving both identity and content integrity.

Exam trap

The trap here is that candidates confuse hashing (which provides integrity) with digital signatures (which provide both integrity and non-repudiation), leading them to pick hashing when the question explicitly requires proof of who signed it.

How to eliminate wrong answers

Option B is wrong because symmetric encryption only provides confidentiality (secrecy) of the contract file, not proof of who signed it or integrity verification; it uses a shared key that cannot uniquely tie a signature to an individual. Option C is wrong because hashing only provides integrity by producing a fixed-size hash of the content, but it does not prove who signed it or offer non-repudiation; anyone can compute the same hash. Option D is wrong because tokenization replaces sensitive data with a non-sensitive placeholder (token) for data protection, typically for payment or PII, and does not provide signing proof or integrity verification.

Full explanation →

872

MCQeasy

Based on the exhibit, what should the analyst do next to limit the impact of the suspected compromise?

A.Run a full antivirus scan first and wait for the results before taking any other action.

B.Isolate FIN-LT-22 from the network to contain the suspected malware activity.

C.Reboot the laptop to clear the malicious process from memory.

D.Reset the user's password and close the ticket after confirming they can log in again.

AnswerB

Network isolation is the best immediate containment step when an endpoint shows signs of active malicious behavior. It limits further command-and-control traffic, prevents lateral movement, and buys time for investigation. In incident response, containment comes before eradication and recovery when the threat is still active.

Why this answer

Isolating FIN-LT-22 from the network immediately stops the suspected malware from communicating with command-and-control servers or spreading laterally to other hosts. This containment step aligns with the NIST incident response framework's containment phase, which prioritizes limiting damage before eradication or recovery. In a suspected compromise, network isolation (e.g., disabling the switch port or using a host-based firewall rule) is the fastest way to cut off malicious traffic without destroying volatile evidence in memory.

Exam trap

The trap here is that candidates often choose to run an antivirus scan first (Option A) because they assume detection must precede containment, but the SY0-701 exam emphasizes that containment is the immediate priority to limit impact, even before identifying the specific malware.

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan first wastes critical time and may alert the attacker or trigger destructive actions before containment; antivirus also relies on signatures and may miss unknown malware. Option C is wrong because rebooting clears volatile memory (RAM), destroying evidence of the malicious process and potentially allowing persistence mechanisms to re-establish on startup, which violates forensic best practices. Option D is wrong because resetting the user's password does not address the active malware on the endpoint; the attacker could still maintain access via a backdoor or keylogger, and closing the ticket prematurely ignores the need for containment and eradication.

Full explanation →

873

MCQhard

Based on the exhibit, what is the best improvement to reduce the impact if one backup server is compromised?

A.Keep the same key file but rename it so attackers cannot find it easily.

B.Replace AES with SHA-256 so the backups are harder to read.

C.Store encryption keys in a centralized KMS or HSM and use distinct keys with rotation.

D.Email the key file to backup operators so they can restore data quickly.

AnswerC

This is the best improvement because the current design places the same key on every backup server, creating a large blast radius if one host is compromised. Centralized key management through a KMS or HSM improves control, auditing, rotation, and separation of duties. Distinct keys also limit how much data exposure results from one server compromise.

Why this answer

Using a centralized Key Management System (KMS) or Hardware Security Module (HSM) with distinct, rotated keys ensures that compromising one backup server does not expose the encryption keys for all backups. This isolates the impact to only the data encrypted with that specific key, and key rotation further limits the window of exposure. In contrast, sharing a single key file across servers creates a single point of failure, as compromising one server reveals the key for all backups.

Exam trap

The trap here is that candidates may think renaming or hiding the key file (Option A) is a valid security measure, but CompTIA tests the principle that security through obscurity (hiding files) is not a substitute for proper key management and isolation.

How to eliminate wrong answers

Option A is wrong because renaming the key file does not change the underlying cryptographic material; an attacker who compromises the server can still locate and use the key file regardless of its name, as file enumeration or registry searches can find it. Option B is wrong because SHA-256 is a hashing algorithm, not an encryption algorithm; it is one-way and cannot be used to encrypt or decrypt backups, making backups unrecoverable. Option D is wrong because emailing the key file to backup operators exposes the key in transit and at rest in email systems, violating security best practices and increasing the risk of interception or unauthorized access.

Full explanation →

874

MCQhard

Based on the exhibit, what should the administrator do next?

A.Install the update because a longer hash means the file is newer.

B.Re-download the update from the trusted source and verify the hash again.

C.Rename the file to match the vendor’s naming convention and retry installation.

D.Disable SHA-256 verification because patch files often change after download.

AnswerB

A hash mismatch means the local file does not match the vendor-published value. The safest next step is to obtain a fresh copy from a trusted source and compare the hash again. That helps determine whether the original download was corrupted in transit or tampered with before deployment.

Why this answer

If the hash of a downloaded file does not match the vendor-published hash, the file is likely corrupted or tampered with. The administrator should delete the corrupted file, re-download it from the trusted source, and recompute the hash to ensure integrity before installation. This follows the principle of verifying file integrity via cryptographic hashing (e.g., SHA-256) before applying updates.

Exam trap

The trap here is confusing hash length or file naming with file integrity, leading candidates to think a longer hash means a newer file or that renaming fixes hash mismatches, when in fact only re-downloading and re-verifying the hash ensures the file is authentic and uncorrupted.

How to eliminate wrong answers

Option A is wrong because hash length (e.g., SHA-256 vs SHA-512) is unrelated to file version or freshness; a longer hash does not indicate a newer file. Option C is wrong because renaming a file does not change its content or hash, so it will not resolve a hash mismatch. Option D is wrong because disabling SHA-256 verification would bypass integrity checks, allowing potentially malicious or corrupted files to be installed, which violates security best practices.

Full explanation →

875

MCQmedium

A security analyst is reviewing authentication logs and observes multiple failed login attempts for a single user account occurring within a short timeframe, followed by a successful login from an IP address located in a country where the user has never traveled. The failed attempts originate from various IP addresses and use different passwords. Which type of attack has most likely occurred?

A.Brute-force attack

B.Credential stuffing

C.Password spraying

D.Dictionary attack

AnswerA

Correct. A brute-force attack is characterized by systematically trying many different passwords against a single account until the correct one is found. The log pattern of multiple failed attempts followed by a success aligns with this method.

Why this answer

(Brute-force attack) because the log shows multiple failed login attempts from various IP addresses using different passwords, followed by a successful login from an unfamiliar country. This pattern indicates a distributed brute-force attack where the attacker systematically tries many passwords against a single account, often using a botnet or proxy rotation to evade IP-based rate limiting. The successful login from a foreign IP confirms the attacker eventually guessed the correct password.

Exam trap

The trap here is that candidates confuse 'multiple failed attempts from various IPs' with credential stuffing, but the key differentiator is that credential stuffing uses known credential pairs, not systematically generated passwords against a single account.

Why the other options are wrong

Credential stuffing uses previously breached username/password pairs from other services, but the question states the failed attempts used different passwords, not reused credentials from breaches.

Password spraying involves trying a single common password against many user accounts, not multiple passwords against a single account as described in the question.

A dictionary attack uses a predefined list of likely passwords (e.g., common words or variations) against a single account, but the question describes failed attempts with 'different passwords' from various IPs, which is more consistent with a brute-force attack that systematically tries many passwords.

When would these options actually be correct?

A security analyst sees multiple failed logins with the same username but different passwords, and later a successful login from a known breached credential list; the question would specify that the successful login used a password found in a recent data breach.

Password spraying would be correct if the question described multiple failed login attempts using the same password (e.g., 'Password123') across many different user accounts, followed by a successful login from an unusual location.

A dictionary attack would be correct if the question stated that the attacker used a wordlist of common passwords (e.g., 'password123', 'admin') against a single account, and the failed attempts showed passwords from that list, not random or systematically generated ones.

Why candidates pick the wrong answer

Candidates may confuse any attack using multiple passwords with credential stuffing, not realizing that credential stuffing specifically relies on reused credentials from prior breaches, not random password attempts.

Candidates may confuse password spraying with brute-force because both involve multiple login attempts, but they fail to note that password spraying targets many accounts with one password, while this scenario targets one account with many passwords.

Candidates may confuse 'dictionary attack' with any attack that tries multiple passwords, but the key distinction is that dictionary attacks use a curated list of likely passwords, not exhaustive or random attempts.

Full explanation →

876

Drag & Dropmedium

Drag and drop the steps for the SSH key exchange process in the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

SSH key exchange establishes a secure channel; the server's host key is used to verify identity, and Diffie-Hellman generates a shared secret.

Full explanation →

877

MCQmedium

A software supplier used by your organization begins subcontracting a critical part of its service to an unknown hosting company. Which contractual control would BEST help manage this supply chain risk?

A.Require the supplier to send monthly sales updates to the procurement team.

B.Require advance notice and approval for subcontractor changes, plus right-to-audit and security obligations.

C.Ask the supplier to place all responsibility for the subcontractor on the customer.

D.Disable all vendor access immediately without reviewing the change.

AnswerB

This is the strongest contractual approach because it gives the organization visibility into changes, authority to review added risk, and leverage to enforce security requirements. When a supplier introduces a new subcontractor, advance notice, approval rights, and auditability help prevent hidden dependencies from undermining security expectations or compliance obligations.

Why this answer

It establishes a contractual control that requires the supplier to notify and obtain approval before subcontracting critical services, while also imposing right-to-audit and security obligations. This directly addresses supply chain risk by ensuring the organization can vet and monitor the subcontractor's security posture, as recommended by NIST SP 800-161 for supply chain risk management.

Exam trap

The trap here is that candidates confuse operational reporting (Option A) with security governance, or they assume immediate termination (Option D) is a valid risk response without considering contractual due process and business continuity.

How to eliminate wrong answers

Option A is wrong because monthly sales updates are a financial or operational reporting requirement, not a security control; they provide no visibility into the subcontractor's security practices or compliance with the organization's security policies. Option C is wrong because shifting all responsibility for the subcontractor to the customer defeats the purpose of contractual controls—it removes the supplier's accountability and leaves the organization without any enforceable security requirements on the subcontractor. Option D is wrong because immediately disabling all vendor access without reviewing the change is a reactive, disruptive response that violates change management best practices; it should be preceded by a risk assessment and coordinated with the supplier to avoid unnecessary service disruption.

Full explanation →

878

MCQmedium

Based on the exhibit, which action should the incident response team take next to eradicate the threat?

A.Return the workstation to the user since the outbound connection was blocked.

B.Delete only the scheduled task and reconnect the host to monitor for more alerts.

C.Reimage the endpoint from a known-good build and reset potentially exposed credentials.

D.Close the incident because memory capture has already preserved the evidence.

AnswerC

The logs show a likely malicious macro, encoded PowerShell, a dropped script, and persistence through a scheduled task. That combination indicates a high-confidence compromise with uncertain scope. Reimaging removes hidden persistence more reliably than piecemeal cleanup, and credential resets are appropriate because finance activity occurred on the device and credentials may have been captured.

Why this answer

The exhibit indicates a confirmed compromise (e.g., a scheduled task establishing outbound C2 traffic). Eradication requires removing all traces of the attacker's foothold, which is best achieved by reimaging the endpoint from a known-good build. Additionally, any credentials that may have been exposed during the compromise must be reset to prevent lateral movement or re-entry.

Exam trap

The trap here is that candidates may think deleting the scheduled task (Option B) is sufficient for eradication, but CompTIA emphasizes that any confirmed compromise requires full reimaging to ensure no hidden persistence remains.

How to eliminate wrong answers

Option A is wrong because simply returning the workstation to the user after blocking an outbound connection does not remove the underlying threat (e.g., the scheduled task or persistence mechanism) and assumes the attacker cannot adapt or use alternate C2 channels. Option B is wrong because deleting only the scheduled task leaves other potential persistence mechanisms (e.g., registry run keys, services, or WMI subscriptions) intact, and reconnecting the host without full remediation risks re-infection or continued attacker access. Option D is wrong because closing the incident after memory capture ignores the need for eradication; evidence preservation does not eliminate the active threat, and the host remains compromised.

Full explanation →

879

MCQmedium

A help desk team manages 300 Windows laptops. A legacy accounting app sometimes fails after updates, so the company wants to reduce patch risk while still preventing long-term exposure. Which patching strategy is the best balance?

A.Apply updates manually to each laptop as soon as they are released.

B.Use a pilot group and phased rollout process before wider deployment.

C.Postpone all updates until the legacy accounting app is replaced.

D.Disable automatic updates permanently and patch only after a security incident.

AnswerB

A pilot-to-broad rollout strategy lets the organization validate patches on a small set of representative devices before deploying them widely. That reduces the chance of a widespread compatibility problem while still keeping systems updated on a reasonable schedule. It is a practical balance between security, reliability, and operational risk.

Why this answer

A pilot group with phased rollout lets the team validate patches against the legacy accounting app on a small subset before broad deployment, catching compatibility regressions while still meeting patch SLAs. This balances availability risk against the security risk of unpatched systems.

Exam trap

SY0-701 often tests the false dichotomy that you must choose between 'patch immediately' and 'never patch' — the correct answer is almost always a risk-balanced phased approach.

How to eliminate wrong answers

Option A is wrong because applying updates immediately to all 300 laptops with no validation maximizes the chance of breaking the legacy app and creating a widespread outage. Option C is wrong because postponing all updates until the app is replaced leaves the fleet exposed to known exploited vulnerabilities for an indefinite period. Option D is wrong because disabling updates permanently and patching only after an incident is purely reactive and guarantees compromise before remediation.

Full explanation →

880

MCQeasy

A company laptop is collected as evidence in a suspected theft case. Which action best supports chain of custody?

A.Place the laptop on a desk until the investigator is available.

B.Record each transfer with date, time, handler name, and signatures.

C.Reset the laptop so the legal team can access it more easily.

D.Remove the hard drive and connect it to a personal workstation.

AnswerB

Chain of custody requires a documented record of who handled the evidence, when it changed hands, and under what conditions. These records help prove integrity and admissibility later. Accurate transfer documentation is one of the most important parts of evidence handling in a forensic case.

Why this answer

Chain of custody requires documenting every transfer of evidence with date, time, handler name, and signatures to maintain a verifiable record of who had possession of the laptop at all times. This ensures the evidence is admissible in court by proving it has not been tampered with or altered since collection. Without this documentation, the defense could argue the evidence was compromised, undermining the entire case.

Exam trap

CompTIA often tests the misconception that preserving evidence means making it easier to access (like resetting or removing components), when in fact the priority is maintaining the original state and documenting every touchpoint to ensure legal admissibility.

How to eliminate wrong answers

Option A is wrong because leaving the laptop on a desk unattended violates the principle of secure evidence handling, as it creates an unaccounted gap in custody where the device could be tampered with or accessed by unauthorized individuals. Option C is wrong because resetting the laptop destroys all data, including potential evidence such as logs, files, and user activity, which is irreversible and violates forensic best practices that require preserving the original state of evidence. Option D is wrong because removing the hard drive and connecting it to a personal workstation risks altering the drive's contents (e.g., timestamps, metadata) and introduces potential contamination from the workstation's operating system, breaking the chain of custody and compromising forensic integrity.

Full explanation →

881

MCQmedium

A finance analyst receives an email that appears to come from the CFO. It references a real project, asks for an urgent wire transfer to a "new vendor account," and says to avoid the normal approval workflow because the deal is time-sensitive. What is the best immediate response?

A.Reply to the email asking for additional payment details and wait for a response.

B.Process the transfer quickly because the message appears to come from an executive.

C.Verify the request using a known-good contact method and report the message as suspicious.

D.Forward the email to another finance employee so someone else can confirm the request.

AnswerC

The safest response is to independently verify the request through a trusted channel already on file, such as a known phone number or internal messaging system. That breaks the attacker’s control of the conversation and prevents a rushed financial error. Reporting the message also helps security staff search for related phishing attempts and protect other employees from a similar business email compromise attempt.

Why this answer

The best immediate response is to verify the request using a known-good contact method (e.g., a phone number from the corporate directory) and report the message as suspicious. This defeats the impersonation attempt because the attacker cannot control the out-of-band channel. It also follows the principle of verifying unusual or urgent financial requests through a separate trusted path.

Exam trap

SY0-701 often tests the misconception that replying to or forwarding a suspicious email is a safe way to verify it, when the correct action is out-of-band verification via a known-good channel.

How to eliminate wrong answers

Option A is wrong because replying to the email continues the conversation with the attacker and does not verify the sender's identity; the reply goes to the attacker's address. Option B is wrong because processing the transfer based on appearance of executive authority is exactly the social-engineering trap; urgency and authority are classic pretexts. Option D is wrong because forwarding to another employee does not verify the request and may spread the phishing email, potentially compromising additional accounts.

Full explanation →

882

MCQmedium

A security analyst notices that a phishing campaign is targeting employees with emails that appear to be from the company's IT support team. The emails contain a link to a website that mimics the corporate password reset portal. Which of the following controls would be MOST effective in preventing users from reaching the malicious website, assuming the link uses HTTPS?

A.Implement a URL filtering policy on the company's web proxy.

B.Deploy an email security gateway that performs sandboxing of attachments.

C.Enable multi-factor authentication on all corporate accounts.

D.Conduct a security awareness training session on phishing.

AnswerA

Implementing URL filtering on the corporate web proxy is a preventive technical control that actively blocks access to known malicious, phishing, or lookalike domains at the network layer. The proxy inspects the requested URL and domain against real-time reputation feeds and policy categories; if the destination matches a threat intel blocklist, the connection is terminated before the browser loads the page. Because it operates in-line on HTTP and HTTPS traffic (using SNI/TLS inspection or DNS resolution), this control disrupts the phishing kill chain regardless of how the link was delivered, including via webmail, social media, or messaging apps. It does not rely on user judgment, making it a more consistent and automated safeguard than awareness training.

Why this answer

A URL filtering policy on the company's web proxy is the most effective control because it can block access to the malicious website based on its domain, category, or reputation, regardless of whether the link uses HTTPS. Since the proxy can perform SSL/TLS inspection (decrypting the HTTPS traffic) or use domain reputation lists, it prevents users from even reaching the phishing site. This directly addresses the core issue of users navigating to a known or suspicious URL.

Exam trap

The trap here is that candidates assume HTTPS encryption makes URL filtering impossible, but the exam expects you to know that web proxies can inspect or block HTTPS traffic using SSL/TLS decryption or domain-based filtering, making URL filtering still effective.

Why the other options are wrong

The question specifies that the link uses HTTPS, so sandboxing attachments is irrelevant because the threat is a link in the email body, not an attachment. Email sandboxing analyzes file attachments for malware, not URLs.

Multi-factor authentication (MFA) protects against credential theft after a user reaches a malicious site, but it does not prevent users from initially accessing the site. The question asks for a control to prevent reaching the malicious website, not to mitigate the impact of credential compromise.

Security awareness training educates users to recognize phishing, but it does not prevent users from reaching the malicious website if they click the link. The question asks for a control that prevents access to the site, not user behavior.

When would these options actually be correct?

An email security gateway with sandboxing would be correct if the phishing campaign included malicious attachments (e.g., PDFs or Office documents with embedded macros) that need to be detonated in a safe environment to detect threats.

In a scenario where a phishing campaign successfully harvests credentials and attackers attempt to log in to corporate accounts, enabling MFA would be the most effective control to block unauthorized access even if credentials are stolen.

A question asks: 'Which control is MOST effective in reducing the likelihood that employees will fall for a phishing campaign targeting password reset credentials?' In that context, training directly addresses user susceptibility.

Why candidates pick the wrong answer

Candidates may think that any email security solution can block phishing, but sandboxing specifically targets attachments, not links. They might confuse sandboxing with URL analysis or general email filtering capabilities.

Candidates may think MFA is a universal security solution and overlook that it addresses post-compromise risks rather than preventing initial access to malicious sites.

Candidates often overvalue training as a catch-all security measure, forgetting that technical controls like URL filtering block access regardless of user decisions.

Full explanation →

883

MCQeasy

After reviewing a risk memo, the operations director signs off on continuing to use an older application because the cost of replacement is too high right now. Which risk management action did the director take?

A.Risk transfer, because the risk was moved to another company.

B.Risk acceptance, because management chose to live with the remaining risk.

C.Risk avoidance, because the application is still being used.

D.Risk mitigation, because the replacement cost was too high.

AnswerB

Risk acceptance is the correct term when management knowingly approves continued operation despite identified risk. The director is not eliminating the issue or moving it elsewhere; instead, they are choosing to tolerate the residual risk for business reasons such as cost or timing. This is a normal part of risk management when the risk is understood and documented.

Why this answer

The operations director chose to continue using the older application despite the identified risk, explicitly because the cost of replacement was too high. This is the definition of risk acceptance: management acknowledges the risk and decides to tolerate the residual risk without implementing additional controls. The director did not transfer, avoid, or mitigate the risk; they accepted it as a cost of business.

Exam trap

The trap here is confusing 'acceptance' with 'avoidance' — candidates often think that continuing to use the application means avoiding the risk, but avoidance requires stopping the risky activity entirely, not just living with it.

How to eliminate wrong answers

Option A is wrong because risk transfer would involve shifting the financial impact of the risk to a third party (e.g., purchasing cyber insurance or outsourcing the application), not simply continuing to use it. Option C is wrong because risk avoidance means ceasing the activity that generates the risk (e.g., decommissioning the application), but the director explicitly chose to keep using it. Option D is wrong because risk mitigation would involve implementing controls to reduce the likelihood or impact of the risk (e.g., patching or adding a WAF), not rejecting mitigation due to cost.

Full explanation →

884

MCQeasy

A server room is sometimes left open while technicians carry equipment in and out. Which control best helps detect and discourage unauthorized entry?

A.A written reminder poster on the wall

B.A CCTV camera covering the entrance

C.A brighter color for the server room door

D.A larger monitor in the nearby office

AnswerB

A CCTV camera covering the entrance provides continuous surveillance, which both deters opportunistic intrusion and creates a forensic record of anyone who approaches or enters the server room. Video footage serves as an auditable trail that can be reviewed during incident investigations, and modern systems can integrate with motion detection, cloud storage, and retention policies for extended evidence availability. While it does not physically block entry, it actively monitors the perimeter and provides accountability, making it a critical detective and deterrent control.

Why this answer

A CCTV camera covering the entrance provides continuous monitoring and recording of activity, which both detects unauthorized entry in real time and creates a deterrent effect through the awareness of surveillance. Unlike passive measures, it offers forensic evidence and can be integrated with access control systems to alert security personnel of breaches.

Exam trap

The trap here is that candidates may confuse administrative controls like signage with detective controls, overlooking that only active surveillance (CCTV) provides both detection and deterrence for an unsecured physical entry point.

How to eliminate wrong answers

Option A is wrong because a written reminder poster is a passive administrative control that relies on voluntary compliance and provides no detection or deterrence against intentional unauthorized entry. Option C is wrong because a brighter color for the door is purely cosmetic and has no impact on security monitoring, access control, or deterring unauthorized individuals.

Full explanation →

885

MCQeasy

A SIEM alert shows one workstation connecting to many internal systems over SMB in a short period of time, followed by attempts to access administrative shares. What is the best response?

A.Ignore the alert because SMB is a normal file-sharing protocol

B.Isolate the workstation to stop possible lateral movement

C.Increase the workstation's monitor brightness to help the user notice alerts

D.Disable all SMB traffic across the entire company immediately

AnswerB

Isolating the workstation is the correct immediate response because the rapid SMB connections to multiple hosts indicate the attacker may be pivoting or spreading laterally. Removing the host from the network, either by disconnecting the cable or disabling the switch port, contains the blast radius while preserving volatile memory and network logs for forensic investigation. This aligns with NIST SP 800-61's containment phase, which prioritizes stopping propagation before eradication or recovery. Later steps can include blocking the account, patching the SMB service, and analyzing the observed behavior to identify the root cause.

Why this answer

The SIEM alert describes classic indicators of lateral movement using SMB, often associated with ransomware or worm-like malware. Isolating the workstation immediately stops the attacker from spreading to other systems via administrative shares (e.g., ADMIN$, C$), which are commonly abused for remote execution. This containment step is the highest priority before any forensic analysis.

Exam trap

The trap here is that candidates may dismiss the alert as normal SMB traffic (Option A) because SMB is common, failing to recognize that the combination of rapid connections and administrative share access is a textbook lateral movement indicator.

How to eliminate wrong answers

Option A is wrong because while SMB is a normal file-sharing protocol, the specific pattern of rapid connections to many internal systems followed by administrative share access is highly anomalous and indicative of malicious lateral movement, not legitimate use. Option C is wrong because increasing monitor brightness has no security function and does not address the alert; it is a nonsensical response that confuses physical display settings with security operations. Option D is wrong because disabling all SMB traffic company-wide is an overly drastic and disruptive response that would break critical business operations, and it should only be considered after proper investigation and with targeted controls like firewall rules or GPO changes.

Full explanation →

886

MCQeasy

A user forwards an email that says their payroll account will be disabled today unless they click a link and verify their password. The message uses the company logo, but the sender address is from a free webmail domain and the link goes to a look-alike login page. What type of attack is this?

A.Baiting, because the attacker is offering something attractive to lure the user.

B.Phishing, because the attacker is using a fraudulent message to steal credentials.

C.Vishing, because the attacker is trying to trick the user into revealing information.

D.Impersonation, because the attacker is pretending to be someone from the company.

AnswerB

Phishing is the best match because the attacker is sending a deceptive message that impersonates a trusted source and directs the user to a fake login page. The goal is credential theft, and the urgency plus look-alike site are common signs. The sender address and request to verify a password are strong indicators of a phishing attempt.

Why this answer

This is a classic phishing attack because the attacker uses a fraudulent email that mimics a legitimate company to trick the user into clicking a link to a look-alike login page, with the goal of stealing their payroll credentials. The key indicators are the spoofed company logo, the free webmail sender address, and the fake login page, all of which are hallmarks of credential harvesting via phishing.

Exam trap

The trap here is that candidates may confuse phishing with vishing or baiting because all involve social engineering, but the specific use of email with a fraudulent link to a fake login page is the defining characteristic of phishing, not voice calls (vishing) or physical lures (baiting).

How to eliminate wrong answers

Option A is wrong because baiting involves offering something attractive (e.g., a free USB drive or download) to lure the victim into a trap, not sending a deceptive email requesting credential verification. Option C is wrong because vishing (voice phishing) uses phone calls or voice messages to trick victims, not email with a link to a fake login page. Option D is wrong because impersonation is a broader social engineering tactic that can be part of phishing, but the specific attack described—using a fraudulent email with a malicious link—is precisely defined as phishing, not impersonation alone.

Full explanation →

887

MCQmedium

A support portal searches customers by last name using a parameter called q. After one user enters a single quote, the app returns a SQL syntax error. A tester then submits `test' OR '1'='1` and sees every customer record. Which control most directly prevents this issue?

A.Parameterize the database queries with prepared statements

B.Encode all output returned to the browser

C.Add CSRF tokens to the login form

D.Move the application to a separate VLAN

AnswerA

Prepared statements parameterize user input so the database engine compiles the SQL query structure once, before any data is bound. The search term is passed as a pure string parameter, never concatenated into the SQL text, so malicious input like ' OR 1=1 -- cannot alter the query's WHERE clause semantics. This eliminates the injection payload's ability to change the query's logical structure.

Why this answer

The vulnerability is SQL injection, which occurs when user input is directly concatenated into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data by using placeholders, ensuring user input is treated as data only and never executed as code. This directly prevents the attacker from injecting malicious SQL fragments like `' OR '1'='1`.

Exam trap

The trap here is that candidates often confuse output encoding (XSS prevention) with input handling (SQL injection prevention), or they think network controls like VLANs can fix application-layer code flaws.

How to eliminate wrong answers

Option B is wrong because encoding output prevents cross-site scripting (XSS), not SQL injection; the attack occurs on the database backend, not in the browser. Option C is wrong because CSRF tokens prevent cross-site request forgery, which tricks a user into submitting unintended requests, but does not stop an attacker from directly crafting malicious input in the search parameter. Option D is wrong because moving the application to a separate VLAN is a network segmentation control that limits lateral movement but does not fix the insecure database query code; the SQL injection would still succeed from the application server.

Full explanation →

888

MCQmedium

A company stores customer documents in cloud object storage. The provider already offers encryption at rest and physical security. Which action most directly reduces the risk of unauthorized access to the stored files?

A.Assume the provider's default settings are sufficient because encryption at rest is already enabled.

B.Move the documents to a public bucket so users can access them without friction.

C.Configure least-privilege IAM roles, bucket policies, and object permissions for approved users only.

D.Disable encryption at rest so administrators can troubleshoot access problems more easily.

AnswerC

In the shared responsibility model, the customer is responsible for managing access controls on the objects they store, and least privilege ensures each approved user or application receives only the permissions necessary to perform its function. This is accomplished by combining IAM roles that define a principal's allowed actions, bucket policies that restrict who can access the bucket and under what conditions (e.g., source IP or MFA), and object permissions like ACLs or condition keys that scope access to specific objects. Configuring these elements for approved users only minimizes the attack surface and helps meet compliance requirements by preventing unauthorized GetObject calls.

Why this answer

Even with encryption at rest and physical security, unauthorized access can occur if IAM policies, bucket policies, and object permissions are overly permissive. Configuring least-privilege access ensures that only approved users can read or modify the stored files, directly reducing the attack surface. Encryption at rest protects data if storage media is compromised, but it does not prevent authorized users with excessive permissions from accessing files they shouldn't.

Exam trap

The trap here is that candidates confuse encryption at rest with access control, assuming that encryption alone prevents unauthorized access, when in fact it only protects against physical theft of storage media, not against API-level access by users with excessive permissions.

How to eliminate wrong answers

Option A is wrong because assuming default settings are sufficient ignores the principle of least privilege; default IAM roles and bucket policies are often overly permissive (e.g., public read access) and must be explicitly hardened. Option B is wrong because moving documents to a public bucket would expose them to anyone on the internet, directly increasing the risk of unauthorized access. Option D is wrong because disabling encryption at rest would leave data vulnerable if an attacker gains physical access to the storage media or if the provider suffers a breach, and it does not solve access control issues.

Full explanation →

889

Matchingeasy

Match each principle to the scenario that best illustrates it.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

A database account can update records but cannot approve purchases.

A contractor can view only the log source tied to the assigned ticket.

One person prepares a wire transfer and another authorizes it.

The portal checks the device and user again before each sensitive action.

The application is protected by MFA, filtering, and endpoint controls.

Why these pairings

Least privilege limits access rights; separation of duties divides critical tasks; defense in depth uses multiple security layers; need to know restricts data access; accountability tracks actions; fail safe ensures security on failure.

Full explanation →

890

MCQhard

A security engineer is reviewing a web application that uses a database. The application constructs SQL queries by concatenating user input directly into the query string. During a penetration test, an attacker enters `' OR '1'='1` in the username field and successfully logs in without valid credentials. Which of the following BEST describes the vulnerability and the most effective mitigation?

A.SQL injection; mitigate by using parameterized queries (prepared statements).

B.Cross-site scripting (XSS); mitigate by encoding output.

C.Cross-site request forgery (CSRF); mitigate by using anti-CSRF tokens.

D.Command injection; mitigate by validating input against a whitelist.

AnswerA

The payload `' OR '1'='1` manipulates the SQL query to always evaluate true, bypassing authentication. This is a SQL injection vulnerability caused by concatenating user input into queries. Parameterized queries separate SQL code from data, preventing user input from being interpreted as SQL commands, making them the most effective mitigation for this scenario.

Why this answer

The payload `' OR '1'='1` is a textbook SQL injection that alters the query's WHERE clause to return true, allowing authentication bypass. The root cause is dynamic SQL construction via string concatenation. Parameterized queries ensure that user input is treated as data, not executable code, effectively neutralizing SQL injection.

This is the most robust and recommended mitigation.

Exam trap

The trap here is confusing SQL injection with other injection types like command injection or XSS, and selecting input validation as the primary fix instead of parameterized queries.

Full explanation →

891

MCQhard

Based on the exhibit, which attack is most likely occurring on the local network?

A.DNS cache poisoning

B.ARP spoofing

C.Replay attack

D.Amplification denial-of-service

AnswerB

The host receives repeated ARP replies claiming the gateway IP belongs to a different MAC address, and the same MAC appears on multiple switch ports. That combination indicates ARP spoofing or poisoning, which can redirect traffic through an attacker for interception or disruption. The brief forwarding to another IP is consistent with a man-in-the-middle attempt built on forged ARP replies.

Why this answer

ARP spoofing is the most likely attack because the exhibit shows an attacker sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This poisons the ARP cache of the victim, causing all traffic destined for the gateway to be sent to the attacker instead, enabling man-in-the-middle interception.

Exam trap

The trap here is that candidates confuse ARP spoofing with DNS cache poisoning because both involve 'poisoning' a cache, but ARP operates at Layer 2 (MAC addresses) while DNS operates at Layer 7 (domain name resolution).

How to eliminate wrong answers

Option A is wrong because DNS cache poisoning involves corrupting a DNS resolver's cache with false DNS records, not manipulating ARP tables at Layer 2. Option C is wrong because a replay attack captures and retransmits valid data packets to trick the receiver, but the exhibit shows direct manipulation of MAC-to-IP mappings, not packet replay. Option D is wrong because an amplification denial-of-service attack uses small queries to generate large responses (e.g., DNS amplification), overwhelming a target with traffic, whereas the exhibit depicts local network ARP manipulation.

Full explanation →

892

MCQmedium

An organization is evaluating a payroll SaaS provider after the procurement team asks for evidence that the vendor's security controls were designed and operating effectively during the past year. Which document should the security team review first?

A.Memorandum of understanding

B.SOC 2 Type II report

C.Software license agreement

D.Network diagram of the vendor's data center

AnswerB

A SOC 2 Type II report is an independent auditor's attestation of a service organization's controls related to the Trust Services Criteria (e.g., security, availability, confidentiality) over a specified period. The 'Type II' designation specifically indicates that the auditor tested and opined on the operating effectiveness of those controls throughout the review window, not just their design. This directly provides procurement or security teams with assurance that the vendor's security controls were functioning as claimed, which is exactly the evidence needed for a third-party risk assessment of a payroll SaaS provider.

Why this answer

A SOC 2 Type II report provides an independent auditor's assessment of a service organization's controls over a period of time (typically 6–12 months), confirming that security controls were not only designed but also operating effectively. This directly meets the procurement team's need for evidence of the vendor's security posture over the past year, as required for evaluating a SaaS provider handling sensitive payroll data.

Exam trap

The trap here is that candidates may confuse a SOC 2 Type I report (which only tests control design at a point in time) with a Type II report (which tests operating effectiveness over a period), or they may mistakenly think a network diagram or legal agreement provides evidence of control effectiveness.

How to eliminate wrong answers

Option A is wrong because a Memorandum of Understanding (MOU) is a non-binding agreement outlining mutual intentions and responsibilities, not an audited report of control effectiveness. Option C is wrong because a Software License Agreement defines usage rights, fees, and legal terms, but does not provide evidence of security control design or operational effectiveness. Option D is wrong because a network diagram shows the vendor's data center architecture but offers no proof that security controls were actually implemented or operating effectively over the past year.

Full explanation →

893

MCQeasy

A company wants to reduce the chance that a stolen password can be used to access employee email. Which control is the best fit?

A.Password complexity requirements only

B.Multi-factor authentication

C.Daily backup verification

D.Security awareness posters

AnswerB

Multi-factor authentication adds another verification step beyond the password, so an attacker who steals only a password still cannot easily log in. It is a practical preventive control for reducing account takeover risk, especially for email and other internet-facing services where passwords may be phished, reused, or exposed in breaches.

Why this answer

Multi-factor authentication (MFA) requires at least two different authentication factors (e.g., something you know like a password and something you have like a time-based one-time password from an authenticator app). Even if an attacker steals the password, they cannot access the email without the second factor, directly reducing the risk of credential theft leading to account compromise.

Exam trap

The trap here is that candidates often choose password complexity (A) thinking stronger passwords prevent theft, but the question explicitly states the password is already stolen, so only a second factor like MFA can block its use.

How to eliminate wrong answers

Option A is wrong because password complexity requirements only make passwords harder to guess or crack, but they do nothing to prevent a stolen password from being reused by an attacker who already possesses it. Option C is wrong because daily backup verification ensures data recoverability in case of loss or ransomware, but it does not prevent unauthorized access to email accounts. Option D is wrong because security awareness posters educate users about threats but provide no technical enforcement to block an attacker using a stolen password.

Full explanation →

894

MCQeasy

An employee receives a phone call from someone claiming to be IT and asking for a one-time verification code to "fix" the employee's account. What is the best response?

A.Provide the code quickly so the support call can be completed without delay.

B.Refuse to share the code and report the call through the company's security process.

C.Reply to the caller by email with the code and ask them to confirm receipt.

D.Change the password immediately and then tell the caller the new password.

AnswerB

The safest response is to refuse the request and report it through the organization’s approved security process. One-time codes should never be shared because they can be used to bypass MFA and hijack the account. Reporting the call helps the security team warn others, investigate the attempt, and reduce the chance of a successful attack.

Why this answer

It follows the principle of never sharing authentication factors, especially one-time verification codes, with anyone over the phone. This scenario is a classic social engineering attack (vishing) where the attacker attempts to bypass multi-factor authentication (MFA) by tricking the employee into revealing a time-based one-time password (TOTP) or similar code. Reporting the call through the company's security process allows the incident to be investigated and mitigates further risk.

Exam trap

The trap here is that candidates may think providing the code is harmless because it is 'one-time' or that changing the password is a proactive security measure, but both actions directly hand over authentication secrets to an unverified caller.

How to eliminate wrong answers

Option A is wrong because providing the code directly enables the attacker to authenticate as the employee, compromising the account and any MFA-protected resources. Option C is wrong because replying by email with the code still shares the secret with an unverified caller, and email is not a secure channel for transmitting authentication factors; it also does not verify the caller's identity. Option D is wrong because changing the password and then telling the caller the new password gives the attacker direct access to the account, bypassing any security controls; the employee should never share credentials with anyone.

Full explanation →

895

MCQeasy

A finance manager can view only the reports needed for monthly budgeting and cannot see payroll details. Which principle is being applied?

A.Need-to-know, because access is limited to information required for the job.

B.Zero trust, because the manager uses a password to sign in.

C.Separation of duties, because the manager is part of finance.

D.Defense in depth, because only one report system is being used.

AnswerA

Need-to-know restricts access to data strictly required for a role's duties, so the finance manager sees budgeting reports but not payroll. This satisfies the stem's constraint that access is limited to information required for the job, distinct from least privilege, which governs permission levels rather than data relevance.

Why this answer

The principle of need-to-know restricts access to only the information necessary for an individual to perform their job duties. In this scenario, the finance manager can view only monthly budgeting reports and is explicitly blocked from payroll details, which aligns directly with need-to-know. This is typically enforced through access control lists (ACLs) or role-based access control (RBAC) policies that limit data visibility based on job function.

Exam trap

The trap here is confusing need-to-know with least privilege, as both limit access, but need-to-know specifically restricts data visibility rather than system permissions or actions.

How to eliminate wrong answers

Option B is wrong because zero trust is a security model that assumes no implicit trust and requires continuous verification of every access request, not simply using a password to sign in. Option C is wrong because separation of duties divides critical tasks among multiple people to prevent fraud or error, not to limit data visibility based on job role. Option D is wrong because defense in depth involves multiple layers of security controls (e.g., firewalls, IDS, encryption), not restricting access to a single report system.

Full explanation →

896

Matchinghard

Match each awareness-program metric or pattern to the best interpretation. Use each interpretation once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Improved phishing resistance

Better escalation culture

Faster detection and triage

Targeted refresher coaching needed

Why these pairings

Phishing click rate measures susceptibility, reporting rate indicates vigilance, training completion rate shows participation, repeat offender rate identifies high-risk users, time to report reflects responsiveness, and knowledge assessment score measures understanding.

Full explanation →

897

Matchingmedium

Match each incident response action to its primary purpose during a suspected endpoint compromise.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Contain the incident and limit spread to other systems

Preserve evidence that could disappear after power-off

Eradicate persistence and return the system to a trusted state

Recover business operations and return service to normal

Complete lessons learned and improve future response

Why these pairings

Incident response actions are sequenced to contain, preserve, analyze, remove, and learn from the incident. Isolating prevents spread; volatile data capture is time-sensitive; imaging preserves evidence; log analysis reveals details; eradication cleans the system; lessons learned improve processes.

Full explanation →

898

MCQmedium

A security analyst in the SOC is investigating a potential DNS tunneling incident. The analyst has identified a workstation that is making thousands of DNS queries to an external domain with base64-encoded subdomains. The analyst suspects that sensitive files from the workstation are being exfiltrated by encoding their contents into the subdomains of the DNS queries. Which of the following log sources will provide the most definitive evidence to confirm that the contents of a specific sensitive file are being transmitted in the DNS queries?

A.The DNS server logs showing the queried domains and subdomains.

B.The workstation's process creation logs showing which process initiated the DNS queries.

C.A full packet capture of the network traffic from the workstation showing the complete DNS messages.

D.The firewall logs showing outbound connections from the workstation to the external DNS server on port 53.

AnswerC

A full packet capture includes the entire DNS query packet, including the complete subdomain portion. The analyst can extract and decode the base64-encoded subdomain data and compare it directly to the contents of a sensitive file on the workstation to definitively confirm data exfiltration.

Why this answer

A full packet capture (PCAP) contains the complete DNS query and response messages, including the raw payload of the subdomain fields. This allows the analyst to extract the base64-encoded data from the subdomains and decode it to verify that it matches the contents of the suspected sensitive file. DNS server logs (option A) typically only record the queried domain names, not the full DNS message payload, and may truncate long subdomains.

Process creation logs (option B) show which executable made the queries but not the data being sent. Firewall logs (option D) only show connection metadata (source, destination, port) and never the DNS query content.

Exam trap

The trap here is that candidates assume DNS server logs contain the full query payload, but in practice they often log only the resolved domain name and may truncate long subdomains, making packet capture the only definitive source for reconstructing exfiltrated data.

Why the other options are wrong

DNS server logs typically show only the queried domain names and subdomains, not the full DNS message payload. Since base64-encoded subdomains are part of the query, the logs would reveal the encoded data, but without the full packet capture, you cannot definitively confirm that the contents of a specific sensitive file are being transmitted—you only see the encoded strings, not the original file content or the exact mapping.

Process creation logs show which process initiated the DNS queries but do not reveal the actual content of the DNS queries, such as the base64-encoded subdomains carrying exfiltrated data.

Firewall logs show only connection metadata (IPs, ports, timestamps) and cannot reveal the contents of DNS queries, so they cannot confirm that file contents are being transmitted.

When would these options actually be correct?

A question asks: 'Which log source would best identify the external domain and subdomains being queried in a DNS tunneling incident?' In that case, DNS server logs directly show the queried domains and subdomains, making them the most definitive source for that specific purpose.

When investigating a malware infection where the primary concern is identifying the malicious executable responsible for initiating suspicious network connections, process creation logs would provide definitive evidence of the process involved.

A question asks which log source best identifies the external IP address and port used by a workstation for DNS tunneling, where the goal is to block the connection rather than inspect payload content.

Why candidates pick the wrong answer

Candidates may think DNS server logs capture all query details, but they often lack the full packet payload needed to reconstruct the exfiltrated data. The base64 subdomains are visible, but without the complete DNS message, you cannot prove the file content is being transmitted.

Candidates may think that identifying the process is sufficient to confirm data exfiltration, overlooking that the content of the DNS queries is needed to prove the sensitive file's contents are being transmitted.

Candidates may think firewall logs capture all outbound traffic details, but they lack the application-layer data needed to see DNS query payloads.

Full explanation →

899

Multi-Selectmedium

A regulated analytics workload must run in a public cloud with the strongest practical tenant isolation while avoiding management of physical servers. The workload should also remain off the public internet. Which two deployment choices best fit? Select two.

Select 2 answers

A.Run the workload on a dedicated host or dedicated instance.

B.Place the workload in a private subnet without a public IP address.

C.Use shared tenancy with security groups only.

D.Assign an elastic IP so administrators can reach the workload directly from anywhere.

E.Expose the workload through a public load balancer to simplify connectivity.

AnswersA, B

Dedicated compute placement provides stronger tenant isolation than shared hardware and is appropriate when a regulated workload needs a higher separation level. It also keeps the organization in a cloud model without requiring ownership of physical servers.

Why this answer

A dedicated host or dedicated instance provides the strongest practical tenant isolation in a public cloud by ensuring that the underlying physical server is not shared with any other customer. This meets the regulatory requirement for strong isolation while avoiding the need to manage physical servers, as the cloud provider still handles hardware maintenance. The dedicated instance model (e.g., AWS Dedicated Instances) offers hardware-level isolation at the instance level, while a dedicated host gives you visibility and control over the physical server, both without requiring you to manage the server itself.

Exam trap

The trap here is that candidates often confuse network isolation (private subnet) with tenant isolation (physical hardware separation), or they assume that a public load balancer can be used without exposing the workload to the internet, forgetting that the load balancer itself has a public endpoint.

Full explanation →

900

Matchinghard

Match each business situation to the best risk treatment. Use each treatment once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Accept risk

Mitigate risk

Transfer risk

Avoid risk

Why these pairings

Risk treatment decisions are based on likelihood and impact: accept low risks, avoid high-high risks, mitigate medium risks, and transfer risks that are high likelihood but low impact or low likelihood but high impact.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 826–900