Courseiva

Security+ SY0-701 (SY0-701) — Questions 826–900

1013 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 11

Page 12 of 14

Page 13
826
MCQmedium

A security analyst is investigating a phishing campaign that specifically targets senior executives in a company. The emails appear to come from the CEO and request urgent wire transfers to a fraudulent account. Which of the following best describes this type of attack?

A.Whaling
B.Spear phishing
C.Vishing
D.Pharming
AnswerA

Whaling is a highly targeted form of spear phishing that focuses specifically on senior executives, such as CEOs, CFOs, or other high-value individuals with privileged access to financial systems or sensitive corporate data. Attackers craft meticulously researched emails that impersonate trusted internal or external authorities, often invoking legal, compliance, or urgent transactional pretexts to pressure the victim into actions like wire transfers or credential disclosure. Unlike generic spear phishing, which may target any individual with specific attributes, whaling is defined by the executive-level target and the disproportionate potential impact, making it a distinct and more dangerous subtype.

Why this answer

This attack is whaling because it specifically targets senior executives (the 'big fish') with a fraudulent email impersonating the CEO to request urgent wire transfers. Whaling is a form of phishing that focuses on high-profile individuals within an organization, leveraging their authority and access to sensitive financial operations. The attack exploits the trust and urgency associated with executive communications to bypass standard security controls.

Exam trap

CompTIA often tests the distinction between whaling and spear phishing, where candidates mistakenly choose spear phishing because they overlook that whaling is a specific subtype targeting executives, not just any individual.

Why the other options are wrong

C

Vishing is a voice-based phishing attack conducted over phone calls, not email. The scenario describes emails requesting wire transfers, which is a text-based attack, not voice.

When would these options actually be correct?

C

A question describing a phishing attack where the attacker calls a senior executive, impersonates the CEO, and requests an urgent wire transfer over the phone would make vishing the correct answer.

Why candidates pick the wrong answer

C

Candidates may confuse the term 'vishing' with 'phishing' due to similar names, or mistakenly think any social engineering attack targeting executives is vishing, without recognizing the voice channel requirement.

Full explanation →
827
MCQmedium

A procurement clerk receives a text message from someone claiming to be a supplier account manager. The message says a recent payment failed and asks the clerk to update bank details through a link to a secure portal. What should the clerk do first?

A.Open the link and compare it with the supplier's branding
B.Reply to the text and ask the sender to confirm the request
C.Verify the request using a known supplier contact method before taking action
D.Forward the message to finance so they can decide whether it is legitimate
AnswerC

The defining characteristic of social engineering / business email compromise (BEC) is that the attacker controls the communication channel, so the only robust countermeasure is to confirm the request via a channel that the attacker cannot influence — a phone number on file, a corporate address book entry, or a previously verified supplier portal. This breaks the attacker's control loop and ensures that the request is not acted upon solely on the basis of an unverified SMS. It also aligns with the principle of 'trust, but verify' and prevents invoice redirection or fraudulent payment before any harm occurs.

Why this answer

The clerk should independently verify the request using a known supplier contact method (e.g., a phone number on file) before taking any action. This prevents falling victim to a social engineering attack, such as a phishing or business email compromise (BEC) attempt, where the attacker spoofs the sender's identity to redirect payments. Verifying through an out-of-band channel ensures the request is legitimate, as the link in the message could lead to a credential-harvesting site or malware download.

Exam trap

The trap here is that candidates may choose Option D, thinking that forwarding to finance is a safe escalation, but the SY0-701 exam emphasizes that the first step is always independent verification using a trusted method, not delegating or relying on the suspicious communication channel.

How to eliminate wrong answers

Option A is wrong because opening the link and comparing branding is unsafe; the link could lead to a lookalike domain that mimics the supplier's portal, and merely comparing branding does not verify the sender's identity or the link's authenticity, as attackers can easily replicate logos and styles. Option B is wrong because replying to the text allows the attacker to continue the social engineering; the reply goes to the same compromised channel, and the attacker can simply confirm the request, providing no real verification. Option D is wrong because forwarding the message to finance shifts responsibility without verifying the request first; finance may also be deceived by the same spoofed message, and the clerk should independently verify before escalating.

Full explanation →
828
MCQmedium

Based on the exhibit, which document should be updated first to reflect the new ticketing platform while keeping approval requirements unchanged?

A.Policy, because every tool change requires rewriting the corporate mandate.
B.Standard, because the approval workflow and evidence rules are still the same.
C.Procedure, because the step-by-step instructions and screenshots are now outdated.
D.Guideline, because optional content should always be revised before mandatory content.
AnswerC

Procedures contain the operational steps people follow to complete a task. Since the workflow and approval rules remain the same but the tool interface changed, the step-by-step guide should be updated first. That keeps the control intent intact while preventing user confusion and process errors.

Why this answer

The procedure document contains the step-by-step instructions, including screenshots and specific commands for the old ticketing platform. Since the new platform changes the user interface and workflow steps, the procedure must be updated first to ensure technicians can follow accurate instructions. Policies and standards define high-level rules and approval requirements, which remain unchanged, so they do not need immediate revision.

Exam trap

The trap here is that candidates confuse 'procedure' with 'standard' or 'policy,' assuming any tool change requires updating the highest-level document, when in fact only the detailed implementation steps (procedure) need revision if the rules and requirements remain unchanged.

How to eliminate wrong answers

Option A is wrong because a policy is a high-level mandate that sets overall direction and requirements; changing a specific tool does not automatically require rewriting the entire policy, especially when approval requirements stay the same. Option B is wrong because a standard defines mandatory rules and baselines (e.g., evidence retention periods), and while the approval workflow and evidence rules are unchanged, the standard does not include the step-by-step instructions that are now outdated. Option D is wrong because a guideline is optional and non-binding; revising optional content before mandatory content is not a priority, and the question specifically asks for the document that should be updated first to reflect the new platform.

Full explanation →
829
MCQhard

Based on the exhibit, which control would most effectively reduce the remaining successful attacks? Phishing awareness results: Team A: click rate 8%, report rate 6%, median report time 52 min Team B: click rate 7%, report rate 18%, median report time 14 min Team C: click rate 12%, report rate 21%, median report time 10 min Incident summary: Team C had one mailbox takeover after a user approved an MFA push while traveling.

A.Continue generic awareness posters without changing technical controls.
B.Replace push-based MFA with phishing-resistant MFA and reinforce verification for unusual login prompts.
C.Disable MFA on mobile devices so users can log in faster.
D.Allow employees to approve prompts from any device to reduce help desk calls.
AnswerB

Replacing push-based MFA with phishing-resistant MFA, such as FIDO2 security keys or passkeys, eliminates the possibility of a remote attacker triggering a simple approval prompt, because the MFA secret is bound to the legitimate service's origin. Reinforcing verification for unusual login prompts—for example, requiring the user to confirm a displayed number or to check the sign-in location—adds a human decision layer that catches prompt fatigue even if a prompt somehow appears. This combination directly counters the reported attack: the travelling employee could not have been phished into approving a push because no push exists, and any abnormal sign-in would trigger an explicit verification step instead of a one-tap 'Yes'.

Why this answer

Team C's successful attack was a mailbox takeover resulting from a user approving an MFA push notification while traveling. This indicates that push-based MFA is vulnerable to MFA fatigue attacks, where an attacker bombards the user with prompts until they approve. Replacing push-based MFA with phishing-resistant MFA (e.g., FIDO2/WebAuthn or hardware tokens) eliminates the possibility of approving a prompt from an untrusted device, and reinforcing verification for unusual login prompts adds a critical user behavior layer to detect anomalies.

Exam trap

CompTIA often tests the misconception that any MFA is equally secure; the trap here is that candidates may think push-based MFA is sufficient because it is 'multi-factor,' but the exam expects you to recognize that push-based MFA is vulnerable to fatigue attacks and that phishing-resistant MFA is the appropriate technical control to prevent such successful attacks.

How to eliminate wrong answers

Option A is wrong because generic awareness posters do not address the specific technical vulnerability of push-based MFA being susceptible to fatigue attacks; they are too vague and have already proven ineffective given Team C's high click rate and the successful attack. Option C is wrong because disabling MFA on mobile devices would remove the only authentication factor for mobile users, drastically increasing the risk of account compromise from stolen credentials or session hijacking. Option D is wrong because allowing employees to approve prompts from any device would exacerbate MFA fatigue by removing location/device context, making it easier for attackers to trick users into approving malicious requests.

Full explanation →
830
Matchingeasy

Match each cryptographic concept to its best purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Makes data unreadable to anyone who does not have the correct key.

Creates a fixed-size fingerprint to detect whether data changed.

Adds random data before hashing passwords so identical passwords look different.

Lets others verify who signed the file and that it was not altered.

Replaces an encryption key before its approved lifetime ends.

Why these pairings

Confidentiality protects secrecy, integrity prevents tampering, authentication confirms identity, non-repudiation ensures proof of origin, availability ensures uptime, and accountability enables audit trails.

Full explanation →
831
MCQeasy

A SOC analyst sees 20 failed logins for one user account, followed by a successful login 30 seconds later from the same office subnet. The user confirms they mistyped the password several times. What is the best conclusion?

A.It is definitely a brute-force attack and should be treated as confirmed compromise.
B.It is most likely a false positive caused by user error and should be documented after verification.
C.It is evidence of malware on the user's workstation until the device is rebuilt.
D.It proves the password was changed by an attacker and the account must be disabled immediately.
AnswerB

The most plausible explanation is that the user mistyped their password repeatedly due to human error, such as Caps Lock being active, an expired password, or a typo, and the login attempts originated from a location consistent with the user's typical behavior. The analyst should verify the user's account, correlate the timestamps with the user's reported activity, and document the incident as a false positive for compliance and future correlation. This approach aligns with the incident response principle of validating alerts with context before escalating, avoiding alert fatigue and unnecessary operational disruption.

Why this answer

The scenario shows 20 failed logins followed by a successful login from the same office subnet, and the user confirms they mistyped the password. This pattern is consistent with user error (e.g., Caps Lock or typo), not an automated brute-force attack, which would typically show a much higher volume of attempts from diverse IPs. The best conclusion is a false positive, which should be documented after verification to maintain accurate incident records.

Exam trap

The trap here is that candidates may overreact to multiple failed logins as a brute-force attack, ignoring the user's confirmation and the same-subnet source, which are classic indicators of user error rather than malicious activity.

How to eliminate wrong answers

Option A is wrong because a brute-force attack would involve hundreds or thousands of attempts from multiple IP addresses, not just 20 from the same subnet, and a successful login from the user's own subnet with user confirmation of error makes an attack unlikely. Option C is wrong because there is no evidence of malware; failed logins followed by a successful login from the same subnet are not indicative of malware activity, and rebuilding the device is an extreme, unnecessary response. Option D is wrong because the successful login occurred from the same office subnet, not an attacker's IP, and the user confirmed they mistyped the password; there is no evidence the password was changed, and disabling the account would be premature without further investigation.

Full explanation →
832
MCQmedium

A security team is defining the minimum approved configuration for all new Linux web servers. The document must require specific logging settings, approved packages, and disabled services, and administrators must check servers against it during audits. Which governance artifact best fits this need?

A.Guideline, because it suggests recommended settings without requiring enforcement.
B.Baseline, because it defines the minimum approved configuration that systems should meet.
C.Policy, because it is the high-level statement of intent for the organization.
D.Procedure, because it explains the exact steps to install and configure each server.
AnswerB

A baseline is the correct artifact when an organization wants a documented, measurable starting configuration for systems. It captures the approved minimum settings, such as required services, logging, and packages, and supports consistent builds and compliance checks. Because the question describes a configuration that administrators will audit against, a baseline fits better than a guideline or a general policy.

Why this answer

A baseline is the correct governance artifact because it defines the minimum approved configuration that systems must meet, including specific logging settings, approved packages, and disabled services. In the context of Linux web servers, a baseline ensures consistent security posture by providing a measurable standard that administrators can audit against, such as verifying that rsyslog is configured for remote logging, only packages like Apache or Nginx from approved repositories are installed, and services like Telnet or FTP are disabled. This aligns with the requirement for enforcement and auditability, unlike a guideline which is merely advisory.

Exam trap

The trap here is that candidates confuse 'policy' with 'baseline' because both are governance documents, but a policy is a broad directive (e.g., 'secure all systems') while a baseline provides the specific, auditable technical controls (e.g., 'disable Telnet, enable auditd, use only Apache 2.4') that administrators must enforce.

How to eliminate wrong answers

Option A is wrong because a guideline suggests recommended settings without requiring enforcement, but the scenario explicitly requires administrators to check servers against the document during audits, implying mandatory compliance. Option C is wrong because a policy is a high-level statement of intent (e.g., 'all servers must be secure') that lacks the specific technical details (e.g., exact logging settings, package lists, disabled services) needed for a configuration audit; a baseline operationalizes policy into measurable technical requirements.

Full explanation →
833
MCQmedium

A SOC analyst confirms that an employee entered credentials into a phishing site and that the mailbox now shows a new forwarding rule sending messages to an external address. The account is still signed in on a laptop and a mobile phone. What is the best next action?

A.Wait for the user to log out naturally before taking action.
B.Revoke active sessions and force a password reset for the account.
C.Archive the mailbox and close the ticket after notifying the user.
D.Delete the forwarding rule only and consider the incident closed.
AnswerB

Revoking active sessions immediately invalidates any authentication tokens, cookies, or session identifiers the attacker may have captured, cutting off their current access to the mailbox. Forcing a password reset ensures that the compromised password is no longer valid, preventing the attacker from re-authenticating even if they attempt to log in again. This dual action directly addresses both the active session compromise and the credential compromise, which is essential for containing the incident.

Why this answer

The immediate priority is to contain the compromised account by terminating all active sessions (revoking OAuth tokens, clearing SAML sessions) and forcing a password reset to prevent further unauthorized access. The mailbox forwarding rule indicates the attacker has established persistence, and the active sessions on the laptop and mobile phone mean the attacker could still be using the account. Revoking sessions ensures the attacker cannot continue exfiltration or lateral movement, while the password reset invalidates the stolen credentials.

Exam trap

The trap here is that candidates may think waiting for the user to log out (Option A) is acceptable because the user is still signed in, but in security operations, you must assume the attacker has active access and act immediately to revoke sessions rather than relying on user behavior.

How to eliminate wrong answers

Option A is wrong because waiting for the user to log out naturally gives the attacker continued access to the account, allowing further data exfiltration via the forwarding rule or other malicious actions. Option C is wrong because archiving the mailbox and closing the ticket without revoking sessions or resetting the password leaves the account compromised, the forwarding rule active, and the attacker still able to access the account and modify settings.

Full explanation →
834
MCQhard

Employees use a browser-based SaaS portal, a native expense app, and an internal API. The company wants one corporate identity, API access without separate passwords, and automatic account removal when HR disables a user. Which solution best fits?

A.Use LDAP binds directly against each application and manage local passwords separately.
B.Use OpenID Connect federation with OAuth 2.0 access tokens and SCIM provisioning.
C.Use shared local accounts in each application and sync passwords nightly from the directory.
D.Use Kerberos constrained delegation to each vendor tenant for every application.
AnswerB

OpenID Connect (OIDC) provides a federated identity layer that supports both browser-based SSO through authorization code flows and native mobile app sign-in via PKCE, while OAuth 2.0 access tokens grant the SaaS apps scoped API access on behalf of the user. SCIM (System for Cross-domain Identity Management) automates the creation, update, and deactivation of user accounts in the SaaS applications, ensuring offboarding is immediate and no orphaned accounts linger. Together they give the organization centralized lifecycle control, strong authentication, and least-privilege API access, which is the modern standard for SaaS identity management.

Why this answer

OpenID Connect (OIDC) federation with OAuth 2.0 provides a single corporate identity (federated SSO), allows API access without separate passwords (using access tokens), and SCIM provisioning automates account removal when HR disables a user. This combination meets all three requirements: unified identity, passwordless API access, and lifecycle management.

Exam trap

The trap here is that candidates often confuse LDAP or Kerberos (both legacy on-premises protocols) with modern cloud federation, failing to recognize that OIDC + OAuth 2.0 + SCIM is the only combination that provides SSO, token-based API access, and automated provisioning for SaaS and native apps.

How to eliminate wrong answers

Option A is wrong because LDAP binds require separate password management per application and do not provide API access without passwords, nor do they support automatic account removal via SCIM. Option C is wrong because shared local accounts with nightly password sync violate the requirement for a single corporate identity and do not enable API access without passwords; they also lack automatic provisioning/deprovisioning. Option D is wrong because Kerberos constrained delegation is designed for on-premises Windows environments and does not federate to browser-based SaaS or native apps, nor does it support SCIM-based lifecycle management.

Full explanation →
835
MCQmedium

A SOC analyst confirms that a workstation is encrypting local files and attempting SMB connections to nearby hosts. The user is still logged in, and the business wants to limit spread without destroying evidence. What is the best immediate action?

A.Power the workstation off immediately and leave it in place
B.Quarantine the workstation from the network using EDR or switch port containment
C.Run a full antivirus scan while the workstation remains connected
D.Wipe and reimage the workstation from a standard build image
AnswerB

This is the best immediate containment action because it stops further spread while preserving evidence. EDR quarantine or disabling the switch port isolates the infected host without unnecessarily powering it down. The SOC can then collect volatile and disk evidence, determine the scope of infection, and proceed with eradication and recovery steps in the proper incident response sequence.

Why this answer

Quarantining the workstation via EDR or switch port containment immediately stops the SMB-based lateral movement and further encryption of network shares, while preserving the volatile evidence (memory, running processes, encryption keys) for forensic analysis. This aligns with the business requirement to limit spread without destroying evidence, as powering off or reimaging would lose critical forensic data.

Exam trap

The trap here is that candidates think powering off (Option A) is the fastest way to stop spread, but CompTIA emphasizes preserving evidence and avoiding destruction of volatile data, making network quarantine the correct choice.

How to eliminate wrong answers

Option A is wrong because powering off the workstation destroys volatile evidence (e.g., encryption keys in memory, active network connections) and may trigger anti-forensic mechanisms in the ransomware. Option C is wrong because running a full antivirus scan while the workstation remains connected allows the ransomware to continue encrypting local files and spreading via SMB to nearby hosts, violating the goal to limit spread. Option D is wrong because wiping and reimaging destroys all evidence, including the ransomware binary, encryption artifacts, and forensic traces needed for incident response and attribution.

Full explanation →
836
MCQeasy

A company needs a public website that anyone on the internet can reach, but the application and database servers must stay off the internet. Where should the web server be placed?

A.On the internal user network with the database server.
B.In a DMZ separated from the internal application and database networks.
C.On the same subnet as the firewall management interface.
D.Directly on the database subnet so performance is faster.
AnswerB

A DMZ is the best choice because it allows public access to the web server while keeping the application and database tiers behind additional security controls. If the web server is compromised, the attacker still has to cross another boundary to reach internal systems. This layered zoning is a standard architecture pattern for public-facing services and helps contain risk.

Why this answer

The web server must be placed in a DMZ (demilitarized zone) because this network segment is designed to host publicly accessible services while isolating them from internal networks. The DMZ allows inbound traffic from the internet to the web server, but the application and database servers remain on internal networks with strict firewall rules that block direct internet access, enforcing a layered security architecture.

Exam trap

The trap here is that candidates often confuse a DMZ with a 'public subnet' and think placing the web server directly on the internet-facing side of the firewall is sufficient, but the DMZ is a separate, isolated network segment that enforces strict traffic inspection and prevents direct lateral movement to internal resources.

How to eliminate wrong answers

Option A is wrong because placing the web server on the internal user network with the database server would expose both to direct internet traffic, violating the requirement to keep application and database servers off the internet and creating a single point of compromise. Option C is wrong because the firewall management interface subnet is a highly restricted administrative network; placing a public web server there would expose management interfaces to attack and violate security best practices. Option D is wrong because placing the web server directly on the database subnet would allow internet traffic to reach the database server directly, bypassing the application layer and defeating the purpose of network segmentation.

Full explanation →
837
Matchingeasy

Match each control category to the best example.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

A firewall blocks unauthorized inbound traffic.

A written policy requires manager approval before access is granted.

A badge reader controls entry to a server room.

A SIEM alert notifies the SOC about a failed login pattern.

Restoring a system from a known-good backup after a failure.

Why these pairings

Control categories are matched to examples: preventive controls block, detective controls identify, corrective controls fix, deterrent controls discourage, compensating controls provide alternatives, and directive controls set rules.

Full explanation →
838
Multi-Selectmedium

A security analyst is reviewing the organization's incident response procedures. According to the NIST SP 800-61 framework, which four of the following are recognized phases of the incident response lifecycle? (Choose four.)

Select 4 answers
.Preparation
.Detection and Analysis
.Containment, Eradication, and Recovery
.Post-Incident Activity
.Threat Hunting
.Risk Assessment

Why this answer

The NIST SP 800-61 Revision 2 framework defines the incident response lifecycle as consisting of four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. These phases form a continuous cycle, with lessons learned from Post-Incident Activity feeding back into Preparation. The question asks for the four recognized phases, and these four options directly match the NIST model.

Exam trap

The trap here is that candidates may confuse proactive security activities like Threat Hunting or Risk Assessment with the formal incident response phases, but NIST SP 800-61 strictly lists only the four phases given as correct answers.

Full explanation →
839
MCQeasy

A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?

A.Do nothing until the patch window opens.
B.Add a compensating control such as restricting access to the system.
C.Disable all logging so the system runs faster.
D.Rename the application so attackers cannot find it.
AnswerB

A compensating control lowers risk while the permanent fix is unavailable.

Why this answer

Implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.

Exam trap

The trap here is that candidates may choose 'Do nothing' assuming patching is the only valid action, but CompTIA expects you to recognize that compensating controls are a standard risk management strategy when immediate patching is not feasible.

How to eliminate wrong answers

Option A is wrong because doing nothing leaves the vulnerability exposed, increasing the risk of exploitation during the two-week window, which violates the security team's goal of risk reduction. Option C is wrong because disabling logging degrades visibility and audit capabilities, making it harder to detect or investigate attacks, and does not address the underlying vulnerability.

Full explanation →
840
MCQeasy

A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?

A.Patching the vendor's application servers.
B.Setting user sharing permissions and access controls for company data.
C.Replacing failed disks in the provider's storage cluster.
D.Maintaining the cloud provider's identity center and hypervisor.
AnswerB

In a SaaS model, the provider manages the application and underlying infrastructure, but the customer remains responsible for how the service is used. That includes user provisioning, access permissions, sharing settings, and data handling decisions. Configuring who can see or edit documents is a customer duty because it directly affects the organization's confidentiality and compliance obligations.

Why this answer

In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.

Exam trap

The trap here is that candidates often confuse the SaaS model with IaaS or PaaS, incorrectly assuming the customer is responsible for patching or hardware maintenance, when in fact the provider handles all infrastructure layers in SaaS.

How to eliminate wrong answers

Option A is wrong because patching the vendor's application servers is the provider's responsibility under the SaaS shared responsibility model, not the customer's. Option C is wrong because replacing failed disks in the provider's storage cluster is an infrastructure maintenance task owned by the SaaS provider. Option D is wrong because maintaining the cloud provider's identity center and hypervisor is part of the provider's responsibility for the underlying platform, not the customer's.

Full explanation →
841
MCQhard

Based on the exhibit, which issue should be remediated FIRST? The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.

A.Internet-facing VPN appliance
B.Internal HR file server
C.Lab workstation
D.DMZ reporting server
AnswerA

This asset should be remediated first because it is directly reachable from the internet, has a publicly known exploit that can be weaponized without authentication, and currently lacks compensating controls such as a WAF, access-control list, or host IPS. That combination yields the highest probability of successful remote compromise in the shortest time, so even if other assets have higher raw CVSS scores, the VPN appliance presents the greatest immediate risk to the organization.

Why this answer

The Internet-facing VPN appliance is the highest priority because it is directly exposed to untrusted networks (the Internet), making it the most likely entry point for attackers. A compromise here could lead to full network access, bypassing all other security controls, which represents the greatest real-world risk regardless of its severity score.

Exam trap

The trap here is that candidates often fixate on the highest CVSS severity score (e.g., a critical vulnerability on the internal server) rather than considering the attack surface and likelihood of exploitation, which is the core of risk-based prioritization.

How to eliminate wrong answers

Option B (Internal HR file server) is wrong because it resides on the internal network and is not directly reachable from the Internet, so its exposure is limited to already-authenticated users; remediating it first would not reduce external attack surface. Option C (Lab workstation) is wrong because it is isolated in a lab environment, typically with restricted network access and no sensitive production data, making its compromise low-impact. Option D (DMZ reporting server) is wrong because while it is in a DMZ, it is not Internet-facing (it is behind the firewall and only accessible from internal or specific external sources), so its risk is lower than a directly exposed VPN gateway.

Full explanation →
842
MCQhard

Based on the exhibit, what is the most likely explanation for the suspicious workstation activity?

A.Ransomware campaign
B.Fileless attack
C.Worm propagation
D.Rootkit persistence
AnswerB

The exhibit shows legitimate Windows tools launching hidden, encoded PowerShell from a scheduled task, with no dropped executable on disk. That pattern strongly suggests a fileless attack, where the payload runs primarily in memory and uses trusted utilities to reduce visibility. The periodic connections after execution also fit a lightweight backdoor or loader rather than a traditional malware binary.

Why this answer

The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.

Exam trap

The trap here is that candidates see a PowerShell command and assume it is a worm or ransomware, but the key detail is the in-memory execution (no file written) which is the hallmark of a fileless attack, not the payload's ultimate goal.

How to eliminate wrong answers

Option A is wrong because ransomware typically encrypts files and leaves ransom notes, but the exhibit shows no evidence of file encryption or ransom demands—only a suspicious PowerShell download cradle. Option C is wrong because worm propagation requires self-replicating code that spreads across networks without user interaction, whereas the exhibit shows a single command executed on one workstation with no lateral movement indicators. Option D is wrong because rootkit persistence involves hiding processes or files at the kernel level (e.g., via driver hooks or MBR modification), but the exhibit shows a one-time in-memory execution with no persistence mechanism like scheduled tasks or registry run keys.

Full explanation →
843
MCQmedium

A weekly scan reports three findings: a medium-severity missing patch on a lab VM with no network access, a high-severity default credential on a management interface reachable from the internet, and a low-severity outdated browser plug-in on a visitor kiosk. Which issue should be remediated first?

A.The medium-severity missing patch on the isolated lab VM.
B.The low-severity outdated browser plug-in on the visitor kiosk.
C.The high-severity default credential on the management interface exposed to the internet.
D.All three issues have the same priority because they were found in the same scan cycle.
AnswerC

Default credentials on a management interface exposed to the internet represent a critical risk because they are publicly known, easily tested by automated tools, and provide immediate administrative access if successfully used. The internet exposure makes the vulnerability remotely exploitable without authentication, and a management interface often has elevated privileges, enabling full system control. This combination of high severity, high exploitability, and direct internet accessibility must be the top priority.

Why this answer

The high-severity default credential on a management interface reachable from the internet represents an immediate, exploitable risk. Default credentials are well-known and can be used by attackers to gain full administrative control over the device, often leading to a complete compromise of the network. In contrast, the other findings have compensating controls (no network access) or lower impact (outdated browser plug-in), making them lower priority in a risk-based remediation strategy.

Exam trap

The trap here is that candidates focus solely on the severity label (high vs. medium vs. low) without considering the compensating controls or exposure, leading them to incorrectly rank the missing patch or outdated plug-in as higher priority.

How to eliminate wrong answers

Option A is wrong because the lab VM has no network access, which means the missing patch cannot be exploited remotely; the risk is contained and can be remediated later. Option B is wrong because an outdated browser plug-in on a visitor kiosk is low severity and typically has limited attack surface (e.g., no saved credentials, restricted user privileges), so it does not pose an immediate threat compared to an internet-exposed default credential. Option D is wrong because not all findings have the same priority; risk severity is determined by both the vulnerability's severity and the exposure/impact, and the high-severity default credential with internet exposure clearly outweighs the others.

Full explanation →
844
MCQhard

A facilities manager receives an SMS from "FedEx Delivery" saying a shipment for the research lab cannot clear security until the recipient verifies the package by signing in. The message includes the manager's initials and the warehouse code, and the link opens a cloned sign-in page. Which attack is most likely?

A.Smishing, because the attacker is using a text message to deliver a targeted credential lure.
B.Vishing, because the attacker is pretending to be a delivery service representative.
C.Spear phishing, because the message is targeted using the recipient's role and location.
D.Baiting, because the message offers a shipment verification reward to encourage action.
AnswerA

Smishing is the best answer because the attack arrives by SMS and is designed to push the victim to a fake login page. The personalized details make it more convincing, but the defining factor is the text-message delivery channel combined with credential harvesting. This is a common real-world approach for bypassing inbox filtering and exploiting mobile trust.

Why this answer

Smishing is a social engineering attack that uses SMS (Short Message Service) to deliver a fraudulent message designed to trick the recipient into revealing sensitive information. In this scenario, the attacker sends a text message impersonating FedEx, includes the manager's initials and warehouse code for personalization, and provides a link to a cloned sign-in page, which is the classic credential-harvesting mechanism of a smishing attack.

Exam trap

The trap here is that candidates confuse the targeted nature of the message (which suggests spear phishing) with the delivery vector (SMS), but the exam specifically tests the distinction between phishing subtypes based on the communication channel used.

How to eliminate wrong answers

Option B is wrong because vishing (voice phishing) involves a phone call, not an SMS text message; the attack described uses a text message with a link, not a voice call. Option C is wrong because spear phishing is a form of email-based phishing that targets a specific individual or organization; while the message is targeted, the delivery method is SMS, not email, making smishing the more precise classification.

Full explanation →
845
MCQmedium

Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?

A.Move every device into a single flat subnet so internal routing is simpler.
B.Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.
C.Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.
D.Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.
AnswerB

Separating device classes into distinct VLANs creates clear trust boundaries and limits what a compromised endpoint can reach. Inter-VLAN ACLs or firewall rules can then enforce only the necessary traffic paths, such as management or service traffic. This reduces lateral movement from a workstation to sensitive building systems like cameras and badge readers.

Why this answer

Segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.

Exam trap

The trap here is that candidates often think antivirus or a flat network simplifies management, but the SY0-701 exam specifically tests the principle of network segmentation to contain lateral movement, not just endpoint protection or network simplicity.

How to eliminate wrong answers

Option A is wrong because a single flat subnet removes all network segmentation, allowing any compromised endpoint to directly communicate with any other device (including building systems) via Layer 2 broadcast or unicast, which maximizes lateral movement risk. Option C is wrong because relying solely on antivirus on workstations does not block network-level access to cameras; antivirus is a host-based detection tool that cannot prevent a compromised workstation from sending malicious traffic to other IP addresses on the same subnet. Option D is wrong because putting all traffic through the guest Wi-Fi VLAN would isolate it from the corporate network, but it would also isolate building systems from necessary management traffic and does not provide granular segmentation between different device types; it also introduces performance and policy issues for non-Wi-Fi devices.

Full explanation →
846
MCQmedium

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

A.A stateless network ACL that allows inbound traffic from the ALB's subnet only.
B.A stateful security group that allows inbound traffic from the ALB's security group only.
C.A web application firewall (WAF) that inspects all traffic for SQL injection.
D.A host-based firewall on each web server that allows traffic from the ALB's private IP address.
AnswerB

Correct. Security groups are stateful and can use another security group as a source. This configuration cleanly allows only traffic originating from the ALB, automatically handles return traffic, and is the recommended cloud-native approach for controlling instance-level access.

Why this answer

A stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.

Exam trap

The trap here is that candidates often confuse stateless network ACLs with stateful security groups, assuming a subnet-based ACL is sufficient, but they overlook that ACLs cannot filter by security group and require bidirectional rule management, making them unsuitable for this precise ALB-only access requirement.

Why the other options are wrong

C

A WAF inspects application-layer traffic for threats like SQL injection, but it does not restrict traffic sources. The requirement is to limit inbound traffic to only the ALB, which is a network access control, not a web application firewall function.

D

Using the ALB's private IP address is not scalable because the ALB's IP can change (e.g., after scaling or replacement), and it does not leverage the cloud provider's native security group reference, which automatically tracks the ALB's IP changes.

When would these options actually be correct?

C

A WAF would be correct if the question asked for a security control to protect the web application from common web exploits (e.g., SQL injection, XSS) at the application layer, without specifying source IP restrictions.

D

A host-based firewall would be correct if the cloud provider does not support security group references (e.g., in a non-cloud environment) or if the requirement is to allow traffic from a specific static IP address that is guaranteed not to change.

Why candidates pick the wrong answer

C

Candidates may confuse a WAF's ability to filter malicious traffic with network access control, or they may think a WAF can replace network-level restrictions because it inspects all incoming traffic.

D

Candidates may think that specifying the ALB's private IP is a precise way to restrict traffic, not realizing that cloud ALBs can have dynamic IPs and that security groups offer a more robust, managed solution.

Full explanation →
847
MCQmedium

A resolver log shows multiple clients querying the correct internal host name, but the DNS server starts returning an unexpected public IP address after a burst of unsolicited DNS responses from outside the network. Users are sent to a lookalike login page. What type of attack is most likely occurring?

A.DNS poisoning
B.Brute-force authentication
C.Port scanning
D.Packet sniffing
AnswerA

DNS poisoning directly corrupts the name resolution process: an attacker either forges a DNS response that arrives before the legitimate answer or tampers with a resolver's cache, causing it to return a fraudulent IP address for a valid domain. This matches the scenario exactly because multiple clients querying the correct record will all receive the malicious answer and be redirected to the counterfeit website, while the resolver log simply shows normal queries.

Why this answer

The scenario describes a DNS poisoning (also known as DNS cache poisoning) attack. The burst of unsolicited DNS responses from outside the network is the attacker injecting forged DNS records into the resolver's cache, causing it to map the correct internal host name to an unexpected public IP address. This redirects users to a lookalike login page, which is the classic outcome of DNS poisoning.

Exam trap

The trap here is that candidates may confuse DNS poisoning with packet sniffing because both involve network traffic, but only DNS poisoning actively modifies cached resolution data to redirect users.

How to eliminate wrong answers

Option B is wrong because brute-force authentication involves repeatedly trying passwords against a login interface, not manipulating DNS responses to redirect traffic. Option C is wrong because port scanning is used to discover open ports on a target system, not to alter DNS resolution or redirect users to a fake site. Option D is wrong because packet sniffing passively captures network traffic for analysis, but it does not inject forged DNS responses or modify the resolver's cache.

Full explanation →
848
MCQhard

Based on the exhibit, which access change best follows least privilege while still allowing the help desk to complete the task?

A.Add helpdesk_27 to Domain_Admin for seven days, since the request is urgent and time-limited.
B.Use a shared administrator password so the technician can finish the ticket without changing group memberships.
C.Grant helpdesk_27 the Helpdesk_Admin role for the ticket and remove it after completion.
D.Ask the user's manager to perform the reset manually so the help desk does not need additional access.
AnswerC

Granting the narrower Helpdesk_Admin role is the best least-privilege choice because it gives the technician only the permissions needed to unlock the account and reset MFA. The role is specific to the job function and can be removed after the ticket is complete. That limits exposure while still allowing the work to be finished efficiently.

Why this answer

It implements Role-Based Access Control (RBAC) by granting the help desk technician a temporary, ticket-specific role (Helpdesk_Admin) that provides just enough privileges to perform the password reset without granting broader administrative rights. This follows the principle of least privilege by limiting the elevated access to the exact scope and duration needed, and the role can be automatically revoked after the ticket is closed, minimizing the attack surface.

Exam trap

The trap here is that candidates may choose Option A because it appears to limit the duration of elevated access, but they overlook that Domain_Admin membership provides far more privileges than needed for a single password reset, violating the core principle of least privilege.

How to eliminate wrong answers

Option A is wrong because adding helpdesk_27 to Domain_Admin grants full domain administrative privileges, which far exceed what is needed for a single password reset and violates least privilege by providing persistent, overly broad access even if time-limited. Option B is wrong because using a shared administrator password violates the principle of non-repudiation (no individual accountability) and introduces a shared credential security risk, as all actions would be attributed to the shared account rather than the specific technician. Option D is wrong because it bypasses the help desk's role entirely and places an operational burden on the user's manager, which is inefficient, not scalable, and does not address the need for the help desk to have appropriate access to perform their job function.

Full explanation →
849
MCQmedium

A company portal lets employees save a short profile bio. One employee enters a string containing script code, and later other users who view that profile are redirected to a fake sign-in page. What vulnerability best explains this behavior?

A.Reflected cross-site scripting, because the payload only appears in the current request response.
B.Stored cross-site scripting, because the malicious script is saved and served to other users later.
C.Command injection, because the script runs inside the web server process.
D.Session fixation, because the attacker wants the victim to use an old session ID.
AnswerB

Stored XSS occurs when malicious script is persisted by the application, such as in a profile field, comment, or message. Every user who later loads the page receives the harmful content. The redirection to a fake sign-in page shows that the script is executing in other users’ browsers, which makes this a stored, not reflected, attack. Proper output encoding and input handling are needed to prevent it.

Why this answer

The employee's profile bio is saved to the server and later served to other users who view the profile. This is the defining characteristic of stored (persistent) cross-site scripting (XSS): the malicious script is permanently stored on the target server and executed in the browsers of other users when they retrieve the stored data.

Exam trap

The trap here is confusing stored XSS with reflected XSS by focusing on the 'current request' aspect rather than recognizing that the payload is saved and served to other users later, which is the key differentiator.

How to eliminate wrong answers

Option A is wrong because reflected XSS requires the payload to be part of the current request (e.g., in a URL parameter or form input) and is not permanently stored; it only affects the user who submits the request. Option C is wrong because command injection targets the server-side operating system by injecting system commands (e.g., via shell metacharacters like ';' or '|'), not client-side script execution in a browser.

Full explanation →
850
MCQmedium

A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?

A.Least privilege
B.Defense in depth
C.Separation of duties
D.Zero trust
AnswerB

Correct. The design uses network segmentation, firewalls, and encryption to create multiple layers of defense. This is the core concept of defense in depth, ensuring that a failure in one layer does not compromise the entire system.

Why this answer

The design enforces defense in depth by layering multiple security controls: a DMZ isolates public-facing web servers from internal networks, a stateful firewall restricts inbound traffic to HTTP/HTTPS only, and outbound connections from web servers to internal application servers are limited to a specific TCP port with TLS encryption. This layered approach ensures that even if one control fails (e.g., a web server is compromised), the attacker still faces additional barriers to reach sensitive internal systems.

Exam trap

The trap here is that candidates confuse 'defense in depth' with 'least privilege' because both involve restricting access, but defense in depth specifically refers to multiple overlapping security layers (network segmentation, firewalls, encryption) rather than minimal permissions for a single component.

Why the other options are wrong

A

The design restricts web servers to only initiate outbound connections to internal servers on a specific port, which is an example of least privilege, but the question asks for the primary principle. The overall architecture with multiple layers (DMZ, separate network, firewall rules, TLS) is defense in depth, not just least privilege.

C

The design does not separate duties among different people or roles; it separates network segments and controls traffic, which is about defense in depth, not separation of duties.

D

The design explicitly uses multiple layers of security (DMZ, separate internal segment, stateful firewall, TLS encryption), which is defense in depth, not zero trust. Zero trust would require continuous verification of every request regardless of network location, which is not described.

When would these options actually be correct?

A

A question that asks: 'A security policy states that web servers should only be able to communicate with database servers on TCP port 3306 and no other traffic. Which principle is being applied?' Here, the focus is solely on restricting permissions to the minimum necessary, making least privilege the correct answer.

C

In a scenario where different administrators are responsible for managing web servers versus internal application servers, and policies ensure that no single person has access to both environments, separation of duties would be the correct principle.

D

A question describing a network architecture where no implicit trust is granted based on network location, every access request is authenticated and authorized regardless of source (e.g., all traffic between internal servers must be authenticated and encrypted, with micro-segmentation enforced).

Why candidates pick the wrong answer

A

Candidates see the firewall rule that permits only specific outbound connections and mistakenly think that is the core principle, overlooking that the question emphasizes the layered security approach (DMZ, segmentation, encryption) which is defense in depth.

C

Candidates may confuse 'separation of duties' with 'network segmentation' because both involve dividing resources, but separation of duties specifically refers to dividing responsibilities among people to prevent fraud or error.

D

Candidates may mistakenly think that restricting traffic between segments and requiring encryption aligns with zero trust, but zero trust is a broader model that includes continuous verification and least privilege, not just network segmentation.

Full explanation →
851
MCQmedium

After a ransomware event, the team restores a file server from backup, but management wants proof that the restore process will work before the backups are declared trusted. What should be done next?

A.Delete the old backup copies to prevent future confusion
B.Perform a test restore in an isolated environment and verify the recovered data
C.Switch to incremental backups only so the next restore is faster
D.Store the backups on the same file server so they are easier to access
AnswerB

A test restore is the best way to validate backup integrity and operational readiness after an incident. Restoring in isolation confirms that the backup can be used successfully without risking production systems. Verification should include checking file integrity, application access if relevant, and whether the restored data meets recovery objectives. This provides evidence that backups remain trustworthy after ransomware.

Why this answer

The only way to prove that backups are trustworthy is to perform a test restore in an isolated environment, verifying the integrity and completeness of the recovered data. This validates that the backup process, media, and software are functioning correctly without risking the production environment. Without a successful test restore, the team cannot confirm that the backups are free from corruption, encryption, or other issues that would prevent a real recovery.

Exam trap

The trap here is that candidates may think simply having backups is sufficient proof of recoverability, but the exam emphasizes that only a successful test restore in an isolated environment can validate the backup's integrity and the restore process itself.

How to eliminate wrong answers

Option A is wrong because deleting old backup copies does not prove the restore process works and actually removes potentially valuable recovery points, violating the 3-2-1 backup rule. Option C is wrong because switching to incremental backups only does not validate the current restore process; it changes the backup strategy without addressing the need for proof of recoverability, and incremental backups actually require a full backup chain to restore, increasing complexity. Option D is wrong because storing backups on the same file server violates the fundamental principle of backup isolation, making them vulnerable to the same ransomware attack that encrypted the original data, and it does not test the restore process at all.

Full explanation →
852
MCQmedium

A cloud-hosted API lets users supply a URL for the service to fetch an image. Shortly after release, logs show requests to 169.254.169.254 and internal admin addresses. What control best reduces this risk?

A.Allow the API to follow any redirect so it works with more image sources.
B.Restrict outbound requests to an allowlist and block internal address ranges.
C.Store the fetched image in encrypted form before sending it to users.
D.Increase the session timeout to reduce repeated logins by legitimate users.
AnswerB

This is a classic server-side request forgery pattern: the server is making attacker-influenced requests to internal or metadata addresses. An allowlist of approved destinations, combined with blocking private and link-local ranges, prevents the service from being used as a proxy into internal systems. That control directly targets the unsafe outbound request behavior and is more effective than trying to clean malicious URLs after the fact. It also reduces exposure to cloud metadata theft and internal service probing.

Why this answer

Restricting outbound requests to an allowlist and blocking internal address ranges directly mitigates the Server-Side Request Forgery (SSRF) vulnerability. The requests to 169.254.169.254 (the AWS/GCP/Azure metadata endpoint) and internal admin addresses indicate an attacker is using the API to probe internal services. An allowlist ensures the API only connects to trusted external hosts, while blocking private and link-local ranges prevents access to internal infrastructure.

Exam trap

The trap here is that candidates may confuse data-at-rest protection (encryption) with access control, or mistakenly think allowing redirects improves functionality without realizing it exacerbates SSRF; The SY0-701 exam often tests the specific cloud metadata endpoint (169.254.169.254) as a classic SSRF indicator.

How to eliminate wrong answers

Option A is wrong because allowing the API to follow any redirect would actually increase the SSRF risk, as an attacker could craft a redirect from an allowed external URL to an internal or metadata endpoint, bypassing initial URL checks. Option C is wrong because storing the fetched image in encrypted form does not prevent the API from making unauthorized requests to internal or metadata endpoints; encryption protects data at rest, not the request origin or destination.

Full explanation →
853
MCQhard

A stateless firewall sits between a DMZ subnet 10.10.10.0/24 and an internal subnet 10.10.20.0/24. Only the web server at 10.10.10.25 should be allowed to initiate TCP sessions to the app server at 10.10.20.20 on port 8443. All other DMZ-to-internal traffic must remain blocked. Which ACL entry is the best fit on the DMZ-facing interface?

A.deny tcp 10.10.10.0/24 10.10.20.0/24 eq 8443 followed by permit ip any any
B.permit tcp host 10.10.10.25 host 10.10.20.20 eq 8443 followed by deny ip any any
C.permit tcp host 10.10.20.20 host 10.10.10.25 eq 8443 followed by deny ip any any
D.permit ip 10.10.10.0/24 10.10.20.0/24 followed by deny ip any any
AnswerB

This rule is the least-privilege match for the stated requirement. It allows only the specific source host, destination host, and destination port needed for the application flow, while the explicit deny blocks all remaining DMZ-to-internal traffic on that interface. Because the firewall is stateless, narrowing the source and destination at the entry point is the safest way to prevent unintended exposure.

Why this answer

It explicitly permits only the web server at 10.10.10.25 to initiate TCP sessions to the app server at 10.10.20.20 on port 8443, then denies all other traffic. Since the firewall is stateless, it cannot track session state, so the ACL must be applied on the DMZ-facing interface to control outbound-initiated traffic from the DMZ to the internal subnet. The permit statement uses the 'host' keyword for precise source and destination, followed by an explicit deny all to block any other DMZ-to-internal traffic.

Exam trap

The trap here is that candidates often reverse the source and destination in the permit statement (as in Option C), mistakenly thinking the ACL should allow the app server to respond, rather than correctly permitting the web server to initiate the connection from the DMZ to the internal subnet.

How to eliminate wrong answers

Option A is wrong because it denies the specific traffic (TCP from 10.10.10.0/24 to 10.10.20.0/24 on port 8443) that should be permitted, and then permits all other traffic, which would allow unauthorized DMZ hosts to reach the internal subnet. Option C is wrong because it reverses the source and destination, permitting the app server at 10.10.20.20 to initiate sessions to the web server on port 8443, which violates the requirement that only the web server should initiate the connection. Option D is wrong because it permits all IP traffic from the entire DMZ subnet to the internal subnet, which would allow any DMZ host to reach any internal host, completely bypassing the restriction to only the web server and only on port 8443.

Full explanation →
854
MCQeasy

A new SIEM rule generates many alerts from a scheduled backup job that is known to be legitimate. What should the analyst do to improve alert quality?

A.Disable all logging for the backup server.
B.Tune the rule to exclude the known backup activity pattern.
C.Ignore the alerts permanently because the job is approved.
D.Reimage the backup server to stop the alerts.
AnswerB

Alert tuning should reduce false positives without losing useful detection. If the backup job is documented and legitimate, the analyst can adjust the rule to exclude that approved activity pattern or server. This keeps the SIEM useful and helps responders focus on real suspicious behavior instead of repeated harmless alerts.

Why this answer

Tuning the SIEM rule to exclude the known backup activity pattern reduces false positives while preserving detection of actual threats. By creating an exception for the specific backup server's IP, schedule, or process hash, the analyst maintains visibility into anomalous behavior without being overwhelmed by noise.

Exam trap

The trap here is that candidates may choose to disable logging or ignore alerts, confusing operational convenience with proper security hygiene, when the correct approach is to refine detection logic through tuning.

How to eliminate wrong answers

Option A is wrong because disabling all logging for the backup server would create a blind spot, preventing detection of real threats like ransomware encrypting backup data or unauthorized access to backup files. Option C is wrong because ignoring alerts permanently violates security monitoring best practices and could allow a malicious actor to hide activity within the backup job's noise. Option D is wrong because reimaging the backup server is an extreme, unnecessary measure that does not address the root cause—the SIEM rule's lack of specificity—and would disrupt operations without solving the alert volume issue.

Full explanation →
855
MCQmedium

An organization is retiring a batch of laptops with SSDs. All of the systems used full-disk encryption and stored sensitive internal documents. What is the best action before the devices leave the company?

A.Run a quick format and remove the asset tags after the files are deleted.
B.Perform a cryptographic erase by destroying the encryption keys and document the sanitization process.
C.Degauss the SSDs and then store them in the disposal room until pickup.
D.Overwrite the drives once with random data and consider the devices ready for resale.
AnswerB

For encrypted SSDs, destroying the encryption keys is an effective and practical sanitization method because the data becomes unreadable even if the drive is later examined. This approach matches the media type and the fact that full-disk encryption was used. Proper documentation also supports accountability and compliance. It is stronger than merely deleting files or performing a superficial format, which may leave recoverable data behind.

Why this answer

A cryptographic erase (also known as a crypto-scrub) renders the encrypted data permanently inaccessible by securely destroying the encryption keys. Since the SSDs used full-disk encryption (FDE), the data is already encrypted at rest, and without the keys, the ciphertext is effectively unrecoverable. This method is fast, reliable, and compliant with sanitization standards like NIST SP 800-88, making it the best action before the devices leave the organization.

Exam trap

The trap here is that candidates often choose degaussing (Option C) for SSDs, mistakenly applying a technique that works only for magnetic media like HDDs, while ignoring that cryptographic erase is the proper and efficient method for encrypted solid-state drives.

How to eliminate wrong answers

Option A is wrong because a quick format only removes the file system pointers, not the actual data; the encrypted content remains on the SSD and could potentially be recovered if the encryption keys are still present. Option C is wrong because degaussing SSDs is ineffective—SSDs use flash memory that is not affected by magnetic fields, and degaussing can physically destroy the drive without guaranteeing data removal. Option D is wrong because overwriting SSDs with random data is unreliable due to wear-leveling and over-provisioning; the SSD firmware may remap bad blocks, leaving remnants of the original encrypted data intact.

Full explanation →
856
MCQmedium

A security analyst receives an automated alert indicating that a standard user account logged in from a geographic location that is unusual for the user, and the login occurred at 3:00 AM local time. The analyst has not yet verified whether this was a successful login or if any additional suspicious activity occurred. According to standard incident response procedures, what should the analyst do NEXT?

A.Disable the user account immediately and reset the password.
B.Conduct a full forensic analysis of the user's workstation.
C.Review the account's recent activity for signs of compromise.
D.Report the incident to law enforcement.
AnswerC

Reviewing recent activity (e.g., successful logins, file access, privilege escalation attempts) is the appropriate analysis step to validate the alert. This helps determine if the account is compromised and guides subsequent containment and eradication actions.

Why this answer

The correct next step is to review the account's recent activity to gather more context. According to the NIST incident response process (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity), after detection the analyst should perform analysis to validate the alert and determine the scope. Reviewing recent logins, accessed files, and other actions helps decide if containment is needed.

Immediately disabling the account (A) could be premature if the alert is a false positive or if the user is traveling. Conducting a full forensic analysis (B) is too resource-intensive for a single alert without further evidence. Reporting to law enforcement (D) is not appropriate at this stage; that would occur after a confirmed incident that meets legal thresholds.

Why the other options are wrong

A

Disabling the account and resetting the password is premature because the analyst has not yet confirmed the login was successful or that any compromise occurred. Standard incident response procedures require initial triage and verification before taking containment actions.

B

Conducting a full forensic analysis of the user's workstation is premature at this stage because the alert only indicates an unusual login; the analyst has not yet verified if the login was successful or if any compromise occurred. Standard incident response procedures require initial triage and verification before escalating to forensic analysis.

D

Reporting to law enforcement is premature at this stage because the analyst has not yet verified if the login was successful or if any malicious activity occurred. Standard incident response procedures require initial triage and confirmation of a security incident before involving external authorities.

When would these options actually be correct?

A

This would be correct if the question stated that the account had been confirmed compromised (e.g., multiple failed logins followed by a successful login from an unusual location, and evidence of data exfiltration). In that scenario, immediate containment is necessary to prevent further damage.

B

This option would be correct in a scenario where the analyst has already confirmed that the user's account was compromised and malicious activity has been detected on the workstation, such as unauthorized file access or malware execution. The question would state that the incident is confirmed and requires in-depth investigation.

D

This option would be correct if the question stated that the analyst has already confirmed a successful breach involving sensitive data exfiltration or a ransomware attack, and the organization's policy mandates immediate law enforcement notification as part of the incident response plan.

Why candidates pick the wrong answer

A

Candidates may think that any suspicious login warrants immediate account disablement as a precaution, but they overlook the need to first verify the alert and gather context to avoid unnecessary disruption.

B

Candidates may think that any suspicious login warrants immediate deep investigation, confusing the urgency of the alert with the need for forensic analysis, rather than following a step-by-step incident response process.

D

Candidates may think that any unusual login activity, especially from a foreign location, automatically constitutes a crime that must be reported to law enforcement, overlooking the need for verification and internal escalation first.

Full explanation →
857
MCQeasy

A business wants to keep operating even if a supplier-related loss occurs, so it purchases cyber insurance to offset possible costs. Which risk treatment is being used?

A.Avoidance, because the company is eliminating the supplier relationship
B.Mitigation, because insurance removes the risk before it happens
C.Acceptance, because the company is doing nothing about the exposure
D.Transfer, because some financial impact is shifted to another party
AnswerD

This is a textbook risk transfer: the business keeps the supplier and the process but shifts the financial consequences of certain losses to the insurance company via premium payments. The underlying risk (e.g., supplier failure) still exists, but the monetary impact is substantially borne by the insurer, subject to policy terms. Transfer best describes this balance of retaining operational activity while offloading financial risk.

Why this answer

Purchasing cyber insurance transfers the financial risk of a supplier-related loss to the insurance company. This is a classic risk transfer strategy, where the business does not eliminate or reduce the likelihood of the loss but shifts the financial impact to another party via a contractual agreement.

Exam trap

The trap here is confusing risk transfer (shifting financial impact) with risk mitigation (reducing likelihood or impact), leading candidates to incorrectly select mitigation when insurance is involved.

How to eliminate wrong answers

Option A is wrong because avoidance would mean terminating the supplier relationship entirely, not purchasing insurance. Option B is wrong because mitigation involves implementing controls (e.g., firewalls, redundancy) to reduce the likelihood or impact of a risk, not transferring it via insurance. Option C is wrong because acceptance means acknowledging the risk without taking any action, whereas purchasing insurance is an active treatment.

Full explanation →
858
Multi-Selecthard

A SIEM report shows this sequence over 25 minutes: the same public IP submitted one failed password attempt against 53 different accounts, then one account successfully authenticated, created an inbox forwarding rule, and downloaded hundreds of messages through the web portal. Which two conclusions are best supported? Select two.

Select 2 answers
A.The pattern is consistent with a password spraying attack.
B.The attacker is performing a brute-force attack against one account.
C.The activity is most likely credential stuffing with multiple known password pairs.
D.The successful account is likely compromised and being used for persistence or mailbox abuse.
E.The events primarily indicate a denial-of-service attack against the mail system.
AnswersA, D

Password spraying is a low-and-slow attack where an adversary tries a small set of common passwords against many accounts, usually one attempt per account per pass to avoid triggering lockout policies. The SIEM sequence of repeated single failed logins across different users from the same source IP over 25 minutes matches this pattern exactly: no individual account is hammered, yet the cumulative authentication attempt volume is high. The eventual successful login indicates that at least one account was using a weak, predictable password that the attacker had guessed in the spraying cycle.

Why this answer

The SIEM shows a single public IP attempting one failed password against 53 different accounts over 25 minutes. This pattern—low-and-slow, one attempt per account—is the hallmark of a password spraying attack, which avoids account lockout thresholds by never hitting the same account repeatedly. The subsequent successful authentication and mailbox abuse confirm the attacker found a weak password for one account.

Exam trap

The trap here is confusing password spraying (one password, many accounts) with brute-force (many passwords, one account) or credential stuffing (many known pairs), leading candidates to pick B or C despite the single-IP, single-attempt-per-account pattern.

Full explanation →
859
MCQeasy

A security team wants every company laptop to have the same screen-lock timeout, disk encryption setting, and local firewall configuration. Which type of document should define these mandatory settings?

A.A guideline, because employees can decide whether to follow it.
B.A standard, because it specifies mandatory technical requirements.
C.A risk register, because it tracks all security vulnerabilities on laptops.
D.A business impact analysis, because it identifies the most important laptop functions.
AnswerB

A standard is the correct document for mandatory, measurable security settings such as screen-lock timeouts, encryption, and firewall configuration. Standards turn policy intent into specific requirements that can be checked and enforced across devices, which helps keep configurations consistent and easier to audit.

Why this answer

A standard is the correct document type because it defines mandatory technical requirements that must be uniformly enforced across all company laptops. In this scenario, the screen-lock timeout, disk encryption setting (e.g., BitLocker or FileVault), and local firewall configuration (e.g., Windows Defender Firewall with Advanced Security) are non-negotiable controls that must be applied identically to every device to meet security policy. Standards are binding and often reference specific configuration baselines, such as CIS Benchmarks or NIST SP 800-53, ensuring consistent implementation.

Exam trap

The trap here is confusing a standard with a guideline, as many candidates assume any security document is advisory, but standards are explicitly mandatory and enforceable, unlike guidelines which are optional recommendations.

How to eliminate wrong answers

Option A is wrong because a guideline is advisory and suggests best practices that employees may choose to follow or ignore, whereas the scenario requires mandatory settings that must be enforced. Option C is wrong because a risk register is a document that identifies, assesses, and tracks security vulnerabilities and risks, not a document that defines mandatory technical configurations for laptops. Option D is wrong because a business impact analysis (BIA) identifies critical business functions and the impact of their disruption, not the specific technical settings like screen-lock timeout or disk encryption.

Full explanation →
860
MCQeasy

Employees must sign in to several cloud applications with their corporate account, and terminated users should lose access without separate password resets in each app. What is the best solution?

A.Create a separate local username and password in every cloud application.
B.Use federation with single sign-on from a central identity provider.
C.Store the same shared password in a password manager for all applications.
D.Allow each application to authenticate users only by device MAC address.
AnswerB

Federation with SSO is the best option because employees authenticate once with the corporate identity provider and then access multiple applications through trusted token exchange. This reduces password sprawl, improves user convenience, and makes offboarding faster because disabling the central account removes access across connected services. It also supports stronger controls such as MFA at the identity provider rather than repeating them in every application.

Why this answer

Federation with single sign-on (SSO) from a central identity provider (IdP) allows users to authenticate once using their corporate account, and the IdP issues security tokens (e.g., SAML assertions or OIDC tokens) that each cloud application trusts. When a user is terminated, the administrator disables the account in the IdP, and all applications immediately reject the user's tokens, eliminating the need for separate password resets in each app.

Exam trap

The trap here is that candidates confuse password managers (which store credentials but do not provide centralized revocation) with federation, or they mistakenly think MAC address authentication is viable for cloud applications, when in fact MAC addresses are link-layer identifiers not usable over the internet.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and passwords in every cloud application violates the requirement for centralized access control and would require manual password resets in each app upon termination. Option C is wrong because storing the same shared password in a password manager does not provide centralized revocation; the password would still need to be changed in every application individually to block access. Option D is wrong because authenticating by device MAC address is not feasible for cloud applications (MAC addresses are not transmitted over the internet) and does not support user-level identity or termination.

Full explanation →
861
MCQmedium

A legal department needs a contract file that can later prove who signed it and whether the content changed after signing. Which cryptographic mechanism should be used?

A.Digital signature
B.Symmetric encryption
C.Hashing
D.Tokenization
AnswerA

A digital signature applies asymmetric cryptography: the signer's private key encrypts a hash of the document, and the corresponding public key verifies that the hash came from that signer and the document is unchanged. This binds the contract irrevocably to the specific signer, providing authentication, integrity, and non-repudiation. It is precisely the mechanism legal departments need to ensure a contract is legally enforceable and attributable.

Why this answer

A digital signature provides non-repudiation, ensuring the signer cannot deny signing the document, and integrity, detecting any changes after signing. It uses asymmetric cryptography where the signer's private key creates the signature, and the public key verifies it, making it the correct choice for proving both identity and content integrity.

Exam trap

The trap here is that candidates confuse hashing (which provides integrity) with digital signatures (which provide both integrity and non-repudiation), leading them to pick hashing when the question explicitly requires proof of who signed it.

How to eliminate wrong answers

Option B is wrong because symmetric encryption only provides confidentiality (secrecy) of the contract file, not proof of who signed it or integrity verification; it uses a shared key that cannot uniquely tie a signature to an individual. Option C is wrong because hashing only provides integrity by producing a fixed-size hash of the content, but it does not prove who signed it or offer non-repudiation; anyone can compute the same hash. Option D is wrong because tokenization replaces sensitive data with a non-sensitive placeholder (token) for data protection, typically for payment or PII, and does not provide signing proof or integrity verification.

Full explanation →
862
MCQeasy

Based on the exhibit, what should the analyst do next to limit the impact of the suspected compromise?

A.Run a full antivirus scan first and wait for the results before taking any other action.
B.Isolate FIN-LT-22 from the network to contain the suspected malware activity.
C.Reboot the laptop to clear the malicious process from memory.
D.Reset the user's password and close the ticket after confirming they can log in again.
AnswerB

Network isolation is the best immediate containment step when an endpoint shows signs of active malicious behavior. It limits further command-and-control traffic, prevents lateral movement, and buys time for investigation. In incident response, containment comes before eradication and recovery when the threat is still active.

Why this answer

Isolating FIN-LT-22 from the network immediately stops the suspected malware from communicating with command-and-control servers or spreading laterally to other hosts. This containment step aligns with the NIST incident response framework's containment phase, which prioritizes limiting damage before eradication or recovery. In a suspected compromise, network isolation (e.g., disabling the switch port or using a host-based firewall rule) is the fastest way to cut off malicious traffic without destroying volatile evidence in memory.

Exam trap

The trap here is that candidates often choose to run an antivirus scan first (Option A) because they assume detection must precede containment, but the SY0-701 exam emphasizes that containment is the immediate priority to limit impact, even before identifying the specific malware.

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan first wastes critical time and may alert the attacker or trigger destructive actions before containment; antivirus also relies on signatures and may miss unknown malware. Option C is wrong because rebooting clears volatile memory (RAM), destroying evidence of the malicious process and potentially allowing persistence mechanisms to re-establish on startup, which violates forensic best practices. Option D is wrong because resetting the user's password does not address the active malware on the endpoint; the attacker could still maintain access via a backdoor or keylogger, and closing the ticket prematurely ignores the need for containment and eradication.

Full explanation →
863
MCQhard

Based on the exhibit, what is the best improvement to reduce the impact if one backup server is compromised?

A.Keep the same key file but rename it so attackers cannot find it easily.
B.Replace AES with SHA-256 so the backups are harder to read.
C.Store encryption keys in a centralized KMS or HSM and use distinct keys with rotation.
D.Email the key file to backup operators so they can restore data quickly.
AnswerC

This is the best improvement because the current design places the same key on every backup server, creating a large blast radius if one host is compromised. Centralized key management through a KMS or HSM improves control, auditing, rotation, and separation of duties. Distinct keys also limit how much data exposure results from one server compromise.

Why this answer

Using a centralized Key Management System (KMS) or Hardware Security Module (HSM) with distinct, rotated keys ensures that compromising one backup server does not expose the encryption keys for all backups. This isolates the impact to only the data encrypted with that specific key, and key rotation further limits the window of exposure. In contrast, sharing a single key file across servers creates a single point of failure, as compromising one server reveals the key for all backups.

Exam trap

The trap here is that candidates may think renaming or hiding the key file (Option A) is a valid security measure, but CompTIA tests the principle that security through obscurity (hiding files) is not a substitute for proper key management and isolation.

How to eliminate wrong answers

Option A is wrong because renaming the key file does not change the underlying cryptographic material; an attacker who compromises the server can still locate and use the key file regardless of its name, as file enumeration or registry searches can find it. Option B is wrong because SHA-256 is a hashing algorithm, not an encryption algorithm; it is one-way and cannot be used to encrypt or decrypt backups, making backups unrecoverable. Option D is wrong because emailing the key file to backup operators exposes the key in transit and at rest in email systems, violating security best practices and increasing the risk of interception or unauthorized access.

Full explanation →
864
MCQhard

Based on the exhibit, what should the administrator do next?

A.Install the update because a longer hash means the file is newer.
B.Re-download the update from the trusted source and verify the hash again.
C.Rename the file to match the vendor’s naming convention and retry installation.
D.Disable SHA-256 verification because patch files often change after download.
AnswerB

A hash mismatch means the local file does not match the vendor-published value. The safest next step is to obtain a fresh copy from a trusted source and compare the hash again. That helps determine whether the original download was corrupted in transit or tampered with before deployment.

Why this answer

If the hash of a downloaded file does not match the vendor-published hash, the file is likely corrupted or tampered with. The administrator should delete the corrupted file, re-download it from the trusted source, and recompute the hash to ensure integrity before installation. This follows the principle of verifying file integrity via cryptographic hashing (e.g., SHA-256) before applying updates.

Exam trap

The trap here is confusing hash length or file naming with file integrity, leading candidates to think a longer hash means a newer file or that renaming fixes hash mismatches, when in fact only re-downloading and re-verifying the hash ensures the file is authentic and uncorrupted.

How to eliminate wrong answers

Option A is wrong because hash length (e.g., SHA-256 vs SHA-512) is unrelated to file version or freshness; a longer hash does not indicate a newer file. Option C is wrong because renaming a file does not change its content or hash, so it will not resolve a hash mismatch. Option D is wrong because disabling SHA-256 verification would bypass integrity checks, allowing potentially malicious or corrupted files to be installed, which violates security best practices.

Full explanation →
865
MCQmedium

A security analyst is reviewing authentication logs and observes multiple failed login attempts for a single user account occurring within a short timeframe, followed by a successful login from an IP address located in a country where the user has never traveled. The failed attempts originate from various IP addresses and use different passwords. Which type of attack has most likely occurred?

A.Brute-force attack
B.Credential stuffing
C.Password spraying
D.Dictionary attack
AnswerA

Correct. A brute-force attack is characterized by systematically trying many different passwords against a single account until the correct one is found. The log pattern of multiple failed attempts followed by a success aligns with this method.

Why this answer

(Brute-force attack) because the log shows multiple failed login attempts from various IP addresses using different passwords, followed by a successful login from an unfamiliar country. This pattern indicates a distributed brute-force attack where the attacker systematically tries many passwords against a single account, often using a botnet or proxy rotation to evade IP-based rate limiting. The successful login from a foreign IP confirms the attacker eventually guessed the correct password.

Exam trap

The trap here is that candidates confuse 'multiple failed attempts from various IPs' with credential stuffing, but the key differentiator is that credential stuffing uses known credential pairs, not systematically generated passwords against a single account.

Why the other options are wrong

B

Credential stuffing uses previously breached username/password pairs from other services, but the question states the failed attempts used different passwords, not reused credentials from breaches.

C

Password spraying involves trying a single common password against many user accounts, not multiple passwords against a single account as described in the question.

D

A dictionary attack uses a predefined list of likely passwords (e.g., common words or variations) against a single account, but the question describes failed attempts with 'different passwords' from various IPs, which is more consistent with a brute-force attack that systematically tries many passwords.

When would these options actually be correct?

B

A security analyst sees multiple failed logins with the same username but different passwords, and later a successful login from a known breached credential list; the question would specify that the successful login used a password found in a recent data breach.

C

Password spraying would be correct if the question described multiple failed login attempts using the same password (e.g., 'Password123') across many different user accounts, followed by a successful login from an unusual location.

D

A dictionary attack would be correct if the question stated that the attacker used a wordlist of common passwords (e.g., 'password123', 'admin') against a single account, and the failed attempts showed passwords from that list, not random or systematically generated ones.

Why candidates pick the wrong answer

B

Candidates may confuse any attack using multiple passwords with credential stuffing, not realizing that credential stuffing specifically relies on reused credentials from prior breaches, not random password attempts.

C

Candidates may confuse password spraying with brute-force because both involve multiple login attempts, but they fail to note that password spraying targets many accounts with one password, while this scenario targets one account with many passwords.

D

Candidates may confuse 'dictionary attack' with any attack that tries multiple passwords, but the key distinction is that dictionary attacks use a curated list of likely passwords, not exhaustive or random attempts.

Full explanation →
866
Drag & Dropmedium

Drag and drop the steps for the SSH key exchange process in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

SSH key exchange establishes a secure channel; the server's host key is used to verify identity, and Diffie-Hellman generates a shared secret.

Full explanation →
867
MCQmedium

A software supplier used by your organization begins subcontracting a critical part of its service to an unknown hosting company. Which contractual control would BEST help manage this supply chain risk?

A.Require the supplier to send monthly sales updates to the procurement team.
B.Require advance notice and approval for subcontractor changes, plus right-to-audit and security obligations.
C.Ask the supplier to place all responsibility for the subcontractor on the customer.
D.Disable all vendor access immediately without reviewing the change.
AnswerB

This is the strongest contractual approach because it gives the organization visibility into changes, authority to review added risk, and leverage to enforce security requirements. When a supplier introduces a new subcontractor, advance notice, approval rights, and auditability help prevent hidden dependencies from undermining security expectations or compliance obligations.

Why this answer

It establishes a contractual control that requires the supplier to notify and obtain approval before subcontracting critical services, while also imposing right-to-audit and security obligations. This directly addresses supply chain risk by ensuring the organization can vet and monitor the subcontractor's security posture, as recommended by NIST SP 800-161 for supply chain risk management.

Exam trap

The trap here is that candidates confuse operational reporting (Option A) with security governance, or they assume immediate termination (Option D) is a valid risk response without considering contractual due process and business continuity.

How to eliminate wrong answers

Option A is wrong because monthly sales updates are a financial or operational reporting requirement, not a security control; they provide no visibility into the subcontractor's security practices or compliance with the organization's security policies. Option C is wrong because shifting all responsibility for the subcontractor to the customer defeats the purpose of contractual controls—it removes the supplier's accountability and leaves the organization without any enforceable security requirements on the subcontractor. Option D is wrong because immediately disabling all vendor access without reviewing the change is a reactive, disruptive response that violates change management best practices; it should be preceded by a risk assessment and coordinated with the supplier to avoid unnecessary service disruption.

Full explanation →
868
MCQmedium

Based on the exhibit, which action should the incident response team take next to eradicate the threat?

A.Return the workstation to the user since the outbound connection was blocked.
B.Delete only the scheduled task and reconnect the host to monitor for more alerts.
C.Reimage the endpoint from a known-good build and reset potentially exposed credentials.
D.Close the incident because memory capture has already preserved the evidence.
AnswerC

The logs show a likely malicious macro, encoded PowerShell, a dropped script, and persistence through a scheduled task. That combination indicates a high-confidence compromise with uncertain scope. Reimaging removes hidden persistence more reliably than piecemeal cleanup, and credential resets are appropriate because finance activity occurred on the device and credentials may have been captured.

Why this answer

The exhibit indicates a confirmed compromise (e.g., a scheduled task establishing outbound C2 traffic). Eradication requires removing all traces of the attacker's foothold, which is best achieved by reimaging the endpoint from a known-good build. Additionally, any credentials that may have been exposed during the compromise must be reset to prevent lateral movement or re-entry.

Exam trap

The trap here is that candidates may think deleting the scheduled task (Option B) is sufficient for eradication, but CompTIA emphasizes that any confirmed compromise requires full reimaging to ensure no hidden persistence remains.

How to eliminate wrong answers

Option A is wrong because simply returning the workstation to the user after blocking an outbound connection does not remove the underlying threat (e.g., the scheduled task or persistence mechanism) and assumes the attacker cannot adapt or use alternate C2 channels. Option B is wrong because deleting only the scheduled task leaves other potential persistence mechanisms (e.g., registry run keys, services, or WMI subscriptions) intact, and reconnecting the host without full remediation risks re-infection or continued attacker access. Option D is wrong because closing the incident after memory capture ignores the need for eradication; evidence preservation does not eliminate the active threat, and the host remains compromised.

Full explanation →
869
MCQmedium

A help desk team manages 300 Windows laptops. A legacy accounting app sometimes fails after updates, so the company wants to reduce patch risk while still preventing long-term exposure. Which patching strategy is the best balance?

A.Apply updates manually to each laptop as soon as they are released.
B.Use a pilot group and phased rollout process before wider deployment.
C.Postpone all updates until the legacy accounting app is replaced.
D.Disable automatic updates permanently and patch only after a security incident.
AnswerB

A pilot-to-broad rollout strategy lets the organization validate patches on a small set of representative devices before deploying them widely. That reduces the chance of a widespread compatibility problem while still keeping systems updated on a reasonable schedule. It is a practical balance between security, reliability, and operational risk.

Why this answer

A phased rollout with a pilot group is the most balanced approach. It allows the team to test new patches on a few systems that reflect the production environment before exposing the entire fleet to possible compatibility issues. That lowers operational risk while still ensuring the organization patches regularly, which is essential for reducing exposure to known vulnerabilities and maintaining a secure baseline.

Why others are wrong: Option A is too labor-intensive and still lacks controlled validation. Option C accepts avoidable risk by deferring all updates indefinitely. Option D is reactive and leaves the fleet exposed until an incident occurs. The correct answer is the only one that preserves security and operational stability at the same time.

Full explanation →
870
MCQeasy

A company laptop is collected as evidence in a suspected theft case. Which action best supports chain of custody?

A.Place the laptop on a desk until the investigator is available.
B.Record each transfer with date, time, handler name, and signatures.
C.Reset the laptop so the legal team can access it more easily.
D.Remove the hard drive and connect it to a personal workstation.
AnswerB

Chain of custody requires a documented record of who handled the evidence, when it changed hands, and under what conditions. These records help prove integrity and admissibility later. Accurate transfer documentation is one of the most important parts of evidence handling in a forensic case.

Why this answer

Chain of custody requires documenting every transfer of evidence with date, time, handler name, and signatures to maintain a verifiable record of who had possession of the laptop at all times. This ensures the evidence is admissible in court by proving it has not been tampered with or altered since collection. Without this documentation, the defense could argue the evidence was compromised, undermining the entire case.

Exam trap

CompTIA often tests the misconception that preserving evidence means making it easier to access (like resetting or removing components), when in fact the priority is maintaining the original state and documenting every touchpoint to ensure legal admissibility.

How to eliminate wrong answers

Option A is wrong because leaving the laptop on a desk unattended violates the principle of secure evidence handling, as it creates an unaccounted gap in custody where the device could be tampered with or accessed by unauthorized individuals. Option C is wrong because resetting the laptop destroys all data, including potential evidence such as logs, files, and user activity, which is irreversible and violates forensic best practices that require preserving the original state of evidence. Option D is wrong because removing the hard drive and connecting it to a personal workstation risks altering the drive's contents (e.g., timestamps, metadata) and introduces potential contamination from the workstation's operating system, breaking the chain of custody and compromising forensic integrity.

Full explanation →
871
MCQmedium

A finance analyst receives an email that appears to come from the CFO. It references a real project, asks for an urgent wire transfer to a "new vendor account," and says to avoid the normal approval workflow because the deal is time-sensitive. What is the best immediate response?

A.Reply to the email asking for additional payment details and wait for a response.
B.Process the transfer quickly because the message appears to come from an executive.
C.Verify the request using a known-good contact method and report the message as suspicious.
D.Forward the email to another finance employee so someone else can confirm the request.
AnswerC

The safest response is to independently verify the request through a trusted channel already on file, such as a known phone number or internal messaging system. That breaks the attacker’s control of the conversation and prevents a rushed financial error. Reporting the message also helps security staff search for related phishing attempts and protect other employees from a similar business email compromise attempt.

Why this answer

The best response is to verify the request through a known, trusted communication path and then report it. In a spear phishing or business email compromise scenario, the attacker relies on urgency, authority, and familiarity to bypass normal controls. A separate phone call, chat message, or in-person confirmation using an existing contact list provides stronger assurance than any reply to the suspicious email itself.

Why others are wrong: Replying, processing the transfer, or forwarding the message all keep the workflow inside the attacker’s channel and increase the chance of fraud. None of those actions independently validate the sender’s identity or the payment change request. The key security habit is to stop, verify outside the email thread, and escalate the suspicious communication.

Full explanation →
872
MCQmedium

A security analyst notices that a phishing campaign is targeting employees with emails that appear to be from the company's IT support team. The emails contain a link to a website that mimics the corporate password reset portal. Which of the following controls would be MOST effective in preventing users from reaching the malicious website, assuming the link uses HTTPS?

A.Implement a URL filtering policy on the company's web proxy.
B.Deploy an email security gateway that performs sandboxing of attachments.
C.Enable multi-factor authentication on all corporate accounts.
D.Conduct a security awareness training session on phishing.
AnswerA

Implementing URL filtering on the corporate web proxy is a preventive technical control that actively blocks access to known malicious, phishing, or lookalike domains at the network layer. The proxy inspects the requested URL and domain against real-time reputation feeds and policy categories; if the destination matches a threat intel blocklist, the connection is terminated before the browser loads the page. Because it operates in-line on HTTP and HTTPS traffic (using SNI/TLS inspection or DNS resolution), this control disrupts the phishing kill chain regardless of how the link was delivered, including via webmail, social media, or messaging apps. It does not rely on user judgment, making it a more consistent and automated safeguard than awareness training.

Why this answer

A URL filtering policy on the company's web proxy is the most effective control because it can block access to the malicious website based on its domain, category, or reputation, regardless of whether the link uses HTTPS. Since the proxy can perform SSL/TLS inspection (decrypting the HTTPS traffic) or use domain reputation lists, it prevents users from even reaching the phishing site. This directly addresses the core issue of users navigating to a known or suspicious URL.

Exam trap

The trap here is that candidates assume HTTPS encryption makes URL filtering impossible, but the exam expects you to know that web proxies can inspect or block HTTPS traffic using SSL/TLS decryption or domain-based filtering, making URL filtering still effective.

Why the other options are wrong

B

The question specifies that the link uses HTTPS, so sandboxing attachments is irrelevant because the threat is a link in the email body, not an attachment. Email sandboxing analyzes file attachments for malware, not URLs.

C

Multi-factor authentication (MFA) protects against credential theft after a user reaches a malicious site, but it does not prevent users from initially accessing the site. The question asks for a control to prevent reaching the malicious website, not to mitigate the impact of credential compromise.

D

Security awareness training educates users to recognize phishing, but it does not prevent users from reaching the malicious website if they click the link. The question asks for a control that prevents access to the site, not user behavior.

When would these options actually be correct?

B

An email security gateway with sandboxing would be correct if the phishing campaign included malicious attachments (e.g., PDFs or Office documents with embedded macros) that need to be detonated in a safe environment to detect threats.

C

In a scenario where a phishing campaign successfully harvests credentials and attackers attempt to log in to corporate accounts, enabling MFA would be the most effective control to block unauthorized access even if credentials are stolen.

D

A question asks: 'Which control is MOST effective in reducing the likelihood that employees will fall for a phishing campaign targeting password reset credentials?' In that context, training directly addresses user susceptibility.

Why candidates pick the wrong answer

B

Candidates may think that any email security solution can block phishing, but sandboxing specifically targets attachments, not links. They might confuse sandboxing with URL analysis or general email filtering capabilities.

C

Candidates may think MFA is a universal security solution and overlook that it addresses post-compromise risks rather than preventing initial access to malicious sites.

D

Candidates often overvalue training as a catch-all security measure, forgetting that technical controls like URL filtering block access regardless of user decisions.

Full explanation →
873
MCQeasy

After reviewing a risk memo, the operations director signs off on continuing to use an older application because the cost of replacement is too high right now. Which risk management action did the director take?

A.Risk transfer, because the risk was moved to another company.
B.Risk acceptance, because management chose to live with the remaining risk.
C.Risk avoidance, because the application is still being used.
D.Risk mitigation, because the replacement cost was too high.
AnswerB

Risk acceptance is the correct term when management knowingly approves continued operation despite identified risk. The director is not eliminating the issue or moving it elsewhere; instead, they are choosing to tolerate the residual risk for business reasons such as cost or timing. This is a normal part of risk management when the risk is understood and documented.

Why this answer

The operations director chose to continue using the older application despite the identified risk, explicitly because the cost of replacement was too high. This is the definition of risk acceptance: management acknowledges the risk and decides to tolerate the residual risk without implementing additional controls. The director did not transfer, avoid, or mitigate the risk; they accepted it as a cost of business.

Exam trap

The trap here is confusing 'acceptance' with 'avoidance' — candidates often think that continuing to use the application means avoiding the risk, but avoidance requires stopping the risky activity entirely, not just living with it.

How to eliminate wrong answers

Option A is wrong because risk transfer would involve shifting the financial impact of the risk to a third party (e.g., purchasing cyber insurance or outsourcing the application), not simply continuing to use it. Option C is wrong because risk avoidance means ceasing the activity that generates the risk (e.g., decommissioning the application), but the director explicitly chose to keep using it. Option D is wrong because risk mitigation would involve implementing controls to reduce the likelihood or impact of the risk (e.g., patching or adding a WAF), not rejecting mitigation due to cost.

Full explanation →
874
MCQeasy

A server room is sometimes left open while technicians carry equipment in and out. Which control best helps detect and discourage unauthorized entry?

A.A written reminder poster on the wall
B.A CCTV camera covering the entrance
C.A brighter color for the server room door
D.A larger monitor in the nearby office
AnswerB

A CCTV camera covering the entrance provides continuous surveillance, which both deters opportunistic intrusion and creates a forensic record of anyone who approaches or enters the server room. Video footage serves as an auditable trail that can be reviewed during incident investigations, and modern systems can integrate with motion detection, cloud storage, and retention policies for extended evidence availability. While it does not physically block entry, it actively monitors the perimeter and provides accountability, making it a critical detective and deterrent control.

Why this answer

A CCTV camera covering the entrance provides continuous monitoring and recording of activity, which both detects unauthorized entry in real time and creates a deterrent effect through the awareness of surveillance. Unlike passive measures, it offers forensic evidence and can be integrated with access control systems to alert security personnel of breaches.

Exam trap

The trap here is that candidates may confuse administrative controls like signage with detective controls, overlooking that only active surveillance (CCTV) provides both detection and deterrence for an unsecured physical entry point.

How to eliminate wrong answers

Option A is wrong because a written reminder poster is a passive administrative control that relies on voluntary compliance and provides no detection or deterrence against intentional unauthorized entry. Option C is wrong because a brighter color for the door is purely cosmetic and has no impact on security monitoring, access control, or deterring unauthorized individuals.

Full explanation →
875
MCQeasy

A SIEM alert shows one workstation connecting to many internal systems over SMB in a short period of time, followed by attempts to access administrative shares. What is the best response?

A.Ignore the alert because SMB is a normal file-sharing protocol
B.Isolate the workstation to stop possible lateral movement
C.Increase the workstation's monitor brightness to help the user notice alerts
D.Disable all SMB traffic across the entire company immediately
AnswerB

Isolating the workstation is the correct immediate response because the rapid SMB connections to multiple hosts indicate the attacker may be pivoting or spreading laterally. Removing the host from the network, either by disconnecting the cable or disabling the switch port, contains the blast radius while preserving volatile memory and network logs for forensic investigation. This aligns with NIST SP 800-61's containment phase, which prioritizes stopping propagation before eradication or recovery. Later steps can include blocking the account, patching the SMB service, and analyzing the observed behavior to identify the root cause.

Why this answer

The SIEM alert describes classic indicators of lateral movement using SMB, often associated with ransomware or worm-like malware. Isolating the workstation immediately stops the attacker from spreading to other systems via administrative shares (e.g., ADMIN$, C$), which are commonly abused for remote execution. This containment step is the highest priority before any forensic analysis.

Exam trap

The trap here is that candidates may dismiss the alert as normal SMB traffic (Option A) because SMB is common, failing to recognize that the combination of rapid connections and administrative share access is a textbook lateral movement indicator.

How to eliminate wrong answers

Option A is wrong because while SMB is a normal file-sharing protocol, the specific pattern of rapid connections to many internal systems followed by administrative share access is highly anomalous and indicative of malicious lateral movement, not legitimate use. Option C is wrong because increasing monitor brightness has no security function and does not address the alert; it is a nonsensical response that confuses physical display settings with security operations. Option D is wrong because disabling all SMB traffic company-wide is an overly drastic and disruptive response that would break critical business operations, and it should only be considered after proper investigation and with targeted controls like firewall rules or GPO changes.

Full explanation →
876
MCQeasy

A user forwards an email that says their payroll account will be disabled today unless they click a link and verify their password. The message uses the company logo, but the sender address is from a free webmail domain and the link goes to a look-alike login page. What type of attack is this?

A.Baiting, because the attacker is offering something attractive to lure the user.
B.Phishing, because the attacker is using a fraudulent message to steal credentials.
C.Vishing, because the attacker is trying to trick the user into revealing information.
D.Impersonation, because the attacker is pretending to be someone from the company.
AnswerB

Phishing is the best match because the attacker is sending a deceptive message that impersonates a trusted source and directs the user to a fake login page. The goal is credential theft, and the urgency plus look-alike site are common signs. The sender address and request to verify a password are strong indicators of a phishing attempt.

Why this answer

This is a classic phishing attack because the attacker uses a fraudulent email that mimics a legitimate company to trick the user into clicking a link to a look-alike login page, with the goal of stealing their payroll credentials. The key indicators are the spoofed company logo, the free webmail sender address, and the fake login page, all of which are hallmarks of credential harvesting via phishing.

Exam trap

The trap here is that candidates may confuse phishing with vishing or baiting because all involve social engineering, but the specific use of email with a fraudulent link to a fake login page is the defining characteristic of phishing, not voice calls (vishing) or physical lures (baiting).

How to eliminate wrong answers

Option A is wrong because baiting involves offering something attractive (e.g., a free USB drive or download) to lure the victim into a trap, not sending a deceptive email requesting credential verification. Option C is wrong because vishing (voice phishing) uses phone calls or voice messages to trick victims, not email with a link to a fake login page. Option D is wrong because impersonation is a broader social engineering tactic that can be part of phishing, but the specific attack described—using a fraudulent email with a malicious link—is precisely defined as phishing, not impersonation alone.

Full explanation →
877
MCQmedium

A support portal searches customers by last name using a parameter called q. After one user enters a single quote, the app returns a SQL syntax error. A tester then submits `test' OR '1'='1` and sees every customer record. Which control most directly prevents this issue?

A.Parameterize the database queries with prepared statements
B.Encode all output returned to the browser
C.Add CSRF tokens to the login form
D.Move the application to a separate VLAN
AnswerA

Prepared statements parameterize user input so the database engine compiles the SQL query structure once, before any data is bound. The search term is passed as a pure string parameter, never concatenated into the SQL text, so malicious input like ' OR 1=1 -- cannot alter the query's WHERE clause semantics. This eliminates the injection payload's ability to change the query's logical structure.

Why this answer

The vulnerability is SQL injection, which occurs when user input is directly concatenated into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data by using placeholders, ensuring user input is treated as data only and never executed as code. This directly prevents the attacker from injecting malicious SQL fragments like `' OR '1'='1`.

Exam trap

The trap here is that candidates often confuse output encoding (XSS prevention) with input handling (SQL injection prevention), or they think network controls like VLANs can fix application-layer code flaws.

How to eliminate wrong answers

Option B is wrong because encoding output prevents cross-site scripting (XSS), not SQL injection; the attack occurs on the database backend, not in the browser. Option C is wrong because CSRF tokens prevent cross-site request forgery, which tricks a user into submitting unintended requests, but does not stop an attacker from directly crafting malicious input in the search parameter. Option D is wrong because moving the application to a separate VLAN is a network segmentation control that limits lateral movement but does not fix the insecure database query code; the SQL injection would still succeed from the application server.

Full explanation →
878
MCQmedium

A company stores customer documents in cloud object storage. The provider already offers encryption at rest and physical security. Which action most directly reduces the risk of unauthorized access to the stored files?

A.Assume the provider's default settings are sufficient because encryption at rest is already enabled.
B.Move the documents to a public bucket so users can access them without friction.
C.Configure least-privilege IAM roles, bucket policies, and object permissions for approved users only.
D.Disable encryption at rest so administrators can troubleshoot access problems more easily.
AnswerC

In the shared responsibility model, the customer is responsible for managing access controls on the objects they store, and least privilege ensures each approved user or application receives only the permissions necessary to perform its function. This is accomplished by combining IAM roles that define a principal's allowed actions, bucket policies that restrict who can access the bucket and under what conditions (e.g., source IP or MFA), and object permissions like ACLs or condition keys that scope access to specific objects. Configuring these elements for approved users only minimizes the attack surface and helps meet compliance requirements by preventing unauthorized GetObject calls.

Why this answer

Even with encryption at rest and physical security, unauthorized access can occur if IAM policies, bucket policies, and object permissions are overly permissive. Configuring least-privilege access ensures that only approved users can read or modify the stored files, directly reducing the attack surface. Encryption at rest protects data if storage media is compromised, but it does not prevent authorized users with excessive permissions from accessing files they shouldn't.

Exam trap

The trap here is that candidates confuse encryption at rest with access control, assuming that encryption alone prevents unauthorized access, when in fact it only protects against physical theft of storage media, not against API-level access by users with excessive permissions.

How to eliminate wrong answers

Option A is wrong because assuming default settings are sufficient ignores the principle of least privilege; default IAM roles and bucket policies are often overly permissive (e.g., public read access) and must be explicitly hardened. Option B is wrong because moving documents to a public bucket would expose them to anyone on the internet, directly increasing the risk of unauthorized access. Option D is wrong because disabling encryption at rest would leave data vulnerable if an attacker gains physical access to the storage media or if the provider suffers a breach, and it does not solve access control issues.

Full explanation →
879
Matchingeasy

Match each principle to the scenario that best illustrates it.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

A database account can update records but cannot approve purchases.

A contractor can view only the log source tied to the assigned ticket.

One person prepares a wire transfer and another authorizes it.

The portal checks the device and user again before each sensitive action.

The application is protected by MFA, filtering, and endpoint controls.

Why these pairings

Least privilege limits access rights; separation of duties divides critical tasks; defense in depth uses multiple security layers; need to know restricts data access; accountability tracks actions; fail safe ensures security on failure.

Full explanation →
880
MCQhard

Based on the exhibit, which attack is most likely occurring on the local network?

A.DNS cache poisoning
B.ARP spoofing
C.Replay attack
D.Amplification denial-of-service
AnswerB

The host receives repeated ARP replies claiming the gateway IP belongs to a different MAC address, and the same MAC appears on multiple switch ports. That combination indicates ARP spoofing or poisoning, which can redirect traffic through an attacker for interception or disruption. The brief forwarding to another IP is consistent with a man-in-the-middle attempt built on forged ARP replies.

Why this answer

ARP spoofing is the most likely attack because the exhibit shows an attacker sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This poisons the ARP cache of the victim, causing all traffic destined for the gateway to be sent to the attacker instead, enabling man-in-the-middle interception.

Exam trap

The trap here is that candidates confuse ARP spoofing with DNS cache poisoning because both involve 'poisoning' a cache, but ARP operates at Layer 2 (MAC addresses) while DNS operates at Layer 7 (domain name resolution).

How to eliminate wrong answers

Option A is wrong because DNS cache poisoning involves corrupting a DNS resolver's cache with false DNS records, not manipulating ARP tables at Layer 2. Option C is wrong because a replay attack captures and retransmits valid data packets to trick the receiver, but the exhibit shows direct manipulation of MAC-to-IP mappings, not packet replay. Option D is wrong because an amplification denial-of-service attack uses small queries to generate large responses (e.g., DNS amplification), overwhelming a target with traffic, whereas the exhibit depicts local network ARP manipulation.

Full explanation →
881
MCQmedium

An organization is evaluating a payroll SaaS provider after the procurement team asks for evidence that the vendor's security controls were designed and operating effectively during the past year. Which document should the security team review first?

A.Memorandum of understanding
B.SOC 2 Type II report
C.Software license agreement
D.Network diagram of the vendor's data center
AnswerB

A SOC 2 Type II report is an independent auditor's attestation of a service organization's controls related to the Trust Services Criteria (e.g., security, availability, confidentiality) over a specified period. The 'Type II' designation specifically indicates that the auditor tested and opined on the operating effectiveness of those controls throughout the review window, not just their design. This directly provides procurement or security teams with assurance that the vendor's security controls were functioning as claimed, which is exactly the evidence needed for a third-party risk assessment of a payroll SaaS provider.

Why this answer

A SOC 2 Type II report provides an independent auditor's assessment of a service organization's controls over a period of time (typically 6–12 months), confirming that security controls were not only designed but also operating effectively. This directly meets the procurement team's need for evidence of the vendor's security posture over the past year, as required for evaluating a SaaS provider handling sensitive payroll data.

Exam trap

The trap here is that candidates may confuse a SOC 2 Type I report (which only tests control design at a point in time) with a Type II report (which tests operating effectiveness over a period), or they may mistakenly think a network diagram or legal agreement provides evidence of control effectiveness.

How to eliminate wrong answers

Option A is wrong because a Memorandum of Understanding (MOU) is a non-binding agreement outlining mutual intentions and responsibilities, not an audited report of control effectiveness. Option C is wrong because a Software License Agreement defines usage rights, fees, and legal terms, but does not provide evidence of security control design or operational effectiveness. Option D is wrong because a network diagram shows the vendor's data center architecture but offers no proof that security controls were actually implemented or operating effectively over the past year.

Full explanation →
882
MCQeasy

A company wants to reduce the chance that a stolen password can be used to access employee email. Which control is the best fit?

A.Password complexity requirements only
B.Multi-factor authentication
C.Daily backup verification
D.Security awareness posters
AnswerB

Multi-factor authentication adds another verification step beyond the password, so an attacker who steals only a password still cannot easily log in. It is a practical preventive control for reducing account takeover risk, especially for email and other internet-facing services where passwords may be phished, reused, or exposed in breaches.

Why this answer

Multi-factor authentication (MFA) requires at least two different authentication factors (e.g., something you know like a password and something you have like a time-based one-time password from an authenticator app). Even if an attacker steals the password, they cannot access the email without the second factor, directly reducing the risk of credential theft leading to account compromise.

Exam trap

The trap here is that candidates often choose password complexity (A) thinking stronger passwords prevent theft, but the question explicitly states the password is already stolen, so only a second factor like MFA can block its use.

How to eliminate wrong answers

Option A is wrong because password complexity requirements only make passwords harder to guess or crack, but they do nothing to prevent a stolen password from being reused by an attacker who already possesses it. Option C is wrong because daily backup verification ensures data recoverability in case of loss or ransomware, but it does not prevent unauthorized access to email accounts. Option D is wrong because security awareness posters educate users about threats but provide no technical enforcement to block an attacker using a stolen password.

Full explanation →
883
MCQeasy

An employee receives a phone call from someone claiming to be IT and asking for a one-time verification code to "fix" the employee's account. What is the best response?

A.Provide the code quickly so the support call can be completed without delay.
B.Refuse to share the code and report the call through the company's security process.
C.Reply to the caller by email with the code and ask them to confirm receipt.
D.Change the password immediately and then tell the caller the new password.
AnswerB

The safest response is to refuse the request and report it through the organization’s approved security process. One-time codes should never be shared because they can be used to bypass MFA and hijack the account. Reporting the call helps the security team warn others, investigate the attempt, and reduce the chance of a successful attack.

Why this answer

It follows the principle of never sharing authentication factors, especially one-time verification codes, with anyone over the phone. This scenario is a classic social engineering attack (vishing) where the attacker attempts to bypass multi-factor authentication (MFA) by tricking the employee into revealing a time-based one-time password (TOTP) or similar code. Reporting the call through the company's security process allows the incident to be investigated and mitigates further risk.

Exam trap

The trap here is that candidates may think providing the code is harmless because it is 'one-time' or that changing the password is a proactive security measure, but both actions directly hand over authentication secrets to an unverified caller.

How to eliminate wrong answers

Option A is wrong because providing the code directly enables the attacker to authenticate as the employee, compromising the account and any MFA-protected resources. Option C is wrong because replying by email with the code still shares the secret with an unverified caller, and email is not a secure channel for transmitting authentication factors; it also does not verify the caller's identity. Option D is wrong because changing the password and then telling the caller the new password gives the attacker direct access to the account, bypassing any security controls; the employee should never share credentials with anyone.

Full explanation →
884
MCQeasy

A finance manager can view only the reports needed for monthly budgeting and cannot see payroll details. Which principle is being applied?

A.Need-to-know, because access is limited to information required for the job.
B.Zero trust, because the manager uses a password to sign in.
C.Separation of duties, because the manager is part of finance.
D.Defense in depth, because only one report system is being used.
AnswerA

Need-to-know limits access to information based on business need. The finance manager can view budgeting reports, but payroll details are withheld because they are not required for the role.

Why this answer

The principle of need-to-know restricts access to only the information necessary for an individual to perform their job duties. In this scenario, the finance manager can view only monthly budgeting reports and is explicitly blocked from payroll details, which aligns directly with need-to-know. This is typically enforced through access control lists (ACLs) or role-based access control (RBAC) policies that limit data visibility based on job function.

Exam trap

The trap here is confusing need-to-know with least privilege, as both limit access, but need-to-know specifically restricts data visibility rather than system permissions or actions.

How to eliminate wrong answers

Option B is wrong because zero trust is a security model that assumes no implicit trust and requires continuous verification of every access request, not simply using a password to sign in. Option C is wrong because separation of duties divides critical tasks among multiple people to prevent fraud or error, not to limit data visibility based on job role. Option D is wrong because defense in depth involves multiple layers of security controls (e.g., firewalls, IDS, encryption), not restricting access to a single report system.

Full explanation →
885
Matchinghard

Match each awareness-program metric or pattern to the best interpretation. Use each interpretation once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Improved phishing resistance

Better escalation culture

Faster detection and triage

Targeted refresher coaching needed

Why these pairings

Phishing click rate measures susceptibility, reporting rate indicates vigilance, training completion rate shows participation, repeat offender rate identifies high-risk users, time to report reflects responsiveness, and knowledge assessment score measures understanding.

Full explanation →
886
Matchingmedium

Match each incident response action to its primary purpose during a suspected endpoint compromise.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Contain the incident and limit spread to other systems

Preserve evidence that could disappear after power-off

Eradicate persistence and return the system to a trusted state

Recover business operations and return service to normal

Complete lessons learned and improve future response

Why these pairings

Incident response actions are sequenced to contain, preserve, analyze, remove, and learn from the incident. Isolating prevents spread; volatile data capture is time-sensitive; imaging preserves evidence; log analysis reveals details; eradication cleans the system; lessons learned improve processes.

Full explanation →
887
MCQmedium

A security analyst in the SOC is investigating a potential DNS tunneling incident. The analyst has identified a workstation that is making thousands of DNS queries to an external domain with base64-encoded subdomains. The analyst suspects that sensitive files from the workstation are being exfiltrated by encoding their contents into the subdomains of the DNS queries. Which of the following log sources will provide the most definitive evidence to confirm that the contents of a specific sensitive file are being transmitted in the DNS queries?

A.The DNS server logs showing the queried domains and subdomains.
B.The workstation's process creation logs showing which process initiated the DNS queries.
C.A full packet capture of the network traffic from the workstation showing the complete DNS messages.
D.The firewall logs showing outbound connections from the workstation to the external DNS server on port 53.
AnswerC

A full packet capture includes the entire DNS query packet, including the complete subdomain portion. The analyst can extract and decode the base64-encoded subdomain data and compare it directly to the contents of a sensitive file on the workstation to definitively confirm data exfiltration.

Why this answer

A full packet capture (PCAP) contains the complete DNS query and response messages, including the raw payload of the subdomain fields. This allows the analyst to extract the base64-encoded data from the subdomains and decode it to verify that it matches the contents of the suspected sensitive file. DNS server logs (option A) typically only record the queried domain names, not the full DNS message payload, and may truncate long subdomains.

Process creation logs (option B) show which executable made the queries but not the data being sent. Firewall logs (option D) only show connection metadata (source, destination, port) and never the DNS query content.

Exam trap

The trap here is that candidates assume DNS server logs contain the full query payload, but in practice they often log only the resolved domain name and may truncate long subdomains, making packet capture the only definitive source for reconstructing exfiltrated data.

Why the other options are wrong

A

DNS server logs typically show only the queried domain names and subdomains, not the full DNS message payload. Since base64-encoded subdomains are part of the query, the logs would reveal the encoded data, but without the full packet capture, you cannot definitively confirm that the contents of a specific sensitive file are being transmitted—you only see the encoded strings, not the original file content or the exact mapping.

B

Process creation logs show which process initiated the DNS queries but do not reveal the actual content of the DNS queries, such as the base64-encoded subdomains carrying exfiltrated data.

D

Firewall logs show only connection metadata (IPs, ports, timestamps) and cannot reveal the contents of DNS queries, so they cannot confirm that file contents are being transmitted.

When would these options actually be correct?

A

A question asks: 'Which log source would best identify the external domain and subdomains being queried in a DNS tunneling incident?' In that case, DNS server logs directly show the queried domains and subdomains, making them the most definitive source for that specific purpose.

B

When investigating a malware infection where the primary concern is identifying the malicious executable responsible for initiating suspicious network connections, process creation logs would provide definitive evidence of the process involved.

D

A question asks which log source best identifies the external IP address and port used by a workstation for DNS tunneling, where the goal is to block the connection rather than inspect payload content.

Why candidates pick the wrong answer

A

Candidates may think DNS server logs capture all query details, but they often lack the full packet payload needed to reconstruct the exfiltrated data. The base64 subdomains are visible, but without the complete DNS message, you cannot prove the file content is being transmitted.

B

Candidates may think that identifying the process is sufficient to confirm data exfiltration, overlooking that the content of the DNS queries is needed to prove the sensitive file's contents are being transmitted.

D

Candidates may think firewall logs capture all outbound traffic details, but they lack the application-layer data needed to see DNS query payloads.

Full explanation →
888
Multi-Selectmedium

A regulated analytics workload must run in a public cloud with the strongest practical tenant isolation while avoiding management of physical servers. The workload should also remain off the public internet. Which two deployment choices best fit? Select two.

Select 2 answers
A.Run the workload on a dedicated host or dedicated instance.
B.Place the workload in a private subnet without a public IP address.
C.Use shared tenancy with security groups only.
D.Assign an elastic IP so administrators can reach the workload directly from anywhere.
E.Expose the workload through a public load balancer to simplify connectivity.
AnswersA, B

Dedicated compute placement provides stronger tenant isolation than shared hardware and is appropriate when a regulated workload needs a higher separation level. It also keeps the organization in a cloud model without requiring ownership of physical servers.

Why this answer

A dedicated host or dedicated instance provides the strongest practical tenant isolation in a public cloud by ensuring that the underlying physical server is not shared with any other customer. This meets the regulatory requirement for strong isolation while avoiding the need to manage physical servers, as the cloud provider still handles hardware maintenance. The dedicated instance model (e.g., AWS Dedicated Instances) offers hardware-level isolation at the instance level, while a dedicated host gives you visibility and control over the physical server, both without requiring you to manage the server itself.

Exam trap

The trap here is that candidates often confuse network isolation (private subnet) with tenant isolation (physical hardware separation), or they assume that a public load balancer can be used without exposing the workload to the internet, forgetting that the load balancer itself has a public endpoint.

Full explanation →
889
Matchinghard

Match each business situation to the best risk treatment. Use each treatment once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Accept risk

Mitigate risk

Transfer risk

Avoid risk

Why these pairings

Risk treatment decisions are based on likelihood and impact: accept low risks, avoid high-high risks, mitigate medium risks, and transfer risks that are high likelihood but low impact or low likelihood but high impact.

Full explanation →
890
MCQmedium

A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?

A.SQL injection, because the attacker likely altered a database query.
B.Cross-site scripting, because the attacker could have injected script into the portal.
C.Insecure deserialization, because a crafted object triggered unexpected server-side actions.
D.CSRF, because the attacker may have forced an administrator to submit a form.
AnswerC

Insecure deserialization occurs when an application accepts untrusted serialized data and rebuilds it unsafely. That can allow an attacker to trigger code paths, remote lookups, or even command execution, which matches the LDAP activity and account creation.

Why this answer

The scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.

Exam trap

The trap here is that candidates may confuse insecure deserialization with other injection attacks (SQLi or XSS) because all involve untrusted input, but only deserialization directly allows server-side object reconstruction and arbitrary method invocation without proper validation.

How to eliminate wrong answers

Option A is wrong because SQL injection involves manipulating database queries through input fields, not through serialized objects; the described behavior (LDAP calls and account creation) is not typical of SQL injection, which primarily targets data extraction or modification. Option B is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, not server-side object deserialization; XSS cannot directly cause the server to make outbound LDAP calls or create local accounts.

Full explanation →
891
MCQmedium

A security manager at a financial services company is evaluating the effectiveness of a newly deployed security awareness training program. The program included modules on recognizing phishing emails, password security, and tailgating. One month after the training, the manager wants to assess whether employees are applying the learned behaviors to reduce the risk of phishing attacks. Which of the following metrics would provide the most valid indication of the training's behavioral impact?

A.The percentage of employees who completed the training modules.
B.The average score on the post-training knowledge quiz.
C.The number of reported phishing incidents to the security team.
D.The reduction in the employee click-through rate on simulated phishing campaigns.
AnswerD

Simulated phishing campaigns provide a controlled, realistic threat environment that measures employees' actual clicking behavior rather than their theoretical knowledge. Comparing pre-training baseline click-through rates to post-training rates isolates the training's behavioral impact, directly showing whether employees now recognize and avoid phishing lures. This metric is the gold standard for security awareness effectiveness because it captures the exact risky behavior the training aims to reduce.

Why this answer

The reduction in the employee click-through rate on simulated phishing campaigns directly measures a change in behavior—specifically, whether employees are applying the training to avoid clicking malicious links. Unlike knowledge scores or completion rates, this metric captures real-world application of the learned behavior in a controlled, measurable environment.

Exam trap

The trap here is that candidates confuse knowledge assessment (quiz scores) or participation metrics (completion rates) with behavioral metrics, but the exam specifically tests the distinction between measuring 'knowing' versus 'doing' in security awareness programs.

Why the other options are wrong

A

Completion percentage measures participation, not behavioral change. The manager wants to assess whether employees are applying learned behaviors to reduce phishing risk, not just that they took the training.

B

The average score on the post-training knowledge quiz measures theoretical understanding, not actual behavioral change. The question specifically asks for evidence that employees are applying learned behaviors to reduce phishing risk, which requires a behavioral metric like click-through rate reduction.

C

The number of reported phishing incidents does not directly measure behavioral change; it may increase due to better reporting rather than reduced susceptibility. The question asks for the impact on reducing phishing risk, which is best measured by click-through rates on simulated phishing campaigns.

When would these options actually be correct?

A

A question asking for a metric to ensure training delivery compliance, such as 'Which metric best indicates that all employees have received the required security awareness training?'

B

This option would be correct if the question asked: 'Which metric best indicates that employees understood the training content?' or 'Which metric should be used to evaluate the immediate knowledge retention from the training program?'

C

This metric would be correct if the question asked: 'Which metric best indicates employees are actively reporting suspicious emails after security awareness training?' In that context, an increase in reported incidents demonstrates application of reporting behavior.

Why candidates pick the wrong answer

A

Candidates may confuse training completion with training effectiveness, assuming that if everyone completed the training, it must have been effective.

B

Candidates may assume that a high quiz score directly translates to real-world behavior, overlooking the gap between knowledge and action. They might also think that post-training assessment is the standard way to measure training effectiveness.

C

Candidates may think that more reported incidents indicate greater security awareness, overlooking that reporting is a separate behavior from avoiding phishing clicks, and that increased reporting can occur even if click rates remain high.

Full explanation →
892
Matchingeasy

Match each control type to the best description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Stops a threat before it succeeds.

Identifies an event after or while it is happening.

Fixes a problem after it has occurred.

Discourages an attacker from trying.

Provides an alternate safeguard when the preferred control is not possible.

Why these pairings

Control types are categorized by nature: administrative involves rules, technical involves technology, physical involves tangible barriers, logical involves software-based access, operational involves processes, and legal/regulatory involves compliance.

Full explanation →
893
MCQhard

Based on the exhibit, which change best improves recovery resilience against a repeat ransomware incident?

A.Keep the current design and add more NAS storage capacity.
B.Move the NAS to the same subnet as the file server for faster backups.
C.Use an immutable or offline backup copy that production credentials cannot modify.
D.Shorten the backup retention period to reduce storage use.
AnswerC

The incident showed that the attacker could encrypt both production and the backup share because the backup target stayed online and writable. An immutable or offline copy breaks that dependency and prevents the same credentials from destroying recovery data. In ransomware recovery, backup survivability matters more than convenience, so this change gives the strongest resilience improvement.

Why this answer

Ransomware often encrypts or deletes accessible backups. An immutable or offline backup copy (e.g., using S3 Object Lock, Write Once Read Many (WORM) storage, or air-gapped tape) ensures that even if production credentials are compromised, the backup data cannot be modified or deleted by the attacker. This directly preserves a clean recovery point after a ransomware incident.

Exam trap

The trap here is that candidates often assume faster backups (Option B) or more capacity (Option A) improve resilience, but they overlook the fundamental requirement that backups must be protected from modification by the attacker, which only immutability or an air gap provides.

How to eliminate wrong answers

Option A is wrong because adding more NAS storage capacity does not protect existing backups from being encrypted or deleted by ransomware; it only increases the volume of data at risk. Option B is wrong because moving the NAS to the same subnet as the file server exposes the backup storage to the same network-based attacks and lateral movement, making it easier for ransomware to reach and corrupt the backups. Option D is wrong because shortening the backup retention period reduces the number of available recovery points, increasing the risk of data loss and potentially eliminating the last clean backup before the ransomware attack.

Full explanation →
894
MCQmedium

Based on the exhibit, which attack is most likely being attempted against the application?

A.Cross-site scripting, because the attacker is trying to inject script into the victim's browser session.
B.Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.
C.Cross-site request forgery, because the attacker is forcing an authenticated user to submit an unwanted request.
D.SQL injection, because the attacker is manipulating a query parameter to expose backend data.
AnswerB

The application accepts a URL parameter and then makes outbound requests to internal resources, including the cloud metadata endpoint. That is the hallmark of SSRF. The attacker is causing the server to reach addresses that should not normally be accessible through a public request path.

Why this answer

The exhibit shows an attacker manipulating a URL parameter (e.g., `?url=http://169.254.169.254/latest/meta-data/`) to make the application fetch an internal resource. This is a classic Server-Side Request Forgery (SSRF) attack, where the application is tricked into making requests to internal services (like cloud metadata endpoints) on the attacker's behalf, bypassing network segmentation.

Exam trap

CompTIA often tests SSRF by showing a URL parameter like `?url=` or `?file=` pointing to an internal IP (e.g., 127.0.0.1 or 169.254.169.254), and candidates confuse it with CSRF because both involve 'forged requests,' but SSRF is server-side while CSRF is client-side.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into a victim's browser, not manipulating server-side requests to internal resources. Option C is wrong because cross-site request forgery (CSRF) forces an authenticated user to submit an unwanted request (e.g., via a forged HTTP POST), but the exhibit shows the attacker directly controlling the request URL, not relying on a victim's session. Option D is wrong because SQL injection targets database queries via input fields (e.g., `' OR 1=1--`), not URL parameters that trigger server-side HTTP requests to internal IPs.

Full explanation →
895
Multi-Selectmedium

EDR flags encoded PowerShell launched by a spreadsheet application and an outbound HTTPS connection to a rare domain. Which two response actions are best to take from the EDR console first? Select two.

Select 2 answers
A.Isolate the endpoint from the network through the EDR platform
B.Collect a triage package or memory snapshot before remediation, if supported
C.Uninstall the spreadsheet application immediately
D.Reboot the endpoint to clear the suspicious script
E.Wait for a second alert before taking any action
AnswersA, B

Endpoint isolation via the EDR agent should be the immediate response because it severs active command-and-control channels and prevents lateral movement to adjacent hosts, while the management plane remains available for authorized forensic actions. Unlike unplugging the network cable, EDR-based isolation allows the responder to push collection tools or pull telemetry, preserving the host's state for memory analysis. This containment step aligns with incident response priorities: stop the spread before eradication, and retain visibility into the attacker's activity.

Why this answer

Isolating the endpoint from the network (A) is correct because it immediately stops the outbound HTTPS connection to the rare domain, preventing potential command-and-control (C2) data exfiltration or further payload download. Collecting a triage package or memory snapshot (B) is correct because the encoded PowerShell script and suspicious process chain are volatile artifacts that may be lost on reboot or remediation, and capturing them preserves forensic evidence for analysis.

Exam trap

CompTIA often tests the misconception that rebooting or uninstalling the application is a valid first response, when in fact both destroy volatile evidence and fail to contain the active threat.

Full explanation →
896
Multi-Selectmedium

A company wants to detect unauthorized changes to production server configurations before users notice an outage. Which two controls best fit this goal? Select two.

Select 2 answers
A.File integrity monitoring on critical system files
B.Centralized alerting on configuration-change events from the SIEM
C.Full-disk encryption on the server volumes
D.Multifactor authentication for remote administrators
E.Network segmentation between user VLANs and server VLANs
AnswersA, B

File integrity monitoring (FIM) on critical system files is a detective control that establishes a cryptographic baseline (e.g., SHA-256 hashes) for protected files and configuration artifacts. On a periodic or real-time basis, FIM agents recalculate hashes and compare them against that baseline, flagging any deviation that could indicate unauthorized tampering. For example, changes to /etc/shadow, Windows registry keys, or web server configuration files immediately generate an alert, satisfying the requirement to detect unauthorized changes even though it does so after the fact.

Why this answer

File integrity monitoring (FIM) on critical system files is correct because it detects unauthorized changes by comparing current file hashes against a known-good baseline. When a change occurs, FIM generates an alert, enabling the security team to investigate before users notice an outage. This directly addresses the goal of detecting configuration tampering proactively.

Exam trap

The trap here is that candidates often confuse preventive controls (like encryption or MFA) with detective controls (like FIM and SIEM alerting), leading them to select options that prevent access but do not detect changes after they happen.

Full explanation →
897
Multi-Selecteasy

A company wants employees to sign in once with corporate credentials and access multiple SaaS apps without creating separate passwords for each service. Which two features best support this goal? Select two.

Select 2 answers
A.Federation trust between the corporate identity provider and the SaaS provider.
B.Single sign-on so users authenticate once and reuse that session across apps.
C.Shared generic accounts for each department.
D.Storing the same password inside every SaaS application.
E.Disabling MFA so the sign-in process is faster.
AnswersA, B

Federation trust is a technical relationship established between the corporate identity provider (IdP) and the SaaS provider's service (SP), often via standards like SAML 2.0 or OIDC. The SP relies on security assertions/tokens issued by the IdP, eliminating the need for separate accounts or passwords in the SaaS application. This enables centralized identity governance, immediate revocation when an employee leaves, and a single compliant authentication policy across all connected services.

Why this answer

Federation trust, typically implemented via standards like SAML 2.0 or OpenID Connect, establishes a trust relationship between the corporate identity provider (IdP) and each SaaS provider. This allows the SaaS app to accept authentication assertions from the corporate IdP, enabling users to sign in with their corporate credentials without needing separate passwords for each service.

Exam trap

The trap here is that candidates may confuse SSO (Option B) with federation (Option A) as being redundant, but they are complementary—federation establishes the trust relationship, while SSO provides the seamless session reuse—so both are required to meet the goal of signing in once with corporate credentials across multiple SaaS apps.

Full explanation →
898
MCQeasy

A login form sends user input directly into a database query. When a tester enters a single quote character, the application returns a database error. What attack is most likely?

A.Cross-site scripting
B.SQL injection
C.Session hijacking
D.Insecure deserialization
AnswerB

This is SQL injection because the application appears to concatenate unsanitized input into a database query. A single quote often breaks query syntax and reveals that user input is being interpreted as part of the SQL command. That is a common sign the application is vulnerable to injection attacks.

Why this answer

The application directly concatenates user input into a database query without sanitization. Entering a single quote breaks the SQL syntax, causing a database error, which is a classic indicator of SQL injection (SQLi). This vulnerability allows an attacker to manipulate the query structure and potentially extract or modify database contents.

Exam trap

The trap here is that candidates may confuse the immediate error response with cross-site scripting (XSS), but the database error clearly indicates the injection is targeting the SQL layer, not the browser's DOM.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, not directly into database queries, and a single quote would not typically trigger a database error in an XSS context. Option C is wrong because session hijacking targets an authenticated user's session token (e.g., via theft or fixation) and does not involve injecting characters into a login form to cause a database error. Option D is wrong because insecure deserialization exploits the processing of serialized objects (e.g., PHP or Java serialization) to execute arbitrary code or manipulate application logic, not by sending a single quote into a database query.

Full explanation →
899
MCQmedium

A monthly scan finds a critical remote-code-execution issue on an internet-facing VPN appliance. The vendor has released a fix, but the appliance can only be rebooted during the weekend maintenance window in five days. What is the BEST immediate action to lower risk until patching can occur?

A.Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features
B.Wait for the weekend because the exploit is not confirmed
C.Remove logging from the appliance to improve performance during the wait
D.Run another scan every hour and do nothing else
AnswerA

A compensating control lowers exposure right away when the patch cannot be installed immediately, which is the safest short-term option.

Why this answer

Applying a compensating control—such as restricting access to trusted source IPs via an ACL and disabling nonessential remote access features like unused VPN protocols or administrative interfaces—immediately reduces the attack surface. This mitigates the risk of exploitation of the remote-code-execution vulnerability on the internet-facing VPN appliance until the vendor patch can be applied during the scheduled maintenance window. The key is to implement network-layer controls that block untrusted sources from reaching the vulnerable service, buying time without requiring a reboot.

Exam trap

The trap here is that candidates may think waiting for the maintenance window is acceptable because the vulnerability is unconfirmed, but the exam expects proactive risk reduction through compensating controls rather than passive delay.

How to eliminate wrong answers

Option B is wrong because waiting for the weekend assumes the exploit is not confirmed, but a critical remote-code-execution vulnerability on an internet-facing appliance is inherently high-risk; the scan finding indicates a real issue, and delaying action without compensating controls leaves the organization exposed to active exploitation. Option C is wrong because removing logging from the appliance does not lower risk; it actually reduces visibility into potential attacks and may violate compliance requirements, while doing nothing to prevent exploitation of the vulnerability. Option D is wrong because running another scan every hour and doing nothing else provides no risk reduction; scanning repeatedly does not block or mitigate the vulnerability, and it wastes resources without addressing the immediate threat.

Full explanation →
900
Matchinghard

Match each design requirement to the best security architecture control. Use each control once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

DMZ

Bastion host

Microsegmentation

Zero Trust Network Access (ZTNA)

Load balancer

Why these pairings

Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Full explanation →
Page 11

Page 12 of 14

Page 13

All pages

1234567891011121314

Practice SY0-701 by domain

Target a specific domain to shore up weak areas.

General Security ConceptsThreats, Vulnerabilities, and MitigationsSecurity ArchitectureSecurity OperationsSecurity Program Management and Oversight
See all domains with question counts →