Security+ SY0-701 SY0-701 Questions 901–975 | Page 13/14

901

MCQmedium

An HR system marks employees as hired, transferred, or terminated. The security team wants those changes to create, update, or disable accounts in multiple SaaS apps automatically after the user authenticates through the company identity provider. Which capability should be added?

A.SAML federation alone, with no additional account lifecycle automation.

B.Password synchronization between every application.

C.SCIM provisioning integrated with the SSO platform.

D.Local administrator groups on each SaaS application.

AnswerC

SCIM provisioning integrated with the SSO platform provides a standard REST-based API for automatically creating, updating, and disabling user accounts when HR marks employees as hired, transferred, or terminated. The HR system becomes the authoritative source, and the SSO platform propagates those lifecycle events to all connected applications in near real time. This enables centralized, auditable, and consistent identity lifecycle management across SaaS apps.

Why this answer

SCIM (System for Cross-domain Identity Management) is the correct choice because it provides a standardized protocol for automating the creation, update, and deletion of user accounts across multiple SaaS applications. When integrated with an SSO platform (like SAML), SCIM handles the lifecycle events (hire, transfer, terminate) by sending RESTful API calls to each SaaS app, ensuring accounts are created, updated, or disabled without manual intervention. SAML alone only handles authentication, not account provisioning, making SCIM essential for the described automation.

Exam trap

The trap here is that candidates often confuse SAML federation (which only handles authentication) with full identity lifecycle management, leading them to pick option A, but the question explicitly requires automated account creation, update, and disablement—a capability only SCIM provides.

How to eliminate wrong answers

Option A is wrong because SAML federation alone only handles authentication (single sign-on) and does not include any account lifecycle management—it cannot create, update, or disable accounts automatically. Option B is wrong because password synchronization between applications is a legacy approach that does not automate account provisioning or deprovisioning; it only keeps passwords consistent and introduces security risks without addressing the core requirement of lifecycle automation. Option D is wrong because local administrator groups on each SaaS application are a manual, per-application access control mechanism that does not provide any automated account lifecycle management or integration with the identity provider.

Full explanation →

902

MCQmedium

A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?

A.Rely only on the cloud provider's service health dashboard and billing alerts.

B.Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.

C.Encrypt the virtual machine disks and disable all logging to reduce exposure.

D.Install only a web application firewall because that covers server log collection.

AnswerB

This combines host-level visibility with cloud network telemetry. Audit logs capture logons and system activity inside the virtual machine, while flow logs show network connections. Forwarding both to a SIEM gives analysts the context needed to correlate suspicious behavior across layers.

Why this answer

It directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.

Exam trap

The trap here is that candidates may think cloud provider dashboards or encryption are sufficient for security monitoring, but they fail to recognize that the specific data types required (OS events and network flows) must be explicitly enabled and forwarded from the guest OS and network layer, not inferred from provider-level metrics.

How to eliminate wrong answers

Option A is wrong because relying solely on the cloud provider's service health dashboard and billing alerts provides only infrastructure-level availability and cost data, not the required OS login events, process activity, or network flow metadata. Option C is wrong because encrypting disks and disabling all logging would eliminate the very data needed for investigations, directly contradicting the goal of making that data available in the SIEM.

Full explanation →

903

Multi-Selecthard

An accounts payable clerk receives an email that appears to come from a long-time vendor. The message asks for an urgent change to bank routing information, says the CFO is traveling, and requests that no one call back because the matter is confidential. The display name looks legitimate, but the reply-to address is different from the sender identity. Which three findings most strongly indicate a pretexting or business email compromise attempt? Select three.

Select 3 answers

A.The message requests a payment change outside the normal approval workflow.

B.The reply-to address does not match the claimed sender identity.

C.The recipient is told to keep the request confidential and avoid calling back.

D.The email contains a professional logo and a consistent signature block.

E.The email uses correct spelling and grammar throughout.

AnswersA, B, C

Unauthorized changes to payment instructions are a classic business email compromise tactic. This bypasses established controls and tries to exploit urgency. It is one of the strongest indicators because legitimate vendors normally accept verification through established channels, not a one-off email request.

Why this answer

The request for a payment change outside the normal approval workflow is a classic indicator of business email compromise (BEC). Attackers exploit the absence of standard verification steps, such as dual authorization or manager sign-off, to redirect funds fraudulently. This bypass of established procedures directly aligns with the social engineering technique of pretexting, where the attacker fabricates a scenario (urgent, confidential, CFO traveling) to pressure the victim into violating policy.

Exam trap

CompTIA often tests the misconception that surface-level professionalism (logos, grammar) indicates legitimacy, when in fact these are easily replicated and the true red flags are procedural violations and header mismatches.

Full explanation →

904

MCQeasy

Field staff use company-owned tablets that also run approved personal apps. Security wants corporate email and documents separated from personal data, with the ability to wipe only the work data if a device is lost. What is the best control?

A.Use a work profile or container managed by a mobile device management platform.

B.Disable all personal apps by removing internet access from the tablet.

C.Install only a screen lock and require a longer PIN for the tablet.

D.Use a USB cable lock so the tablet cannot be physically moved.

AnswerA

A managed work profile or container is the best answer because it separates corporate data from personal applications on the same mobile device. That allows the organization to enforce policies on work data, protect corporate email and documents, and selectively remove only the business container if the tablet is lost or the user leaves. It supports a practical BYOD or COPE style deployment without wiping the user's personal content.

Why this answer

A work profile or container managed by a mobile device management (MDM) platform creates a separate, encrypted partition on the device for corporate data. This allows the organization to enforce policies and perform a selective wipe of only the work container without affecting personal apps or data, meeting the requirement for separation and targeted remote wipe.

Exam trap

The trap here is that candidates may think a screen lock or disabling internet is sufficient for data separation, but the exam specifically tests the concept of containerization and selective wipe as the only method that meets both separation and targeted data removal requirements.

How to eliminate wrong answers

Option B is wrong because disabling internet access on the tablet would block all network connectivity, preventing both personal and corporate apps from functioning, and does not provide any data separation or selective wipe capability. Option C is wrong because a screen lock and longer PIN only protect the device from unauthorized access at rest; they do not separate corporate data from personal data, nor do they enable a selective wipe of work data only.

Full explanation →

905

MCQmedium

An organization is redesigning access for a finance application. Employees should be able to approve expense reports only within their assigned job roles, and every approval must be traceable to the individual user who performed it. Which access model best fits this requirement?

A.Mandatory access control, because a central authority labels each expense report by sensitivity.

B.Role-based access control, because permissions are assigned by job function and tied to named users.

C.Discretionary access control, because individual employees decide who can approve expenses.

D.Rule-based access control, because approval rights are determined only by the time of day.

AnswerB

RBAC matches a finance workflow where users inherit permissions based on job roles such as approver, reviewer, or auditor. It is easy to administer, supports least privilege, and works well when access should be consistent for groups with similar duties. The requirement to trace approvals to individuals is also satisfied when each person uses a unique account and actions are logged.

Why this answer

Role-based access control (RBAC) is the correct choice because it assigns permissions based on job functions (e.g., 'Finance Approver') and links those permissions to named user accounts. This ensures that only employees in the appropriate role can approve expense reports, and each approval action is logged against the specific user, providing non-repudiation and traceability.

Exam trap

The trap here is that candidates often confuse 'rule-based access control' (which uses condition-based rules like time-of-day) with 'role-based access control' (which uses job functions), leading them to select option D despite the question's clear focus on job roles and user traceability.

How to eliminate wrong answers

Option A is wrong because mandatory access control (MAC) uses system-enforced labels (e.g., classification levels) to control access, not job roles, and it does not inherently tie approvals to named users for traceability. Option C is wrong because discretionary access control (DAC) allows individual data owners to set permissions, which would violate the requirement that approvals be restricted to assigned job roles and would not guarantee centralized traceability. Option D is wrong because rule-based access control (RBAC is often confused with rule-based, but here the option describes time-of-day rules only, which is a specific attribute-based condition, not a model that assigns permissions by job function or ensures user-level traceability.

Full explanation →

906

MCQmedium

Based on the exhibit, what type of attack is most likely being used against the accounts payable team?

A.Phishing, because the message asks recipients to open a file and respond quickly.

B.Spear phishing, because the email is tailored to a specific team, project, and recipient.

C.Pretexting, because the sender claims to have spoken with the recipient before.

D.Baiting, because the attacker offers a useful file related to the project.

AnswerB

This is spear phishing because the attacker uses personalized details such as the recipient's name, the internal project name, and a plausible business deadline. Those details are meant to increase trust and pressure the victim into taking action. The goal is to trick a specific target or group, not to send an indiscriminate message to everyone.

Why this answer

B is correct because spear phishing is a targeted attack where the email is customized for a specific individual or group, using personal details like the recipient's name, team, and project to increase credibility. The exhibit shows the email addresses the recipient by name, references the 'Acme Corp Q3 audit' project, and is sent to the accounts payable team, which matches the tailored nature of spear phishing. This makes it more convincing than generic phishing, as the attacker has researched the target to craft a relevant lure.

Exam trap

The trap here is that candidates confuse spear phishing with generic phishing because both involve email, but the key differentiator is the level of personalization—spear phishing uses specific details like the recipient's name and project, while phishing uses generic greetings like 'Dear Customer'.

How to eliminate wrong answers

Option A is wrong because phishing is a broad, untargeted attack sent to many recipients, while the email in the exhibit is specifically addressed to a named individual on the accounts payable team and references a specific project, indicating it is tailored. Option C is wrong because pretexting involves creating a fabricated scenario (e.g., impersonating a colleague or authority figure) to gain trust, but the email does not establish a false identity or backstory beyond claiming a prior conversation, which is a common spear phishing tactic, not a full pretext. Option D is wrong because baiting typically offers a physical item (e.g., a USB drive) or a digital download (e.g., a free file) to lure victims, but the email asks the recipient to open an attached file related to the project, which is a delivery mechanism for malware, not the core attack type—spear phishing better describes the targeted social engineering.

Full explanation →

907

MCQmedium

A vulnerability scan finds that an old print server still has SMBv1 enabled. The business says the vendor will not support a patch for at least two months, but the server must stay online. What is the best temporary mitigation?

A.Move the server to a restricted network segment and allow SMB access only from required hosts.

B.Turn off endpoint logging to reduce performance impact until the vendor releases a patch.

C.Increase the password length requirement for all users and keep the server on the same network.

D.Schedule a weekly reboot to clear any malicious sessions and reduce the chance of exploitation.

AnswerA

Isolating the server on a restricted network segment is a sound compensating control; it shrinks the attack surface to only those hosts that legitimately require SMB access, reducing the number of potential exploit sources while the vendor patch is pending. Because SMBv1 is remotely exploitable without authentication in many cases, limiting connectivity via firewall rules is more effective than relying on host-level hardening. This approach aligns with network segmentation principles and does not hide or destroy security-relevant data.

Why this answer

Network segmentation is the most effective temporary mitigation when a patch is unavailable. By moving the print server to a restricted VLAN or firewall zone and applying an access control list (ACL) that permits SMB traffic only from known, required hosts, you reduce the attack surface and prevent widespread exploitation of SMBv1 vulnerabilities (e.g., EternalBlue). This approach follows the principle of least privilege and containment, buying time until the vendor releases a patch.

Exam trap

The trap here is that candidates may choose a reactive measure like rebooting or a non-technical control like password changes, failing to recognize that containment via network segmentation is the only proactive defense that directly limits the exploit's reach without requiring a patch.

How to eliminate wrong answers

Option B is wrong because turning off endpoint logging reduces visibility into potential attacks, making it harder to detect exploitation of SMBv1; it does not address the vulnerability. Option C is wrong because increasing password length does not mitigate the SMBv1 protocol-level flaws (e.g., lack of pre-authentication integrity checks, susceptibility to relay attacks); it only strengthens authentication, which is irrelevant to the unpatched service. Option D is wrong because scheduling a weekly reboot does not prevent exploitation; attackers can re-establish malicious sessions quickly after reboot, and the vulnerability remains fully exploitable between reboots.

Full explanation →

908

MCQmedium

A Linux host is patched, but the scanner still flags the package as vulnerable. The vendor advisory says the distribution backported the fix, so the package version did not change. What should the analyst do before closing the ticket?

A.Verify the vendor advisory and package metadata, then document evidence of the fixed build.

B.Close the ticket immediately because the patch was installed successfully.

C.Raise the severity of the finding because the scanner still reports it.

D.Disable the scanner until the next maintenance window to avoid repeated alerts.

AnswerA

A version number alone can be misleading when a vendor backports a fix without changing the upstream version. The analyst should confirm the remediation using vendor notes, package release metadata, or other authoritative evidence. That ensures the finding is truly remediated before the ticket is closed and prevents a false assumption based only on a scanner result.

Why this answer

When a vendor backports a security fix to an older package version without incrementing the version number, the vulnerability scanner may still flag the package based on its version string. The analyst must verify the vendor advisory and package metadata (e.g., using `rpm -q --changelog` or `dpkg --status`) to confirm the fix is present, then document this evidence to close the ticket with proper justification.

Exam trap

The trap here is that candidates assume a patched system always has a newer package version, but CompTIA tests the understanding that backported fixes keep the same version string, requiring manual verification of the changelog or vendor advisory.

How to eliminate wrong answers

Option B is wrong because closing the ticket without verification ignores the scanner's alert and the need for evidence that the backported fix is actually installed. Option C is wrong because raising the severity is inappropriate; the package is not vulnerable, and the scanner's false positive does not warrant escalation. Option D is wrong because disabling the scanner avoids the issue rather than resolving it, and the scanner should be tuned or the finding documented as a false positive.

Full explanation →

909

Multi-Selectmedium

After restoring a virtual file server from backup, users can open shares, but the accounting application shows the previous day's transactions are missing. Which two steps should the administrator take next? Select two.

Select 2 answers

A.Verify whether the backup included application-consistent data and transaction logs

B.Restore the missing records from the latest pre-incident application backup or log backup

C.Leave the server as is because file shares are accessible

D.Delete the current backup set to avoid restoring the wrong version again

E.Reimage the server immediately without checking the restore point

AnswersA, B

This is the essential first step because a file-level or crash-consistent backup of a virtual machine may capture the disk state but does not guarantee that applications like SQL Server or Exchange have flushed all committed transactions to disk. Application-consistent backups use VSS or equivalent mechanisms to quiesce the application, ensuring the data files and transaction logs are in a recoverable, synchronized state. Inspecting the backup's metadata and logs reveals whether it supports point-in-time recovery or whether you must fall back to a different recovery source.

Why this answer

The accounting application's missing transactions indicate the backup may not have captured application-consistent data, such as open transaction logs or database writes. Without application consistency (e.g., using Volume Shadow Copy Service or a database-aware backup agent), the restore point may reflect a crash-consistent state where recent transactions were lost. Verifying the backup type ensures the administrator understands whether the data is recoverable from transaction logs or requires a separate application-level restore.

Exam trap

The trap here is that candidates assume file share accessibility equals full data recovery, overlooking the distinction between file-level and application-consistent backups, which is a core concept in CompTIA SY0-701 Domain 3.0 (Security Operations).

Full explanation →

910

MCQmedium

A company manages 300 laptops and wants to reduce risk from missed patches while avoiding a widespread outage if an update has compatibility issues. Which patching approach is the best choice?

A.Install patches manually on each laptop after users report problems.

B.Deploy all patches to every laptop immediately with no testing.

C.Use a phased rollout with a pilot group, then expand deployment after validation, while keeping a standard baseline configuration.

D.Wait for annual maintenance windows so all changes happen at once.

AnswerC

A phased or ring-based rollout balances speed and stability. A pilot group catches compatibility issues early, and the baseline keeps endpoint settings consistent across the fleet. This approach reduces risk from vulnerabilities without creating unnecessary operational disruption.

Why this answer

A phased rollout with a pilot group allows the IT team to validate patches on a small subset of laptops before full deployment, reducing the risk of widespread outages from compatibility issues. Maintaining a standard baseline configuration ensures consistency across all 300 laptops, which simplifies patch management and reduces the likelihood of missed patches. This approach balances risk mitigation with operational continuity, aligning with best practices for enterprise patch management.

Exam trap

The trap here is that candidates may choose Option B (immediate deployment) because they prioritize speed and simplicity over risk management, failing to recognize that unvalidated patches can cause cascading failures that negate any security benefits.

How to eliminate wrong answers

Option A is wrong because installing patches manually only after users report problems is a reactive approach that leaves laptops vulnerable to known exploits for extended periods, increasing the risk of security breaches. Option B is wrong because deploying all patches to every laptop immediately with no testing ignores the potential for compatibility issues that could cause widespread outages, application failures, or system instability across the entire fleet.

Full explanation →

911

MCQmedium

A file server is actively renaming documents and generating ransom notes. The server hosts a shared drive used by finance, and users are still online. What is the best immediate action?

A.Shut the server down immediately to stop all activity as fast as possible.

B.Isolate the server from the network to contain the spread while preserving evidence.

C.Restore the file server from backup before checking whether the infection is still active.

D.Run a full antivirus scan and wait for the results before taking any other action.

AnswerB

Network isolation is the best immediate containment step because it limits lateral movement and reduces the chance that ransomware spreads to other systems or continues encrypting shared data. It is also less destructive than a hard shutdown, which can interfere with evidence collection. In incident response, containment should stop the impact while preserving the ability to investigate what happened.

Why this answer

Isolating the server from the network stops the ransomware from encrypting more files or spreading laterally, while preserving volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. In a live incident, immediate disconnection (not shutdown) is the standard containment step per NIST SP 800-61 and SANS incident response guidelines, as it halts the attack without destroying data in memory or logs.

Exam trap

The trap here is that candidates confuse 'stopping the attack' with 'shutting down the system,' but CompTIA emphasizes that isolation (disconnecting the network cable or disabling the port) is the first step in containment to preserve evidence and avoid data loss.

How to eliminate wrong answers

Option A is wrong because shutting down the server destroys volatile evidence (e.g., active network connections, running ransomware processes in RAM) and may trigger the ransomware to delete or further encrypt files on shutdown, as many modern ransomware variants have persistence mechanisms that activate on system halt. Option C is wrong because restoring from backup before confirming the infection is neutralized risks re-infection if the backup itself is compromised or if the ransomware is still active on the network, and it bypasses the need for forensic preservation. Option D is wrong because running a full antivirus scan while the server is still online allows the ransomware to continue encrypting files and spreading to other systems, and signature-based scans often miss polymorphic or zero-day ransomware strains.

Full explanation →

912

MCQmedium

After imaging laptops, the security team wants to ensure screen-lock timeouts, local admin restrictions, and USB storage controls remain consistent on every device even after users make changes. What is the best approach?

A.Rely on users to follow the build sheet during setup and avoid future changes.

B.Enforce a hardened baseline with configuration management and compliance checks.

C.Increase antivirus scan frequency so policy settings do not change.

D.Apply full disk encryption only, since it covers all endpoint hardening needs.

AnswerB

Correct. A hardened baseline defines the approved secure settings, and configuration management helps enforce those settings consistently across all laptops. Compliance checks detect drift after deployment, which is important when users or software might change security-related options. This approach directly supports secure configuration and repeatability at scale.

Why this answer

Configuration management tools (e.g., Microsoft Intune, Group Policy, or Ansible) can enforce a hardened baseline by applying settings like screen-lock timeouts, local admin restrictions, and USB storage controls. These tools also perform compliance checks to detect and remediate any drift caused by user changes, ensuring consistency across all devices.

Exam trap

The trap here is that candidates may confuse security controls like antivirus or encryption with configuration management, thinking they can prevent or revert policy changes, when in fact only a dedicated configuration management and compliance solution can enforce and remediate baseline settings.

How to eliminate wrong answers

Option A is wrong because relying on users to follow a build sheet is not enforceable; users can intentionally or accidentally change settings, leading to configuration drift and security gaps. Option C is wrong because increasing antivirus scan frequency does not prevent or revert changes to screen-lock, admin, or USB policies; antivirus focuses on malware detection, not configuration enforcement. Option D is wrong because full disk encryption protects data at rest but does not enforce screen-lock timeouts, local admin restrictions, or USB storage controls; it addresses only one aspect of endpoint hardening.

Full explanation →

913

MCQmedium

A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?

A.Worm

B.Logic bomb

C.Rootkit

D.Spyware

AnswerB

A logic bomb is malicious code embedded within a legitimate application that remains inactive until a predefined condition is met, such as a specific date, an event, or an account status change. In this scenario, the finance application functioning normally for weeks and then suddenly deleting files aligns precisely with a time- or event-based trigger, making a logic bomb the most likely cause.

Why this answer

The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.

Exam trap

The trap here is that candidates confuse a logic bomb with a worm because both can execute code automatically, but they fail to recognize that a worm's defining characteristic is self-propagation across networks, not a delayed, condition-based trigger.

How to eliminate wrong answers

Option A is wrong because a worm is self-replicating malware that spreads automatically across networks without user intervention, whereas this scenario involves a hidden task that does not replicate or spread. Option C is wrong because a rootkit is designed to hide the presence of malware or unauthorized processes by modifying the operating system kernel or using hooking techniques, not to trigger a delayed destructive action based on a date. Option D is wrong because spyware is focused on covertly collecting and exfiltrating user data (e.g., keystrokes, browsing habits) without the user's knowledge, not on deleting files or self-removal after a time-based trigger.

Full explanation →

914

MCQmedium

Employees use several SaaS applications, and the security team wants one corporate login, MFA for unmanaged devices, and centralized account provisioning. Which architecture should be used?

A.Create separate usernames and passwords for each SaaS application.

B.Use federated single sign-on with the corporate identity provider and conditional access policies.

C.Share one generic account for the team so access is easier to audit.

D.Put all users on a VPN and let each SaaS application trust the internal network automatically.

AnswerB

Federated single sign-on with the corporate identity provider lets users authenticate once—typically with MFA—and receive a SAML or OIDC assertion that each SaaS application trusts. Conditional access policies evaluate real-time signals such as user risk, device compliance, or geolocation before issuing the token, enabling dynamic controls like blocking unmanaged devices or requiring step-up authentication. This approach centralizes identity lifecycle management and enforces uniform security policy across every connected application.

Why this answer

Federated single sign-on (SSO) with a corporate identity provider (IdP) allows users to authenticate once using their corporate credentials and access multiple SaaS applications without separate logins. Conditional access policies can enforce MFA specifically for unmanaged devices, and centralized account provisioning (e.g., via SCIM) ensures accounts are created, updated, and deprovisioned from a single directory. This architecture meets all three requirements: single corporate login, MFA for unmanaged devices, and centralized provisioning.

Exam trap

The trap here is that candidates confuse network-level controls (VPN) with identity-level controls (federation), assuming that a VPN provides the same authentication and authorization granularity as SSO with conditional access.

How to eliminate wrong answers

Option A is wrong because creating separate usernames and passwords for each SaaS application violates the requirement for a single corporate login, increases password fatigue, and makes centralized provisioning impossible. Option C is wrong because sharing one generic account eliminates individual accountability, violates the principle of least privilege, and makes auditing impossible since actions cannot be traced to a specific user. Option D is wrong because VPNs only provide network-level access and do not integrate with SaaS application authentication; SaaS apps cannot 'trust the internal network automatically' without federation, and VPNs do not enforce MFA or provide centralized account provisioning.

Full explanation →

915

MCQmedium

A security analyst at a financial firm detects an unusual spike in outbound network traffic from a database server that normally only communicates with internal web servers. The traffic is directed to numerous external IP addresses in various countries. According to established incident response procedures, what should be the analyst's immediate next step?

A.Disconnect the server from the network at the switch level.

B.Run a comprehensive antivirus scan on the server.

C.Notify the Chief Information Security Officer (CISO) of the incident.

D.Power off the server to prevent further damage.

AnswerA

Isolating the server at the switch port is the proper containment step because it severs the network path used for data exfiltration without disrupting the host's power or volatile memory. This preserves running processes, open network connections, and other live forensic evidence, aligning with the NIST incident response framework's containment phase. It immediately halts the unauthorized data transfer while allowing the analyst to gather evidence from the live system.

Why this answer

Disconnecting the server at the switch level (e.g., shutting down the switch port or placing it in a quarantine VLAN) is the immediate containment step per incident response procedures. This stops the outbound data exfiltration without risking data loss or corruption that could occur from a hard power-off, and it preserves volatile memory evidence for forensic analysis.

Exam trap

The trap here is that candidates confuse 'immediate containment' with 'immediate notification' or 'immediate remediation,' but the SY0-701 incident response framework prioritizes stopping the active threat (containment) over escalation or scanning.

Why the other options are wrong

Running a comprehensive antivirus scan is a time-consuming step that delays containment. In this scenario, the immediate priority is to stop the data exfiltration by disconnecting the server from the network, not to analyze the malware.

In this scenario, the immediate priority is containment to prevent data exfiltration. Notifying the CISO is a later step after containment and initial analysis, not the immediate next action.

Powering off the server would destroy volatile evidence (e.g., memory contents, active network connections) and may not stop data exfiltration if the attacker has persistence. The immediate priority is containment via network isolation, not power-off.

When would these options actually be correct?

This would be correct if the question described a suspected malware infection on a non-critical system with no signs of active data exfiltration, and the incident response procedure required initial triage with antivirus before any network isolation.

This would be correct as the immediate next step if the incident response procedure requires notification of the CISO before any containment actions, or if the analyst lacks authority to disconnect and must escalate first.

In a scenario where a server is experiencing a destructive malware infection (e.g., ransomware encrypting files) and there is no need for forensic preservation, powering off can prevent further damage. For example, if a server is rapidly deleting critical data and network isolation is insufficient, power-off may be warranted.

Why candidates pick the wrong answer

Candidates often default to scanning for malware as a first step, not realizing that containment (disconnection) takes precedence when there is clear evidence of ongoing data exfiltration.

Candidates may think that escalation is always the first step in incident response, but containment takes precedence when active data exfiltration is suspected.

Candidates may think that stopping the server entirely is the fastest way to halt malicious activity, overlooking the importance of preserving evidence and the fact that network isolation achieves containment without losing volatile data.

Full explanation →

916

MCQhard

During routine checks, configuration management finds several branch firewalls drifted from the approved baseline because a contractor changed settings locally. An automation job now compares each device nightly and automatically reapplies the approved configuration without waiting for a human ticket. Which control type is the automation?

A.Directive control

B.Detective control

C.Corrective control

D.Deterrent control

AnswerC

The automation runs after drift is detected and restores the approved baseline, which means it is correcting the affected system back to a known-good state. It does more than report the problem; it remediates the configuration. That is why the best answer is corrective control rather than detective or preventive control.

Why this answer

The automation job corrects a detected drift by automatically reapplying the approved configuration, which is a classic corrective control. Corrective controls are designed to remediate or reverse an unwanted change or security event after it has been detected. In this scenario, the nightly comparison is detective, but the automatic reapplication is the corrective action.

Exam trap

The trap here is that candidates see 'compares each device nightly' and mistakenly classify the entire process as detective, ignoring that the automatic reapplication is the corrective action that distinguishes the control type.

How to eliminate wrong answers

Option A is wrong because directive controls are policies, standards, or guidelines that define acceptable behavior (e.g., 'firewalls must use the approved baseline'), not automated remediation actions. Option B is wrong because detective controls identify or log a deviation (e.g., the nightly comparison itself), but the automation goes further by actively fixing the drift. Option D is wrong because deterrent controls discourage unwanted behavior through fear of consequences (e.g., warning banners or audit trails), not by automatically correcting configuration changes.

Full explanation →

917

MCQmedium

A branch office uses a NAS for nightly backups, but the NAS is joined to the same domain as the production servers. After ransomware encrypted both production data and backups, management wants the most effective change to reduce the chance of backup tampering without a major redesign. Which control should be implemented?

A.Increase the retention period so deleted files can be recovered for longer.

B.Move backups to a larger NAS with more available storage capacity.

C.Keep one backup copy offline or immutable and outside the production domain.

D.Run backups more frequently to the same NAS so newer files are captured sooner.

AnswerC

An offline or immutable copy is the strongest practical protection against ransomware that can reach the network backup target. Separating that copy from the production domain also reduces the chance that compromised admin credentials can alter it. This improves resilience without requiring a full redesign, and it gives the organization a trusted recovery source even if online backups are encrypted or deleted.

Why this answer

Keeping one backup copy offline or immutable and outside the production domain ensures that even if ransomware compromises the domain, it cannot encrypt or tamper with that isolated copy. This breaks the chain of trust between the production environment and the backup storage, directly addressing the root cause of the incident.

Exam trap

The trap here is that candidates often choose more frequent backups or larger storage, thinking that having more copies or more space provides protection, when the real vulnerability is the shared domain trust that allows ransomware to access and encrypt backups.

How to eliminate wrong answers

Option A is wrong because increasing the retention period only keeps deleted files longer, but does not prevent ransomware from encrypting or deleting the backups themselves on the same domain-joined NAS. Option B is wrong because moving to a larger NAS with more storage capacity does not change the fact that the NAS is still joined to the same domain, leaving backups vulnerable to the same ransomware attack. Option D is wrong because running backups more frequently to the same NAS only creates more copies that are all equally susceptible to encryption or deletion by ransomware that has domain access.

Full explanation →

918

MCQhard

Based on the exhibit, which principle should the organization enforce to reduce fraud risk while keeping the business process functional?

A.Least privilege, because each employee should only have the fewest permissions needed for the shared account.

B.Separation of duties, because no single user should be able to complete every high-risk finance step alone.

C.Need-to-know, because only employees with confidential financial data should see the workflow details.

D.Defense in depth, because the organization should add more security layers around the finance process.

AnswerB

Separation of duties is the best answer because the workflow shows one shared identity can create vendors, enter invoices, approve payments, and change bank details. That concentration enables fraud without a second set of eyes. Splitting those tasks across different roles prevents one person from controlling the entire transaction chain and creates accountability for each critical step.

Why this answer

Separation of duties (SoD) is the correct principle because it prevents any single employee from completing all steps in a high-risk financial transaction alone. By requiring at least two people to authorize and execute critical actions—such as initiating a payment and approving it—the organization reduces the risk of internal fraud without blocking the business workflow. This directly addresses the scenario where a single user could otherwise create, approve, and release a fraudulent payment.

Exam trap

The trap here is that candidates confuse least privilege (which limits permissions for a single user) with separation of duties (which splits a process across multiple users), even though the exhibit clearly shows a sequential workflow where a single user could perform all steps.

How to eliminate wrong answers

Option A is wrong because least privilege limits permissions for a shared account, but the core fraud risk here is not about excessive permissions on a shared account—it is about a single user being able to complete an entire high-risk process alone. Option C is wrong because need-to-know restricts access to confidential data based on job role, but the exhibit shows a workflow where the risk is sequential task completion, not data visibility. Option D is wrong because defense in depth adds multiple security layers (e.g., firewalls, IDS), but it does not specifically address the procedural control of splitting critical financial steps among different users.

Full explanation →

919

MCQhard

Based on the exhibit, what is the MOST likely explanation for the network traffic? The affected host is not showing a large amount of internet-bound traffic, but its DNS behavior is highly unusual.

A.DNS tunneling used for command-and-control or data transfer

B.ARP poisoning causing the host to redirect traffic to a rogue gateway

C.A browser cache synchronization feature repeatedly polling a cloud service

D.A misconfigured static route sending all web traffic to the wrong subnet

AnswerA

The repeated queries to long, randomly generated subdomains, combined with the prevalence of NXDOMAIN responses and the absence of ordinary browsing traffic, are classic indicators of DNS tunneling. In this technique, malware encapsulates command-and-control messages or exfiltrated data into the domain namespace, encoding payloads in subdomain labels and receiving instructions or data in DNS replies such as TXT records. The NXDOMAIN responses may represent either intentional 'no data' signals from the malicious authoritative server or failed resolution attempts that are still part of the tunnel's call-and-response pattern.

Why this answer

The exhibit shows a host with minimal internet-bound traffic but highly unusual DNS behavior, such as frequent queries to a single domain or large DNS query sizes. This pattern is characteristic of DNS tunneling, where data is encoded in DNS queries and responses to bypass network controls, often used for command-and-control (C2) communication or covert data exfiltration. The lack of other traffic indicates the host is not performing normal web browsing or data transfers, making DNS tunneling the most likely explanation.

Exam trap

The trap here is that candidates may overlook the significance of 'unusual DNS behavior' and minimal internet traffic, instead focusing on common attacks like ARP poisoning or benign browser features, which would produce different traffic patterns (e.g., high traffic or periodic HTTP requests).

How to eliminate wrong answers

Option B is wrong because ARP poisoning would cause the host to redirect traffic to a rogue gateway, resulting in a large amount of internet-bound traffic as the host communicates through the attacker's system, not minimal traffic with unusual DNS behavior. Option C is wrong because a browser cache synchronization feature repeatedly polling a cloud service would generate consistent, periodic HTTP/HTTPS traffic to a known cloud provider, not the highly unusual DNS queries (e.g., high query rates, large TXT records) seen in the exhibit, and would not explain the lack of other internet-bound traffic.

Full explanation →

920

MCQeasy

A department wants to keep using a cloud printing service even though the vendor has not yet completed the company's security questionnaire. The business owner agrees to add extra log monitoring until the review is finished. What is the best term for the added monitoring?

A.A compensating control, because it reduces risk while the normal control is unavailable.

B.Residual risk, because all risk is eliminated once monitoring is added.

C.Risk acceptance, because the business owner has approved continued use of the service.

D.Due diligence, because the company is actively reviewing the vendor.

AnswerA

A compensating control is an alternative safeguard used when the preferred control is missing, delayed, or not fully effective. Extra log monitoring helps reduce exposure while the vendor review is still in progress. It does not eliminate the underlying vendor risk, but it is a reasonable temporary measure to reduce likelihood of missing suspicious activity.

Why this answer

The added log monitoring is a compensating control because it provides an alternative security measure to mitigate risk while the primary control (the vendor's completed security questionnaire) is not yet in place. Compensating controls are temporary or alternative safeguards that reduce risk exposure when the preferred control cannot be implemented immediately. In this scenario, the monitoring does not eliminate the need for the questionnaire but reduces the risk of undetected malicious activity until the vendor's security posture is formally assessed.

Exam trap

The trap here is that candidates confuse risk acceptance (which involves no new controls) with risk mitigation (which involves implementing a compensating control), leading them to pick Option C despite the clear action of adding monitoring.

How to eliminate wrong answers

Option B is wrong because residual risk is the risk that remains after controls are applied, not the control itself; adding monitoring reduces but does not eliminate all risk, so the statement 'all risk is eliminated' is incorrect. Option C is wrong because risk acceptance is a management decision to acknowledge and tolerate a risk without implementing additional controls, but here the business owner is actively adding extra log monitoring, which is a risk mitigation action, not pure acceptance. Option D is wrong because due diligence refers to the ongoing investigation and review process (like completing the security questionnaire), not the specific technical control (log monitoring) implemented to reduce risk during that review.

Full explanation →

921

MCQeasy

A development team wants to skip testing and deploy a major application change directly to production to meet a release date. What should the security team require?

A.Disable logging temporarily so the release is less likely to fail.

B.Require change approval and testing in a nonproduction environment first.

C.Deploy only to one server and monitor from there before deciding.

D.Let developers decide without review because they understand the code best.

AnswerB

Change approval and testing in a separate environment are basic controls that reduce the chance of introducing defects or security issues into production. This approach supports safe deployment while still allowing the project to move forward in a controlled way.

Why this answer

Security policy requires that all changes to production systems undergo formal change management, including approval and testing in a nonproduction environment first. Skipping testing violates the principle of change control and could introduce vulnerabilities or misconfigurations that compromise confidentiality, integrity, or availability. The security team must enforce this process to ensure the change is reviewed for security impact and validated before deployment.

Exam trap

The trap here is that candidates may think a phased rollout (Option C) is an acceptable compromise, but the SY0-701 exam emphasizes that change approval and testing in a nonproduction environment are mandatory before any production deployment, regardless of scale.

How to eliminate wrong answers

Option A is wrong because disabling logging would remove the audit trail needed to detect and investigate security incidents, violating compliance requirements and best practices. Option C is wrong because deploying to a single server without prior testing still bypasses the required change approval and nonproduction validation, and monitoring alone cannot catch all security flaws or configuration errors. Option D is wrong because developers may not have full visibility into security implications, and bypassing review undermines segregation of duties and the change management process.

Full explanation →

922

MCQmedium

A help desk lead notices that several support technicians have broad administrator access across every department's systems so they can resolve tickets faster. After a phishing incident, management wants to reduce the damage if one technician account is compromised. What is the best security principle to apply when redesigning access?

A.Defense in depth

B.Least privilege

C.Need-to-know

D.Zero trust

AnswerB

Least privilege means each user receives only the access required to perform assigned duties. Reducing broad administrative rights lowers the impact of credential theft, malware, or accidental misuse. It is especially effective for support staff because their daily tasks usually need access to a limited set of systems rather than full administrative control across the environment.

Why this answer

The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. By applying least privilege, each technician would receive access only to the specific systems and resources required for their role, rather than broad administrator access across all departments. This containment directly limits the blast radius of a compromised account, preventing an attacker from moving laterally to other departmental systems.

Exam trap

CompTIA often tests the distinction between least privilege and need-to-know, where candidates mistakenly choose need-to-know because it sounds similar, but least privilege is the correct principle for limiting system-level access rights and permissions.

How to eliminate wrong answers

Option A is wrong because defense in depth is a layered security strategy that combines multiple controls (e.g., firewalls, antivirus, intrusion detection) to protect assets; it does not specifically address the reduction of individual user permissions. Option C is wrong because need-to-know is a principle for data classification and access based on the necessity of information for a specific task, but it is typically applied to information access rather than administrative system privileges; least privilege is the more precise principle for limiting system-level permissions.

Full explanation →

923

MCQeasy

A small internal reporting server has a low-severity vulnerability. Fixing it now would require several hours of downtime, while the business impact of exploitation is considered low. What is the BEST risk treatment for this situation?

A.Transfer the risk to a third party

B.Accept the risk after documenting the decision

C.Avoid the risk by shutting down the server permanently

D.Mitigate the risk by immediately replacing the server

AnswerB

When both likelihood and impact are low, and remediation would create more disruption than benefit, accepting the risk can be the most practical choice. The key is to document the rationale, obtain the appropriate approval, and revisit the decision later if the system or threat landscape changes.

Why this answer

The best risk treatment is to accept the risk because the vulnerability is low-severity, the business impact of exploitation is low, and the cost of remediation (several hours of downtime) exceeds the potential loss. Documenting the acceptance ensures auditability and informed management approval, which is a standard practice in risk management frameworks like NIST SP 800-37.

Exam trap

The trap here is that candidates may confuse 'accepting risk' with ignoring it, or they may overestimate the need to transfer or avoid risk, failing to recognize that documented acceptance is a valid and often optimal treatment for low-impact, high-remediation-cost scenarios.

How to eliminate wrong answers

Option A is wrong because transferring the risk to a third party (e.g., purchasing cyber insurance or outsourcing) is unnecessary and cost-ineffective for a low-severity, low-impact vulnerability; it would introduce additional expense and administrative overhead without proportional benefit. Option C is wrong because avoiding the risk by permanently shutting down the server is an extreme measure that would disrupt internal reporting functions entirely, causing greater business harm than the vulnerability itself, and is disproportionate to the low severity and low exploitation impact.

Full explanation →

924

MCQmedium

A security analyst is reviewing logs after a successful phishing attack. The attacker used a fake login page that mimicked the company's single sign-on portal to harvest usernames and passwords. The attacker then used the stolen credentials to access the corporate email system. Which type of attack best describes the initial compromise?

A.On-path attack

B.Credential harvesting via phishing

C.Brute-force attack

D.Password spraying

AnswerB

Correct. The attacker used a deceptive email or website to trick users into voluntarily entering their credentials. This is the defining characteristic of phishing-based credential harvesting. The stolen credentials were then reused to access the corporate email system.

Why this answer

The initial compromise was achieved by luring the victim to a fake login page that mimicked the company's single sign-on portal, which is a classic phishing technique. The attacker harvested the credentials directly from the user's submission, making this a credential harvesting attack via phishing. This aligns with the definition of phishing as a social engineering attack that uses deception to obtain sensitive information, distinct from brute-force or password spraying which rely on guessing or trying multiple passwords.

Exam trap

The trap here is that candidates may confuse credential harvesting via phishing with an on-path attack, because both involve intercepting credentials, but phishing relies on user deception to voluntarily submit credentials, whereas an on-path attack captures them transparently during an existing session.

Why the other options are wrong

The initial compromise was achieved through a fake login page that harvested credentials, which is credential harvesting via phishing, not an on-path attack. An on-path attack involves intercepting or modifying communications between two parties, not tricking users into entering credentials on a fake site.

The initial compromise was achieved through a fake login page that harvested credentials, not by systematically guessing passwords. Brute-force attacks involve automated guessing of many password combinations, which is not described here.

Password spraying involves trying a few common passwords against many accounts, not using a fake login page to harvest credentials from a single phishing attack.

When would these options actually be correct?

An on-path attack would be correct if the question described an attacker intercepting network traffic (e.g., ARP spoofing or man-in-the-middle) to capture credentials or modify data in transit, without using a fake login page.

A question describing an attacker repeatedly trying different passwords against a single account until successful, such as 'An attacker gains access to a user account by trying thousands of password combinations in a short period.'

A security analyst notices multiple failed login attempts using the same password (e.g., 'Spring2024!') across hundreds of user accounts within a short time frame. This indicates a password spraying attack.

Why candidates pick the wrong answer

Candidates may confuse on-path attacks with phishing because both involve credential theft, but on-path attacks focus on intercepting live traffic rather than deceiving users into entering credentials on a fake site.

Candidates may confuse credential harvesting with password guessing, or assume that any attack involving passwords is a brute-force attack, overlooking the phishing vector.

Candidates may confuse password spraying with credential harvesting because both involve obtaining passwords, but they overlook the distinct method of using a fake login page in phishing.

Full explanation →

925

MCQhard

Administrators must manage network switches from home. Requirements: encrypted management traffic, MFA for users, no management ports exposed to the Internet, and centralized logging of admin sessions. Which solution best meets the requirements?

A.Open SSH directly on each switch and allow access from the entire Internet.

B.Use a VPN with MFA that terminates on a hardened jump host, then reach switches over SSH or HTTPS.

C.Use port forwarding through the firewall to RDP on each switch.

D.Build an IPSec tunnel only between office routers and share a common admin password on the switches.

AnswerB

A VPN with MFA that terminates on a hardened jump host provides authenticated, encrypted remote access while ensuring switch management protocols are never exposed directly to the internet. The jump host acts as a controlled pivot point, so administrators reach switches only via SSH or HTTPS after passing both the VPN and MFA, and it centralizes logging and auditing of management sessions.

Why this answer

It satisfies all requirements: a VPN with MFA encrypts management traffic, the hardened jump host provides a secure intermediary that keeps switch management ports off the Internet, and centralized logging can be implemented on the jump host to record all admin sessions. This architecture aligns with the principle of defense-in-depth by combining encrypted tunnels, strong authentication, and network segmentation.

Exam trap

The trap here is that candidates may think a VPN alone is sufficient, forgetting that the jump host is necessary to avoid exposing switch management ports and to enable centralized logging and MFA enforcement.

How to eliminate wrong answers

Option A is wrong because opening SSH directly on each switch from the entire Internet exposes management ports to the public, violating the requirement that no management ports be exposed to the Internet, and it lacks MFA. Option C is wrong because port forwarding RDP to each switch exposes management ports (RDP uses port 3389) to the Internet, and RDP is not the native management protocol for network switches (switches typically use SSH or HTTPS), nor does it inherently provide MFA or centralized logging. Option D is wrong because an IPSec tunnel between office routers does not address MFA (it uses a shared common password, which is weak), and it does not provide centralized logging of admin sessions.

Full explanation →

926

MCQmedium

A scan finds two issues: a critical flaw on a lab server reachable only through VPN, and a high-severity flaw on an internet-facing file transfer appliance with active exploitation in the wild. Which should be remediated first?

A.The lab server, because critical severity is always higher than high severity.

B.The internet-facing file transfer appliance, because exploitability and exposure increase risk.

C.Both issues at the same time, because prioritization is unnecessary when two findings are present.

D.The lab server, because systems behind VPN are always more trusted than public systems.

AnswerB

The internet-facing appliance should be fixed first because it is exposed to untrusted users and already being exploited in the wild. Risk-based prioritization considers not only severity but also exposure, exploit availability, and business impact. A high-severity flaw with active exploitation on a public-facing system is usually more urgent than a critical flaw on a restricted lab server.

Why this answer

The internet-facing file transfer appliance with active exploitation in the wild presents a higher risk because it is directly exposed to untrusted networks and has a known exploit that attackers are actively using. Even though the lab server has a critical severity rating, its reachability only through VPN significantly reduces its attack surface and likelihood of exploitation. Risk is a function of both severity and exploitability/exposure, so the actively exploited, internet-facing asset should be remediated first.

Exam trap

The trap here is that candidates assume CVSS severity alone dictates remediation order, ignoring that exploitability and exposure (e.g., internet-facing vs. VPN-restricted) are critical factors in risk-based prioritization.

How to eliminate wrong answers

Option A is wrong because severity alone does not determine remediation priority; a critical flaw on a VPN-restricted lab server is less exploitable than a high-severity flaw on an internet-facing system with active exploitation. Option C is wrong because prioritization is essential when resources are limited; remediating both simultaneously is often impractical and ignores the higher immediate risk posed by the actively exploited internet-facing appliance.

Full explanation →

927

Multi-Selectmedium

Which four of the following are key components of a successful security awareness and training program within an organization? (Choose four.)

Select 4 answers

.Role-based training tailored to specific job functions

.Phishing simulations to reinforce practical skills

.Annual one-time training with no follow-up assessments

.Metrics to measure effectiveness, such as click rates on simulated phishing emails

.Executive-level sponsorship and support for the program

.Outsourcing all training content development to a single vendor without internal review

Why this answer

Role-based training is correct because it ensures that employees receive security education relevant to their specific job functions, such as data handling for finance or system access for IT, which increases the practical applicability and retention of security principles. Phishing simulations are correct as they provide hands-on reinforcement of skills, allowing employees to practice identifying and reporting malicious emails in a controlled environment, which directly reduces real-world risk. Metrics like click rates on simulated phishing emails are correct because they provide quantifiable data to measure program effectiveness, identify high-risk groups, and guide continuous improvement.

Executive-level sponsorship is correct because it provides the necessary authority, resources, and organizational commitment to prioritize security awareness, ensuring the program is taken seriously across all departments.

Exam trap

The SY0-701 exam often tests the misconception that a one-time annual training is sufficient for compliance, but the SY0-701 exam emphasizes that effective security awareness requires continuous, role-specific training with measurable outcomes and leadership support.

Full explanation →

928

MCQmedium

A security analyst is reviewing web server logs from an e-commerce application. The logs show repeated requests containing URLs with appended strings such as: `' OR '1'='1' --` and `'; DROP TABLE Users; --`. The application returned HTTP 200 responses with unexpected data in several instances. Which type of attack is most likely being attempted?

A.SQL injection

B.LDAP injection

C.Command injection

D.Cross-site scripting (XSS)

AnswerA

Correct. The log entries show SQL syntax such as `OR '1'='1'` and `DROP TABLE`, which are classic indicators of SQL injection attempts. This attack exploits improper input sanitization to manipulate database queries. These payloads are appended to SQL statements executed by the web application's backend database, allowing an attacker to bypass authentication or alter data.

Why this answer

The repeated requests contain classic SQL injection payloads, such as `' OR '1'='1' --` (used to bypass authentication or extract data) and `'; DROP TABLE Users; --` (used to delete database tables). The HTTP 200 responses with unexpected data confirm that the application is vulnerable to SQL injection, as the injected SQL code is being executed against the backend database. This attack targets the SQL database layer, not LDAP directories or operating system commands.

Exam trap

The trap here is that candidates may confuse SQL injection with command injection because both use special characters like `'` and `;`, but command injection requires OS command separators and system commands, whereas SQL injection uses database-specific syntax and keywords.

Why the other options are wrong

The logs show SQL syntax like `' OR '1'='1' --` and `DROP TABLE Users`, which are classic SQL injection payloads, not LDAP injection. LDAP injection uses LDAP query syntax, not SQL.

The logs show SQL syntax patterns like ' OR '1'='1' and DROP TABLE, which are classic SQL injection attempts. Command injection typically involves system commands (e.g., ; ls -la) and would not produce SQL-like strings.

The logs show SQL syntax (' OR '1'='1' --, DROP TABLE) and HTTP 200 responses with unexpected data, indicating database manipulation, not client-side script execution. XSS involves injecting scripts into web pages viewed by other users, not direct database queries.

When would these options actually be correct?

An LDAP injection question would involve an application that authenticates users against an LDAP directory, with logs showing payloads like `*)(uid=*))(|(uid=*` or `admin*` in login fields, causing unauthorized access or data exposure.

Command injection would be correct if the logs showed URL parameters with system commands, such as '; ls -la' or '| dir', and the application returned command output in the HTTP response, indicating the server executed the commands.

A security analyst finds that a web application reflects user input in HTTP responses without sanitization, and a proof-of-concept payload like <script>alert('XSS')</script> executes in a browser. The question would specify that the attack targets other users via stored or reflected scripts.

Why candidates pick the wrong answer

Candidates may confuse injection attacks, thinking any injection that manipulates a query is similar, or they may not distinguish between SQL and LDAP syntax.

Candidates may confuse injection types, thinking any injected string is a command, or they may not recognize the specific SQL syntax patterns, leading them to choose a broader injection category.

Candidates may confuse injection attacks or think that any malicious input in web requests is XSS, especially when the response contains unexpected data, without recognizing the SQL-specific syntax and database commands.

Full explanation →

929

MCQmedium

A web team is moving a customer portal behind a new inspection device. They need something that can examine HTTP requests, block malicious patterns like injection attempts, and still allow normal browsing. Which control is most appropriate?

A.IDS, because it alerts on suspicious traffic without affecting application delivery.

B.WAF, because it understands web requests and can block malicious application-layer traffic.

C.DLP, because it can stop sensitive data from being posted to the portal.

D.NAC, because it verifies whether devices are allowed onto the network.

AnswerB

A web application firewall is deployed inline in front of the portal and operates at Layer 7, where it decodes and inspects HTTP/HTTPS requests, including headers, cookies, parameters, and request bodies. By matching traffic against signature-based rules (such as the OWASP Core Rule Set) and behavior, it can distinguish normal requests from SQL injection, cross-site scripting, and other application-layer attacks, then actively block or sanitize them before they reach the backend. This real-time, application-aware blocking is exactly what the team needs for a customer-facing portal that accepts untrusted input.

Why this answer

A WAF (Web Application Firewall) is the correct choice because it operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic. It can parse web requests, identify malicious patterns such as SQL injection or XSS payloads, and block them while allowing legitimate traffic to pass through to the customer portal.

Exam trap

The trap here is that candidates often confuse an IDS with an IPS (Intrusion Prevention System) and assume an IDS can block traffic, but an IDS is passive and only generates alerts, whereas a WAF is an active, inline control that can both detect and block application-layer attacks.

How to eliminate wrong answers

Option A is wrong because an IDS (Intrusion Detection System) is a passive device that only alerts on suspicious traffic; it cannot block malicious requests inline, so it would not prevent injection attempts from reaching the portal. Option C is wrong because DLP (Data Loss Prevention) focuses on detecting and preventing unauthorized transmission of sensitive data, not on blocking web application attacks like injection attempts. Option D is wrong because NAC (Network Access Control) verifies device compliance and access rights at the network layer, but it does not inspect application-layer HTTP requests or block injection patterns.

Full explanation →

930

MCQmedium

A DevOps team builds container images in a CI/CD pipeline. Security wants to reduce the chance of deploying vulnerable libraries and also wants the cluster to reject images that have not been approved. Which approach best meets both requirements?

A.Increase CPU and memory limits for the containers so they run more safely.

B.Allow developers to pull images from any registry as long as the tags look familiar.

C.Disable pipeline scanning to speed releases and rely on runtime monitoring after deployment.

D.Scan images in the pipeline and enforce signature verification or admission control before deployment.

AnswerD

Build-time scanning helps identify vulnerable packages before release, while signature verification or admission control ensures only approved images can run in the cluster. Together, these controls reduce both content risk and deployment risk. This is the strongest combined answer because it addresses prevention and policy enforcement.

Why this answer

It combines two essential security controls: scanning container images for known vulnerabilities (e.g., using Trivy or Clair) during the CI/CD pipeline, and enforcing signature verification (e.g., using Notary or Cosign) or admission control (e.g., using OPA/Gatekeeper or Kyverno) to ensure only signed or approved images are deployed. This directly reduces the risk of deploying vulnerable libraries and prevents unapproved images from running in the cluster.

Exam trap

The trap here is that candidates may think runtime monitoring (Option C) is sufficient, but it fails to prevent the initial deployment of vulnerable or unapproved images, which is the core requirement of the question.

How to eliminate wrong answers

Option A is wrong because increasing CPU and memory limits does not address vulnerability scanning or image approval; it only affects runtime resource allocation, not security posture. Option B is wrong because allowing images from any registry based on tag familiarity is insecure—tags can be easily spoofed or overwritten, and this bypasses any approval or integrity verification. Option C is wrong because disabling pipeline scanning removes the vulnerability detection step entirely, and relying solely on runtime monitoring cannot prevent the initial deployment of vulnerable or unapproved images.

Full explanation →

931

MCQhard

A help desk technician receives a call from someone claiming to be a new contractor whose MFA app failed during travel. The caller knows the company org chart, names the technician's supervisor, and says the technician should use a callback number included in a text message they just sent. What is the safest first action?

A.Reset MFA immediately, since the caller has provided enough internal details to seem credible.

B.Ask the caller to read a one-time code aloud so the technician can confirm their identity.

C.End the call and verify the request through a published help desk number or ticketing system.

D.Approve the request if the caller can name the supervisor and the contractor's project team.

AnswerC

The safest first action is to stop using information supplied by the caller and verify through a trusted, independently obtained contact path. Because the attacker already knows internal details and provided a callback number in a text, those channels cannot be trusted. Using a published help desk number or the official ticketing system preserves least risk and prevents social engineering from extending into account reset abuse.

Why this answer

The safest first action when receiving an unsolicited call requesting privileged actions (like MFA reset) is to independently verify the request through official channels. The caller's knowledge of internal details (org chart, supervisor name) and the request to use a callback number from a text message are classic social engineering red flags, as the callback number could be attacker-controlled. Hanging up and calling back via a published help desk number ensures the request is legitimate and prevents MFA bypass or account takeover.

Exam trap

The trap here is that candidates may assume the caller's knowledge of internal details (supervisor name, org chart) is sufficient proof of identity, but CompTIA tests the principle that any unsolicited request for privileged actions must be independently verified through a trusted channel, not through information the caller provides.

How to eliminate wrong answers

Option A is wrong because resetting MFA immediately based on internal details alone is dangerous; attackers can gather org chart and supervisor names via OSINT or previous breaches, and MFA reset is a high-risk action that should require verified identity. Option B is wrong because asking the caller to read a one-time code aloud is insecure; a one-time code sent to the caller's device could be intercepted or the caller could be the attacker who generated the code themselves, and this method does not verify the caller's identity against a trusted source. Option D is wrong because naming a supervisor and project team is not sufficient authentication; these details are often publicly available or easily guessed, and approving the request without independent verification violates the principle of least privilege and allows unauthorized access.

Full explanation →

932

MCQhard

A team stores sensitive archives on cloud block storage. The provider already encrypts disks at rest, but the company wants copies of the disks to remain unreadable even if a cloud administrator can snapshot and mount the volume. Which control is best?

A.Enable provider-managed encryption at rest only and rotate the storage passwords monthly.

B.Use client-side encryption before upload and keep the keys in an external HSM or key service.

C.Place the storage account in a private subnet and block all Internet access.

D.Rely on immutable snapshots and versioning to prevent unauthorized access.

AnswerB

Client-side encryption means the data is encrypted by your own application or tooling before any bytes are transmitted to the provider, so the provider never receives plaintext or the encryption keys. Keeping the keys in an external HSM or key service (separate from the cloud account) ensures that even if the storage account, snapshots, or mounted disks are copied or accessed by the provider's administrators, the ciphertext remains unreadable without the externally held keys. This achieves a zero-knowledge architecture where the provider cannot decrypt the data, directly addressing the risk of unauthorized administrative access to the cloud storage platform.

Why this answer

Client-side encryption ensures data is encrypted before it ever reaches the cloud provider's storage. By keeping the encryption keys in an external HSM or key service, the cloud provider (including its administrators) never has access to the plaintext keys, so even if they snapshot and mount the volume, the data remains unreadable. This addresses the threat model where the provider's own administrators could otherwise access the data at rest.

Exam trap

The trap here is that candidates assume provider-managed encryption at rest is sufficient against insider threats, but it does not protect against a cloud administrator who has access to the underlying infrastructure and can use snapshot/mount operations to bypass the encryption layer.

How to eliminate wrong answers

Option A is wrong because provider-managed encryption at rest still gives the cloud provider access to the encryption keys (or the means to decrypt), so a cloud administrator with snapshot and mount privileges could read the data. Rotating storage passwords does not change this fundamental access issue. Option C is wrong because placing the storage account in a private subnet and blocking Internet access only restricts network-level access; it does not prevent a cloud administrator from taking a snapshot and mounting it internally, nor does it encrypt the data to protect against that insider threat.

Full explanation →

933

MCQmedium

Users on a wired subnet report intermittent outages when reaching an internal application. A packet capture shows the default gateway IP address repeatedly mapped to a different workstation MAC address, and traffic is being forwarded through that workstation. What attack is most likely occurring?

A.DNS poisoning, because the hostname is resolving to the wrong server.

B.ARP spoofing, because false Layer 2 address mappings are redirecting traffic.

C.Replay attack, because packets are being resent to the gateway.

D.Rogue DHCP service, because clients are losing access to the default gateway.

AnswerB

ARP spoofing, also called ARP poisoning, happens when a host sends forged ARP messages that associate a target IP address with the attacker’s MAC address. In this case, the gateway IP is repeatedly being mapped to a workstation MAC, and traffic is being relayed through that workstation. That is a classic man-in-the-middle setup on a local network segment.

Why this answer

B is correct because ARP spoofing (also known as ARP poisoning) involves an attacker sending forged ARP messages over a local area network. This results in the attacker's MAC address being associated with the IP address of the default gateway, causing traffic destined for the gateway to be forwarded to the attacker's workstation instead. The packet capture evidence of the default gateway IP repeatedly mapped to a different workstation MAC address is the classic signature of this attack.

Exam trap

The trap here is that candidates often confuse ARP spoofing with DNS poisoning because both involve redirecting traffic, but ARP spoofing operates at Layer 2 (MAC address manipulation) while DNS poisoning operates at Layer 7 (hostname resolution).

How to eliminate wrong answers

Option A is wrong because DNS poisoning involves corrupting the DNS resolver cache or DNS server records to map a domain name to an incorrect IP address, not manipulating Layer 2 MAC-to-IP mappings on a local subnet. Option C is wrong because a replay attack involves capturing and retransmitting valid data packets to trick the receiver, not altering ARP tables to redirect traffic through a rogue host. Option D is wrong because a rogue DHCP service would assign incorrect IP configuration (including a fake gateway IP) to clients, but the symptom described is a specific MAC-to-IP mapping conflict for the existing gateway, not a DHCP lease issue.

Full explanation →

934

MCQmedium

A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?

A.Place all servers in the same VLAN and apply a host-based firewall on the database server.

B.Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.

C.Encrypt all data in transit using TLS and at rest using AES-256.

D.Implement network intrusion detection systems on all network segments.

AnswerB

This design creates a clear cardholder data environment (CDE) boundary. The dedicated firewall restricts access so only the application server can communicate with the database server on a specific port. The web server and application server can be placed outside the CDE if they do not directly transmit or store cardholder data, thereby reducing the PCI DSS scope.

Why this answer

Isolating the database server in a separate network segment with a dedicated firewall that restricts traffic to only the application server on the required port creates a clear network segmentation boundary. This segmentation limits the cardholder data environment (CDE) to just the database server, thereby minimizing the scope of the PCI DSS assessment by excluding the web and application servers from the CDE.

Exam trap

The trap here is that candidates often confuse security controls (encryption, IDS) with architectural segmentation, mistakenly believing that encryption or monitoring alone can reduce PCI DSS scope, when only network isolation with a firewall boundary achieves that.

Why the other options are wrong

Placing all servers in the same VLAN does not isolate the database server, so the entire network segment is in scope for PCI DSS. A host-based firewall on the database server alone does not reduce the network segmentation required to minimize scope.

Encryption protects data confidentiality but does not isolate the database server from the rest of the network; PCI DSS scope is determined by network segmentation, not encryption. Without segmentation, all servers are in scope.

Implementing network intrusion detection systems (NIDS) does not reduce the scope of PCI DSS assessment because scope is determined by the systems that store, process, or transmit cardholder data, not by security controls like NIDS.

When would these options actually be correct?

In a scenario where the question asks for a cost-effective security control to protect a single critical server within a flat network, and the primary concern is limiting lateral movement from compromised peers, placing all servers in the same VLAN with a host-based firewall on the critical server could be a valid answer.

A question asking how to protect cardholder data in transit and at rest to meet PCI DSS encryption requirements, without regard to reducing assessment scope.

A question asking for a security control to detect and alert on potential attacks against cardholder data environments, where the goal is to improve monitoring and incident response capabilities, not to reduce PCI DSS scope.

Why candidates pick the wrong answer

Candidates may think that a host-based firewall provides sufficient isolation, not realizing that PCI DSS requires network segmentation (e.g., separate subnet with a firewall) to reduce scope, not just host-level controls.

Candidates often confuse security controls (encryption) with scope reduction, believing that encrypting data eliminates the need for network segmentation.

Candidates may think that adding security controls like NIDS automatically reduces compliance scope, but PCI DSS scope is about network segmentation and data flow, not just security tools.

Full explanation →

935

MCQhard

A Linux server is missing expected security-agent processes, but users can still connect to the application. Local command output does not show a suspicious daemon that another monitoring tool says is listening on port 4444. A raw disk scan reveals a kernel module loaded at boot, and several files appear only when viewed outside the normal operating system tools. What malware type is most likely?

A.Trojan, because it could have introduced the suspicious service after the initial compromise.

B.Spyware, because it may collect data while leaving the application functional.

C.Rootkit, because kernel-level components are hiding processes and files from normal user-mode visibility.

D.Logic bomb, because the malware activates after startup and changes what administrators see.

AnswerC

A rootkit is the best answer because the evidence points to concealment at the operating system level. A kernel module loaded at boot, missing processes in standard listings, and files visible only through raw disk examination all indicate malicious hiding behavior. Rootkits are designed to obscure other malware or unauthorized access, making them especially dangerous and difficult to detect with normal administrative tools.

Why this answer

The scenario describes a rootkit: a kernel-level rootkit can load a malicious kernel module at boot, intercept system calls (e.g., `open`, `readdir`, `netstat`), and hide processes, files, and network listeners from user-mode tools like `ps`, `ls`, or `netstat`. The raw disk scan reveals files invisible to normal OS tools, and the missing security-agent processes and hidden daemon on port 4444 are classic signs of kernel-mode hooking that bypasses standard visibility.

Exam trap

The trap here is that candidates may confuse a rootkit with a Trojan or spyware because all three can persist, but only a rootkit operates at kernel level to hide its artifacts from user-mode commands like `ps`, `ls`, and `netstat`.

How to eliminate wrong answers

Option A is wrong because a Trojan is a type of malware that disguises itself as legitimate software but does not inherently provide kernel-level hiding capabilities; the key evidence here is kernel module loading and file/process concealment, which is the hallmark of a rootkit, not a Trojan. Option B is wrong because spyware focuses on data collection and typically does not modify the kernel to hide its own processes or files; the described behavior of hiding a daemon and files from normal tools goes far beyond spyware's typical user-mode surveillance.

Full explanation →

936

Matchingeasy

Match each PKI term to what it does.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Issues and signs digital certificates.

Binds an identity to a public key.

Can be shared with others to encrypt data or verify signatures.

Must be kept secret and is used to decrypt or sign.

Removes trust from a certificate that should no longer be used.

Why these pairings

CA issues certificates, RA verifies identities, CRL lists revoked certificates, public key encrypts, private key decrypts, digital signature provides integrity and non-repudiation.

Full explanation →

937

MCQmedium

A security manager publishes a document that tells help desk staff exactly how to verify identity, reset an admin password, record the ticket number, and close out the request during a maintenance window. What type of governance artifact is this?

A.Policy

B.Standard

C.Procedure

D.Guideline

AnswerC

A procedure is the correct choice because it provides a detailed, step-by-step set of actions that must be performed in order to complete a task reliably and consistently. The security manager's document tells help desk staff exactly how to handle an issue, ensuring that every employee follows the same sequence and meets security and quality expectations. Procedures are essential for routine operational tasks, such as verifying identity before resetting a password, because they reduce ambiguity and support auditing and training.

Why this answer

A procedure is a step-by-step, ordered list of tasks required to perform a specific operational activity. The document describes exactly how to verify identity, reset an admin password, record the ticket number, and close out the request, which matches the definition of a procedure in governance frameworks.

Exam trap

The trap here is confusing a procedure with a policy or standard, where candidates often pick 'policy' because they think any security document is a policy, but the detailed step-by-step nature uniquely identifies a procedure.

How to eliminate wrong answers

Option A is wrong because a policy is a high-level statement of management intent, not a detailed step-by-step instruction. Option B is wrong because a standard defines mandatory requirements or specifications (e.g., password complexity rules), not the exact sequence of actions. Option D is wrong because a guideline offers recommendations or best practices, not mandatory, prescriptive steps.

Full explanation →

938

Multi-Selecteasy

A user's workstation suddenly renames documents with a new extension, displays a ransom note, and blocks access to a shared drive. Which two indicators support ransomware? Select two.

Select 2 answers

A.Files are renamed or encrypted and no longer open normally

B.A ransom note demands payment for decryption or restoration

C.The mouse pointer moves slowly after long idle periods

D.The browser homepage changed after a software update

E.A new USB keyboard is detected by the operating system

AnswersA, B

Ransomware typically enumerates user files and applies symmetric encryption (e.g., AES) with a per-file key, then appends an extension such as .locked or .crypt. Renaming and encrypting prevents normal access via the OS file system, because the original file system metadata and content are replaced. This behavior is a direct, observable consequence of the malware's core objective: to hold data hostage until a ransom is paid.

Why this answer

Ransomware typically encrypts files and renames them with a new extension (e.g., .encrypted, .locked), making them unopenable without the decryption key. This behavior directly matches the scenario where documents are renamed and access is blocked, confirming file encryption as a core indicator of ransomware.

Exam trap

The trap here is that candidates may confuse general system performance issues (like a slow mouse) with ransomware indicators, but ransomware focuses on file encryption and ransom demands, not on input device behavior.

Full explanation →

939

Multi-Selectmedium

A help desk technician receives a call from someone claiming to be a contractor whose MFA device was lost during travel. The caller knows the company org chart and asks for a new device enrollment. Which three responses are appropriate? Select three.

Select 3 answers

A.Refuse to bypass identity verification requirements.

B.Use a known callback number or approved ticketing process to confirm identity.

C.Report the interaction to the security team if the call seems suspicious.

D.Read the current MFA reset code over the phone to speed up recovery.

E.Enroll the new device immediately because the caller knows company names and roles.

AnswersA, B, C

Knowing internal names is not enough; identity checks must still follow the approved process.

Why this answer

Bypassing identity verification for MFA device enrollment would undermine the security that MFA provides. The caller's knowledge of the org chart does not constitute proof of identity; social engineering attacks often leverage such information. Refusing to bypass verification ensures that only authorized users can enroll new MFA tokens, maintaining the integrity of the authentication process.

Exam trap

The trap here is that candidates may assume knowledge of internal details (like the org chart) is sufficient proof of identity, but social engineering attacks frequently exploit such information to bypass security controls.

Full explanation →

940

Multi-Selectmedium

A software supplier is adding a new subcontractor to process your company's customer data. The security team wants to understand the new exposure before allowing the change. Which three items should it request or review first? Select three.

Select 3 answers

A.A list of the subcontractor's locations and where the data will be processed.

B.The subcontractor's logo and marketing brochure.

C.A data-processing agreement that flows down security and notification obligations.

D.An independent security assessment, such as a SOC report or equivalent.

E.The supplier's quarterly sales forecast.

AnswersA, C, D

Knowing the specific locations where a subcontractor operates and where it will process data allows the organization to map data flows to legal jurisdictions. This is essential for assessing compliance with data protection regulations such as GDPR, which restrict cross-border transfers to countries without an adequacy decision, and for understanding whether data will be subject to foreign government access or conflicting privacy laws. Without this information, the organization cannot properly perform a risk assessment or meet its own regulatory obligations.

Why this answer

Understanding where data will be processed and the subcontractor's physical locations is critical for assessing jurisdictional risks, data sovereignty requirements, and compliance with regulations like GDPR or CCPA. The security team needs this information to evaluate potential exposure to different legal frameworks and physical security controls before granting access to customer data.

Exam trap

The trap here is that candidates may mistakenly think marketing materials or logos are relevant for security assessments, when in fact only operational, legal, and technical documentation (like locations and DPAs) provide actionable risk information.

Full explanation →

941

MCQhard

Based on the exhibit, what is the BEST response by the employee? The message appears to come from a trusted internal support team, but the sender details and request do not align with normal procedures.

A.Verify the request using a known internal help desk number or portal before taking any action.

B.Reply with the six-digit code so the help desk can complete the repair quickly.

C.Open the linked repair page from the email and sign in immediately to avoid suspension.

D.Forward the message to the manager and continue using the account until the suspension occurs.

AnswerA

The employee should verify the request through an independently known help desk number or portal, not through any contact details embedded in the email. This message combines urgency, a mismatched reply-to address, and a request for an MFA code — classic indicators of a phishing or vishing attempt. Calling the official help desk number or logging into the official support portal confirms whether the repair request is legitimate before any sensitive action is taken. This out-of-band verification prevents both credential theft and MFA token compromise.

Why this answer

Verifying the request through a known internal help desk number or portal is the standard security practice to confirm the legitimacy of any unexpected communication, especially when sender details and procedures do not align. This approach mitigates the risk of social engineering attacks, such as phishing or business email compromise (BEC), where attackers impersonate trusted entities to trick employees into revealing sensitive information or performing unauthorized actions. By using an independently verified contact method, the employee ensures they are not falling victim to a fraudulent request that could lead to account compromise or data breach.

Exam trap

The trap here is that candidates may assume the email is legitimate because it appears to come from a trusted internal source, leading them to choose an action that involves direct interaction with the email (like replying or clicking a link) rather than verifying through an independent channel, which is the core principle of social engineering defense.

How to eliminate wrong answers

Option B is wrong because replying with a six-digit code directly to the email sender could provide an attacker with a one-time passcode (OTP) or verification code, enabling them to bypass multi-factor authentication (MFA) or gain unauthorized access to the employee's account. Option C is wrong because opening a linked repair page from the email and signing in immediately could lead to a credential harvesting site that captures the employee's username and password, compromising their account. Option D is wrong because forwarding the message to the manager and continuing to use the account until suspension occurs does not prevent potential compromise; the employee remains vulnerable to further exploitation while the manager investigates, and the account could be used maliciously in the interim.

Full explanation →

942

Multi-Selecteasy

A security team wants to reduce the chance that employees boot unmanaged tools from removable media and wants only approved software to run on laptops. Which two controls should they use? Select two.

Select 2 answers

A.Secure Boot

B.Application control or allowlisting

C.DNS forwarding

D.Longer screen-lock timeout

E.Public DNS resolvers

AnswersA, B

Secure Boot helps ensure the device starts using trusted boot components instead of unapproved pre-boot code. That reduces the risk of tampered boot media or rogue recovery tools.

Why this answer

Secure Boot is correct because it ensures that only signed, trusted firmware and bootloaders execute during system startup, preventing unauthorized bootable media (e.g., USB drives with unmanaged OS images) from loading. This directly reduces the chance that employees can boot unmanaged tools from removable media by enforcing a chain of trust from UEFI firmware to the operating system kernel.

Exam trap

The trap here is that candidates may confuse DNS forwarding (a network service) with DNS filtering or security controls, or think that a longer screen-lock timeout improves security, when in fact it weakens physical security by extending the window of opportunity for unauthorized access.

Full explanation →

943

MCQmedium

After containment and eradication of malware on several laptops, the team restores the devices from known-good images and verifies that users can authenticate and access email. Which action should occur NEXT to complete the incident response lifecycle and reduce future impact?

A.Close the ticket immediately because the systems are working again

B.Perform a lessons-learned review and update playbooks, controls, or detections based on the incident

C.Reimage the laptops again even though they were already restored and tested

D.Disable all email access for the organization until the next quarterly meeting

AnswerB

A lessons-learned review is the formal post-incident activity in the NIST and SANS incident response frameworks. It examines what worked, what failed, and which detection rules, playbooks, or security controls need adjustment, turning the incident into actionable intelligence. Updating playbooks and detections based on the observed TTPs (tactics, techniques, and procedures) reduces recurrence and improves response time for future incidents. This is the correct step because it captures continuous improvement rather than merely restoring service.

Why this answer

The incident response lifecycle includes a post-incident activity phase where the team conducts a lessons-learned review to identify gaps in security controls, update playbooks, and improve detection signatures. This step ensures that the organization reduces the likelihood and impact of similar incidents in the future, completing the lifecycle beyond just restoring operations.

Exam trap

The trap here is that candidates assume the incident response lifecycle ends once systems are restored and operational, overlooking the mandatory post-incident activity phase that ensures continuous improvement and prevents recurrence.

How to eliminate wrong answers

Option A is wrong because closing the ticket immediately after restoration skips the critical post-incident review phase, leaving vulnerabilities unaddressed and missing opportunities to improve defenses. Option C is wrong because reimaging the laptops again is redundant and wastes resources; the devices have already been restored from known-good images and verified for functionality. Option D is wrong because disabling all email access until a quarterly meeting is an extreme, unnecessary measure that disrupts business operations and does not address the root cause or improve security posture.

Full explanation →

944

MCQmedium

A security analyst receives an alert from the intrusion detection system indicating that a workstation in the finance department has established an outbound connection to a known malicious IP address using an encrypted protocol. The analyst verifies the alert and checks the user's activity logs, which show no legitimate business reason for the connection. According to the incident response process, what should the analyst do NEXT?

A.Begin the eradication phase by immediately reimaging the workstation.

B.Isolate the workstation from the network to contain the threat.

C.Conduct a full forensic analysis of the workstation's hard drive.

D.Update the firewall rule to block all outbound traffic to the malicious IP.

AnswerB

Isolation is the immediate containment step in the NIST incident response lifecycle, and it should be performed as soon as a compromise is confirmed. By moving the workstation to a quarantine VLAN, disabling its network interface, or physically disconnecting it, you sever the active command-and-control channel and prevent the attacker from using this host to pivot laterally. This action also preserves volatile evidence in memory for later forensic acquisition, making it the correct first response to an intrusion alert.

Why this answer

According to the NIST SP 800-61 incident response process, containment is the immediate priority after verification to prevent further damage or data exfiltration. Since the workstation has an active encrypted outbound connection to a known malicious IP with no legitimate business reason, isolating the network interface (e.g., disabling the port, blocking the MAC address, or unplugging the cable) stops the threat from communicating while preserving the system state for later analysis. This aligns with the containment phase, which must precede eradication or full forensic analysis.

Exam trap

The SY0-701 exam often tests the order of the incident response phases (Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident) and the trap here is that candidates jump to eradication or forensic analysis without first containing the active threat, which violates the fundamental priority of stopping the bleeding before cleaning up.

Why the other options are wrong

In the incident response process, containment (isolating the workstation) must precede eradication (reimaging). Reimaging without containment could allow the threat to spread or lose volatile evidence.

In the incident response process, containment (isolating the workstation) must occur before eradication or forensic analysis. Conducting a full forensic analysis at this stage would delay containment and allow the threat to persist or spread.

After confirming an active threat, the immediate priority is containment (isolating the workstation) to prevent further damage, not updating firewall rules, which is a longer-term preventive measure.

When would these options actually be correct?

This option would be correct if the question stated that containment has already been performed (e.g., the workstation is already isolated) and the analyst has confirmed the system is compromised with no need for forensic preservation, so the next step is eradication.

A question where the incident has already been contained, and the analyst is now in the eradication or post-incident activity phase, such as: 'After isolating the compromised workstation and blocking the malicious IP, what should the analyst do NEXT to gather evidence for legal proceedings?'

This would be correct if the question stated that the analyst had already contained the threat and was now implementing permanent controls to prevent recurrence, or if the scenario involved a known malicious IP that needed to be blocked proactively across the network.

Why candidates pick the wrong answer

Candidates may think reimaging is a quick fix to remove malware, but they overlook the critical containment step required to prevent lateral movement and preserve evidence.

Candidates may think forensic analysis is the immediate next step to understand the attack, but they overlook the priority of containment to prevent further damage.

Candidates may think blocking the IP is a quick fix to stop the connection, but they overlook that the workstation is already compromised and needs isolation first.

Full explanation →

945

MCQmedium

A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?

A.95% of employees completed the training within the deadline.

B.The number of employees reporting phishing attempts to the SOC increased by 40%.

C.The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.

D.The number of helpdesk tickets related to password resets decreased by 10%.

AnswerC

A simulated phishing click-through rate is a direct behavioral measure: it tests precisely the skill the training is designed to improve, and the marked drop from 18% to 6% shows employees are applying their knowledge in realistic conditions. Unlike self-reports or knowledge quizzes, this metric captures actual decision-making under a simulated attack, making it strong evidence of decreased susceptibility. The pre/post comparison controls for prior awareness and isolates the training’s impact on the target behavior, which is why it is the most convincing effectiveness indicator.

Why this answer

Directly measures the reduction in risky behavior (clicking phishing links) after training, which is the core goal of security awareness training. A drop from 18% to 6% demonstrates a measurable behavior change, not just knowledge acquisition. This aligns with the Kirkpatrick Model's 'Behavior' level of evaluation, which is the strongest indicator of training effectiveness.

Exam trap

The trap here is that candidates often choose Option B (increased reporting) because it sounds proactive, but the question specifically asks for evidence of 'changing employee behavior' away from clicking, not just improving reporting habits.

Why the other options are wrong

Completion rate (95%) measures training participation, not behavior change. The goal is to reduce risky actions like clicking phishing links, not just completing modules.

An increase in reporting phishing attempts indicates improved awareness, but it does not directly measure behavior change in terms of reducing risky actions like clicking. The question specifically asks for evidence of behavior change, and reporting is a secondary action, not the primary risky behavior.

A decrease in password reset tickets is not directly tied to security awareness training; it could result from other factors like improved password policies or self-service tools, and does not measure behavioral change regarding phishing or security awareness.

When would these options actually be correct?

A question asking for evidence of training program adoption or compliance, e.g., 'Which metric best indicates that employees completed the mandatory training on time?'

This option would be correct if the question asked: 'Which metric best indicates that employees are more vigilant and actively participating in the security program?' or 'Which metric demonstrates an increase in security-conscious behavior following training?'

This metric would be correct if the question asked for evidence that the training improved password hygiene or reduced account compromise incidents, such as after a training module on password security and multi-factor authentication.

Why candidates pick the wrong answer

Candidates confuse completion rates with effectiveness, assuming high participation automatically means behavior change.

Candidates may think that more reporting directly correlates with better security behavior, overlooking that the core goal is to reduce clicks, not just increase reports. They might also confuse awareness (knowing to report) with behavior change (not clicking).

Candidates may assume that any positive metric following training indicates effectiveness, overlooking that password resets are not a direct measure of security awareness behavior change.

Full explanation →

946

MCQmedium

A vulnerability scan reports a critical finding on a legacy application server. The security team verifies that the flagged package is installed, but the vulnerable code path is disabled by configuration and cannot be exploited in the current deployment. The vendor will not support a patch until next quarter. What is the best next step?

A.Ignore the finding because the scanner produced a false positive

B.Request a risk exception and document compensating controls until patching is possible

C.Disable the vulnerability scanner to prevent repeated alerts

D.Immediately retire the server even though the application is still business-critical

AnswerB

This is the best response because the team has confirmed the issue cannot be immediately remediated, but the organization still needs formal risk ownership. A risk exception documents the temporary acceptance, while compensating controls capture what is being done to reduce exposure until a supported patch becomes available. That is the right balance between operational constraints and security governance.

Why this answer

The vulnerability is real (the package is installed), but the risk is mitigated by a compensating control (the vulnerable code path is disabled). A risk exception formally documents this compensating control and the planned patch timeline, ensuring the finding is tracked and not forgotten. This aligns with the SY0-701 objective of managing risk through formal acceptance and compensating controls when immediate remediation is not possible.

Exam trap

The trap here is that candidates confuse a 'false positive' (scanner error) with a 'vulnerability that is mitigated by a compensating control' — the scanner is correct, but the risk is lower than the raw CVSS score suggests.

How to eliminate wrong answers

Option A is wrong because the scanner did not produce a false positive; the vulnerable package is indeed installed, and the scanner correctly identified it. The fact that the code path is disabled is a compensating control, not a false positive. Option C is wrong because disabling the vulnerability scanner would eliminate visibility into all findings, including legitimate ones, and violates security monitoring best practices.

Option D is wrong because retiring a business-critical server without a replacement or migration plan would cause unacceptable operational impact, and the risk is already mitigated by the disabled code path.

Full explanation →

947

MCQmedium

A security team suspects a rootkit after seeing hidden processes, boot-time persistence, and altered system files on a laptop. What is the best next step after confirming the suspicion?

A.Run a quick cleanup script and return the laptop to the user

B.Disconnect the laptop, then reimage it from a known-good source

C.Disable the user account and leave the device in place

D.Delete the suspected hidden files manually from Windows Explorer

AnswerB

Disconnecting the laptop isolates it from the network, stopping any ongoing command-and-control communication, data exfiltration, or lateral movement. Reimaging from a known-good source (after securely erasing the disk, and ideally verifying firmware integrity) removes not only the visible malware but also any kernel-level or boot-level persistence mechanisms. This is the only option that provides a trustworthy, verifiable baseline for returning the device to service.

Why this answer

Once a rootkit is confirmed, the system's integrity is compromised at the kernel or boot level, making any software-based cleanup unreliable. Reimaging from a known-good source ensures all malicious code, including bootkits and hidden processes, is completely eradicated. This aligns with the SY0-701 domain of incident response, where containment and eradication require a trusted baseline.

Exam trap

The trap here is that candidates may think a cleanup script or manual deletion is sufficient, but rootkits operate below the OS level, making reimaging the only reliable method to restore integrity.

How to eliminate wrong answers

Option A is wrong because a quick cleanup script cannot remove rootkits that operate at ring 0 or modify the Master Boot Record (MBR); the malware will persist or reinfect. Option C is wrong because disabling the user account does not remove the rootkit from the laptop, leaving the device compromised and potentially spreading to other systems on the network. Option D is wrong because manually deleting files from Windows Explorer cannot remove kernel-mode rootkits that hide their processes and files from user-mode tools, and it may trigger anti-forensic mechanisms.

Full explanation →

948

MCQmedium

Field technicians use company-owned tablets that also run approved personal apps. Security needs corporate email and documents isolated from personal data, selective wipe of only business content if a device is lost, and compliance checks before access is allowed. What should be deployed?

A.Full-disk encryption on the tablets with no additional device management.

B.Mobile device management with a work profile or container and conditional access.

C.A mobile VPN client with split tunneling enabled for user convenience.

D.An antivirus app with a blacklist of approved and unapproved mobile apps.

AnswerB

Mobile device management (MDM) with a work profile or container creates a hard logical separation between corporate data and personal apps on the same tablet. Conditional access policies can then require device compliance (such as patch level, root/jailbreak status, and lock screen strength) before granting access to corporate email or internal applications. This architecture allows IT to selectively wipe only the managed corporate container without touching personal data, and to enforce app-level restrictions. Together, containerization and conditional access directly address the need to manage company-owned tablets that also serve personal use, unlike encryption, VPN, or antivirus alone.

Why this answer

Mobile device management (MDM) with a work profile or container (e.g., Android Work Profile or iOS Managed Open In) provides the required isolation between corporate and personal data. Conditional access enforces compliance checks (e.g., device health attestation, OS patch level) before granting access to corporate resources. This combination also enables selective wipe of only the work container without affecting personal apps or data, meeting the lost-device requirement.

Exam trap

The trap here is that candidates confuse full-disk encryption (which only protects data at rest) with the isolation and selective-wipe capabilities of a managed work profile, or they assume a VPN or antivirus alone can enforce data separation and compliance checks.

How to eliminate wrong answers

Option A is wrong because full-disk encryption protects data at rest but does not isolate corporate from personal data, nor does it support selective wipe or compliance-based access control. Option C is wrong because a mobile VPN with split tunneling only controls network routing for user convenience; it provides no data isolation, no selective wipe capability, and no compliance enforcement. Option D is wrong because an antivirus app with an app blacklist only blocks or allows specific applications; it cannot isolate corporate data, perform selective wipes, or enforce compliance checks before access.

Full explanation →

949

Multi-Selectmedium

A finance workflow currently lets one employee create a payment batch and approve it in the same session. Audit findings say the design increases fraud risk. Which two access architecture changes best reduce that risk while keeping the process functional? Select two.

Select 2 answers

A.Split the workflow into separate creator and approver roles.

B.Require the approver to be a different authenticated user before release.

C.Grant all finance users local administrator rights to speed up exception handling.

D.Store the payment password in a shared mailbox so the team can continue when someone is absent.

E.Remove approval steps entirely and rely on log reviews after payment runs.

AnswersA, B

Separating creator and approver responsibilities implements separation of duties and prevents one person from completing the full fraud-prone action alone. This preserves the workflow while requiring a second trusted person to review and approve the batch. It is a classic access architecture control for payment and procurement systems.

Why this answer

Implementing separation of duties (SoD) by splitting the payment batch creation and approval into distinct roles ensures that no single user can both create and approve a transaction. This directly mitigates the fraud risk identified in the audit by requiring collusion between two users to execute a fraudulent payment. The process remains functional because the workflow is simply reordered into two sequential steps performed by different users.

Exam trap

The trap here is that candidates may confuse 'functional efficiency' with 'security best practices' and incorrectly choose option C, thinking that local admin rights will speed up exception handling, when in fact it violates least privilege and separation of duties.

Full explanation →

950

MCQmedium

A customer portal runs from a primary data center. Management wants the secondary site to take over within minutes if the primary site loses power, and the secondary site should already have current systems and data ready to serve users. Which design best fits this requirement?

A.A cold site with nightly backups stored offsite

B.A hot site with synchronized data replication and automated failover

C.RAID 0 across two storage arrays in the primary data center

D.A single backup server with larger disks and more memory

AnswerB

A hot site is already prepared to operate and can receive traffic quickly when the primary site fails. Synchronized replication keeps data current, and automated failover minimizes manual intervention and recovery time. This is the best match for a near-immediate continuity requirement.

Why this answer

A hot site with synchronized data replication and automated failover is the correct choice because it maintains an exact, real-time copy of systems and data at the secondary site. Synchronous replication ensures zero data loss (RPO=0), and automated failover enables the secondary site to become operational within minutes (RTO measured in minutes), meeting the requirement for immediate takeover after a power loss at the primary site.

Exam trap

The trap here is that candidates confuse a cold site with nightly backups as sufficient for rapid recovery, failing to recognize that the RTO of minutes requires pre-staged, synchronized systems and automated failover, not manual restoration from backups.

How to eliminate wrong answers

Option A is wrong because a cold site has no pre-installed hardware or current data; it requires manual setup and restoration from nightly backups, which takes hours or days, not minutes, and cannot achieve the required RTO. Option C is wrong because RAID 0 provides striping for performance but offers no fault tolerance; if either array fails, all data is lost, and it does not address site-level failover or power loss at the primary data center.

Full explanation →

951

MCQmedium

Sales representatives use company-managed smartphones for email, CRM, and document access. If a phone is lost, IT must remove only the corporate apps and work data without erasing the employee's personal photos and contacts. Which control should be used?

A.Perform a full factory reset remotely as soon as any device is reported lost.

B.Use selective wipe through a mobile device management platform.

C.Disable password complexity so the user can regain access more easily after replacement.

D.Install a VPN profile and assume corporate data is safe if the network traffic is encrypted.

AnswerB

Selective wipe, executed through an MDM platform, targets only the corporate container or managed objects on the device, including work email, calendar, VPN profiles, certificates, and managed applications. Because personal data remains intact, this approach aligns with BYOD and COPE deployment models where users retain a privacy expectation. The remote administrative action also supports immediate response to a lost device without the collateral damage of a full factory reset.

Why this answer

Mobile Device Management (MDM) platforms support selective wipe, which uses management APIs (e.g., Android Enterprise Work Profile or iOS Managed Open In) to remove only corporate apps, accounts, and data while leaving personal content intact. This satisfies the requirement to protect corporate data without infringing on the employee's personal privacy.

Exam trap

The trap here is that candidates often confuse full factory reset (option A) with selective wipe, assuming any remote wipe will suffice, but the exam specifically tests the distinction between wiping all data versus only corporate-managed data.

How to eliminate wrong answers

Option A is wrong because a full factory reset erases all data on the device, including personal photos and contacts, which violates the requirement to preserve personal data. Option C is wrong because disabling password complexity weakens device security and does not address the need to selectively remove corporate data; it also does not help regain access after replacement. Option D is wrong because installing a VPN profile only encrypts network traffic in transit and does not provide any mechanism to remotely remove corporate data from a lost device.

Full explanation →

952

Multi-Selectmedium

A security team is reviewing vulnerabilities in a web application. Which three of the following are common web application vulnerabilities that should be addressed? (Choose three.)

Select 3 answers

.Cross-site scripting (XSS)

.ARP poisoning

.SQL injection

.XML external entity (XXE) injection

.DNS cache poisoning

.Evil twin attack

Why this answer

Cross-site scripting (XSS) is a common web application vulnerability where an attacker injects malicious scripts into web pages viewed by other users, often through input fields or URL parameters. SQL injection occurs when an application improperly sanitizes user input in SQL queries, allowing attackers to manipulate the database. XML external entity (XXE) injection exploits poorly configured XML parsers to process external entities, leading to data disclosure or server-side request forgery.

These three are consistently listed in the OWASP Top 10 as critical web application flaws.

Exam trap

The SY0-701 exam often tests the distinction between web application vulnerabilities (like XSS, SQLi, XXE) and network-level attacks (like ARP poisoning, DNS cache poisoning, evil twin), so candidates mistakenly select network attacks because they are familiar, but they are not specific to web applications.

Full explanation →

953

MCQeasy

After a file server is restored from backup, users can open the share, but the business wants to be sure the recovery was successful. What should the administrator verify next?

A.Only that the restore completed without any error message.

B.That representative files open correctly and the restored data matches the required recovery point.

C.That the server has enough free disk space for future growth.

D.That the backup software icon appears green on the console.

AnswerB

This is the best answer because restore verification should confirm both data usability and recovery accuracy. A successful job status alone is not enough; the team should test sample files, confirm permissions, and ensure the data reflects the expected recovery point objective. That proves the backup can actually support operations after an outage and not just complete technically.

Why this answer

Verifying that representative files open correctly and match the required recovery point (RPO) confirms data integrity and completeness, not just that the restore process ran without errors. This aligns with the backup validation principle of performing a data integrity check, such as comparing file hashes or checking timestamps, to ensure the restored data is usable and meets the business's recovery objectives.

Exam trap

The trap here is that candidates assume a successful restore job status (no errors) is sufficient, but CompTIA tests the understanding that validation requires actual data verification against the recovery point, not just process completion.

How to eliminate wrong answers

Option A is wrong because a restore completing without error messages only confirms the process finished, not that the data is intact or usable; silent corruption or missing files can occur. Option C is wrong because verifying free disk space for future growth is a capacity planning task unrelated to validating the success of a specific recovery operation. Option D is wrong because a green icon on the backup software console only indicates the backup job ran, not that the restored data is correct or meets the recovery point objective.

Full explanation →

954

MCQmedium

An email gateway receives a macro-enabled spreadsheet from an external supplier. Signature-based scanning does not flag it, but the security team wants to observe whether it drops files, creates persistence, or contacts suspicious domains before delivery to the user. Which tool best meets this need?

A.DLP, because it prevents any document from leaving the organization.

B.Sandboxing, because it detonates the file and observes malicious behavior safely.

C.NAC, because it can block the supplier's laptop from the network.

D.A SIEM, because it can block the attachment and quarantine the message.

AnswerB

Sandboxing is designed to execute suspicious files in a controlled environment and watch what they do. That makes it ideal when signature-based tools miss a potentially malicious attachment and the team wants to see whether it drops files, modifies persistence settings, or reaches out to command-and-control infrastructure. It gives analysts behavior-based insight before the attachment reaches the end user.

Why this answer

Sandboxing is the correct choice because it detonates the file in an isolated, controlled environment to observe its runtime behavior, such as dropping files, creating persistence mechanisms, or making outbound connections to suspicious domains. Unlike signature-based scanning, sandboxing can detect unknown or zero-day malware by analyzing behavioral indicators without risking the production network.

Exam trap

CompTIA often tests the distinction between passive detection (signature-based, SIEM correlation) and active behavioral analysis (sandboxing), leading candidates to choose SIEM because they confuse log aggregation with dynamic file analysis.

How to eliminate wrong answers

Option A is wrong because DLP (Data Loss Prevention) focuses on preventing unauthorized exfiltration of sensitive data, not on analyzing file behavior for malware. Option C is wrong because NAC (Network Access Control) enforces access policies based on device compliance, not on detonating and analyzing attachments. Option D is wrong because a SIEM (Security Information and Event Management) aggregates and correlates logs for detection and alerting, but it does not actively detonate files or observe runtime behavior; it relies on data from other tools.

Full explanation →

955

Drag & Dropmedium

Drag and drop the steps for the RADIUS authentication process into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

RADIUS uses UDP; the NAS acts as a client to the RADIUS server, which authenticates and authorizes the user.

Full explanation →

956

MCQmedium

A security analyst detects repeated outbound traffic from a single workstation to an IP address listed on a public threat intelligence feed as a known command-and-control server. The user reports that the workstation is behaving slowly and that antivirus software is up to date. According to incident response best practices, what should the analyst do FIRST?

A.Disconnect the workstation from the network

B.Run a full antivirus scan on the workstation

C.Notify the user that their workstation may be compromised

D.Check the firewall logs to confirm the destination IP

AnswerA

Disconnecting the workstation from the network—by unplugging the Ethernet cable, turning off Wi-Fi, or deactivating the virtual NIC—stops the observed outbound traffic instantly. This containment step severs the command-and-control channel and aborts any ongoing data exfiltration, which is the immediate priority in incident response. It also prevents the malicious process from spreading laterally to other systems on the same segment. While this may lose some volatile network connections, the value of halting the threat outweighs forensic collection at this stage.

Why this answer

The correct first step is to disconnect the workstation from the network to immediately contain the threat and prevent further command-and-control (C2) communication. Since the traffic is already confirmed to a known C2 server via a public threat intelligence feed, the priority is to stop data exfiltration and potential lateral movement, not to gather more evidence or notify the user. Incident response best practices emphasize containment before eradication or notification to minimize damage.

Exam trap

The trap here is that candidates often choose to gather more evidence (Option D) or run a scan (Option B) first, forgetting that containment is the immediate priority once a live C2 connection is confirmed, per the NIST SP 800-61 incident response lifecycle.

Why the other options are wrong

Running a full antivirus scan delays containment; the priority is to stop potential data exfiltration or lateral movement by immediately isolating the workstation from the network.

Notifying the user before containing the threat could cause panic or lead to the user taking actions that disrupt forensic evidence or further compromise the system. Incident response best practices prioritize containment (disconnecting the network) over communication.

Checking firewall logs to confirm the destination IP is a secondary step; the priority is immediate containment by disconnecting the workstation to prevent further C2 communication.

When would these options actually be correct?

This would be correct if the question stated that the antivirus was not up to date and the analyst had already verified the traffic as suspicious but not yet confirmed malicious, making a scan the next logical step before escalation.

In a scenario where the analyst has already contained the threat (e.g., disconnected the workstation) and needs to inform the user about the incident and next steps, such as for an interview or data collection, notifying the user would be appropriate.

If the question asked for the first step after containment (e.g., 'After disconnecting the workstation, what should the analyst do next?'), then checking firewall logs to gather evidence and confirm the threat would be appropriate.

Why candidates pick the wrong answer

Candidates may assume antivirus is the primary defense and that scanning is the standard first response, overlooking the urgency of containing a confirmed C2 communication.

Candidates may think that informing the user is a logical first step to gather information or warn them, but they overlook the immediate need to stop the command-and-control communication to prevent data exfiltration or further compromise.

Candidates may think verification is necessary before action, but in incident response, containment takes precedence over confirmation when a clear indicator of compromise exists.

Full explanation →

957

Multi-Selecteasy

Company-owned tablets run both business apps and approved personal apps. Which two controls best keep company data separated and support selective wipe? Select two.

Select 2 answers

A.Mobile device management with a work profile or container for corporate data.

B.Selective remote wipe of only the managed corporate container.

C.Allow users to install any app if they promise not to open work files.

D.Store corporate files in the personal photo gallery for easier backup.

E.Disable screen locks so users can access business apps faster.

AnswersA, B

A mobile device management (MDM) work profile—such as Android Enterprise work profile or iOS managed app configuration—creates a cryptographically isolated container where corporate data, apps, and policies are managed separately from the personal environment. The container enforces its own PIN policy, encryption, app allowlisting, and traffic routing rules, so business data remains protected even on a shared device. This is the foundational control because it enables centralized administration without infringing on the user's personal apps and data.

Why this answer

Mobile Device Management (MDM) with a work profile or container creates a separate, encrypted partition on the device for corporate data. This container enforces policies (e.g., app whitelisting, VPN) and isolates business apps from personal apps, ensuring that company data remains protected even if the personal side is compromised.

Exam trap

The trap here is that candidates may confuse 'selective wipe' with a full device wipe, or assume that user promises (Option C) or convenience features (Option E) are acceptable security controls, when only containerization and managed wipe satisfy the separation and selective wipe requirements.

Full explanation →

958

Multi-Selecteasy

A records manager is told that some HR emails may be needed for an active investigation, while unrelated messages are still due for deletion under the retention schedule. Which two actions should the manager take? Select two.

Select 2 answers

A.Place the affected emails on legal hold

B.Delete all related records immediately to reduce storage costs

C.Keep the records until the legal team releases the hold

D.Move them into a personal archive folder

E.Rewrite the retention schedule without approval

AnswersA, C

A legal hold is a formal preservation notice issued when litigation or an investigation is reasonably anticipated. It immediately suspends normal retention and deletion schedules for the affected emails, including any automated purge processes, to prevent spoliation and ensure that all relevant evidence remains intact and searchable for the legal matter. This is the required first step before any other records action is taken.

Why this answer

A is correct because placing the affected emails on legal hold suspends the retention schedule for those specific records, ensuring they are preserved for the active investigation without altering the deletion policy for unrelated messages. This is a standard practice under eDiscovery and legal hold procedures, often implemented via Exchange Online or similar systems using litigation hold or in-place hold.

Exam trap

The trap here is that candidates may confuse 'legal hold' with simply archiving or delaying deletion, but only a formal hold ensures compliance with legal preservation requirements and prevents spoliation.

Full explanation →

959

MCQmedium

Following a ransomware incident, management wants proof that the organization can actually recover from its backups before declaring the backups trustworthy. What should the security team do next?

A.Check that the backup job completed successfully during the last seven days.

B.Restore a backup into an isolated test environment and validate the result.

C.Increase the backup retention period to reduce the chance of future loss.

D.Compress the backup files further so they take up less storage.

AnswerB

Restoring a backup into an isolated test environment provides direct, empirical proof that the backup data can be successfully recovered and that the restored systems are functional. This validates backup integrity, the restore process, and whether the data meets recovery point and recovery time objectives, all without risking production systems. It is the only way to demonstrate with confidence that the organization can actually recover from the ransomware attack.

Why this answer

The only way to prove that backups are trustworthy after a ransomware incident is to perform a full restoration into an isolated test environment and validate the integrity, completeness, and functionality of the recovered data. Simply checking that backup jobs completed successfully (Option A) does not verify that the backup data is uncorrupted, free from ransomware, or restorable in a real scenario. A controlled restore test provides tangible evidence that the recovery process works and the data is usable, which is the core requirement of management’s request for proof of recoverability.

Exam trap

The trap here is that candidates often confuse backup completion success with backup recoverability, assuming that a successful backup job log is sufficient proof, when in reality only a full restore test in an isolated environment can validate that the data is usable and free from corruption or ransomware payloads.

How to eliminate wrong answers

Option A is wrong because verifying that a backup job completed successfully only confirms that the backup process ran without errors; it does not validate that the backup data is intact, free from encryption by ransomware, or restorable to a usable state. Option C is wrong because increasing the backup retention period only retains more historical copies of data, but does not test or prove that any of those backups can actually be recovered successfully. Option D is wrong because compressing backup files further reduces storage usage but does not test the recoverability of the data; in fact, excessive compression could introduce corruption or increase restore time without providing any validation of backup trustworthiness.

Full explanation →

960

MCQmedium

Based on the exhibit, what should the organization do before approving this SaaS vendor to process employee HR records?

A.Approve the vendor now because admin MFA is enabled and the deadline is urgent.

B.Request a formal risk acceptance memo and sign the contract without additional review.

C.Require a security addendum and evidence review before onboarding, including notification timelines, deletion terms, subprocessors, and independent testing.

D.Move the HR data into the vendor environment first and complete the review after production cutover.

AnswerC

This is the best answer because the exhibit reveals several third-party risk gaps that matter for employee PII: no current independent assurance, vague breach notification, weak retention language, and no maintained subprocessor list. A contract addendum and evidence review provide enforceable expectations and reduce legal, privacy, and operational risk before data is shared.

Why this answer

Before processing sensitive employee HR records, the organization must ensure the SaaS vendor meets security and compliance requirements. This includes reviewing contractual terms like notification timelines, data deletion policies, subprocessor usage, and independent testing evidence (e.g., SOC 2 Type II or ISO 27001 certification). Without these, the organization cannot verify the vendor's security posture or contractual obligations, which is critical for protecting PII and meeting regulatory requirements like GDPR or HIPAA.

Exam trap

The trap here is that candidates may assume MFA or a risk acceptance memo alone is sufficient for compliance, but the SY0-701 exam emphasizes that contractual and evidence-based reviews are mandatory before onboarding vendors handling sensitive data.

How to eliminate wrong answers

Option A is wrong because admin MFA alone is insufficient; it does not address data protection, incident notification, deletion terms, or independent testing, and urgency does not justify bypassing due diligence. Option B is wrong because a risk acceptance memo without additional review ignores the need to verify security controls and contractual protections, effectively accepting unknown risks. Option D is wrong because moving HR data into the vendor environment before completing the review exposes sensitive data to unverified risks, violating the principle of 'trust but verify' and potentially leading to compliance violations.

Full explanation →

961

MCQhard

Users on a branch VLAN intermittently reach a fake login page even though DNS records have not changed. A packet capture shows the default gateway MAC address changing every 60 seconds, and the switch logs list repeated unsolicited ARP replies from one workstation. Which attack is most likely?

A.DNS poisoning, because name resolution is directing users to the wrong server.

B.ARP poisoning, because forged ARP replies are associating the gateway IP with the attacker's MAC address.

C.Replay attack, because previously captured traffic is being resent to the network.

D.Denial of service, because the branch users cannot reliably reach websites.

AnswerB

ARP poisoning is the best fit because the attacker is sending unsolicited ARP replies to rewrite the local IP-to-MAC mapping. The changing gateway MAC address and repeated ARP activity are classic signs of a man-in-the-middle setup on a switched LAN. Once traffic is redirected through the attacker, fake login pages and credential interception become possible.

Why this answer

The repeated unsolicited ARP replies from one workstation, combined with the default gateway MAC address changing every 60 seconds, directly indicate an ARP poisoning attack. The attacker is sending forged ARP replies to associate the gateway IP with its own MAC address, causing traffic destined for the gateway to be intercepted. This allows the attacker to redirect users to a fake login page without altering DNS records.

Exam trap

The trap here is that candidates see 'fake login page' and 'DNS records have not changed' and jump to DNS poisoning, but the key indicator is the MAC address changing every 60 seconds, which is a classic sign of ARP poisoning, not DNS manipulation.

How to eliminate wrong answers

Option A is wrong because DNS poisoning involves altering DNS records or cache entries to redirect name resolution, but the scenario explicitly states DNS records have not changed and the packet capture shows MAC address changes, not IP resolution changes. Option C is wrong because a replay attack resends captured legitimate traffic to impersonate a user or disrupt a session, but here the attacker is actively sending unsolicited ARP replies to redirect traffic, not replaying old packets. Option D is wrong because a denial of service attack would prevent users from reaching websites entirely, but the users intermittently reach a fake login page, indicating traffic is being redirected, not blocked.

Full explanation →

962

MCQmedium

A development team is moving a regulated application to a cloud platform. The security architect wants the strongest practical separation from other customers without buying and operating physical servers. Which hosting option is most appropriate?

A.A shared multi-tenant environment with no additional security configuration.

B.A dedicated host or isolated compute offering from the cloud provider.

C.Any public object storage service because the data will be encrypted by default.

D.A remote desktop service on the cheapest shared instance available.

AnswerB

A dedicated or isolated compute option provides stronger separation from other tenants while avoiding the need to manage physical hardware directly. It is a common architecture choice for regulated workloads that need enhanced tenant isolation, clearer placement controls, and a stronger compliance story than a standard shared environment.

Why this answer

A dedicated host or isolated compute offering (option B) provides the strongest practical separation because it ensures the application runs on a physical server dedicated solely to that customer, preventing any resource sharing or potential side-channel attacks from other tenants. This meets the regulatory requirement for strong isolation without the cost and operational overhead of purchasing and managing physical servers on-premises.

Exam trap

The trap here is that candidates often confuse 'dedicated host' with 'dedicated instance' or assume a shared multi-tenant environment can be secured solely with encryption, overlooking the need for physical isolation in regulated workloads.

How to eliminate wrong answers

Option A is wrong because a shared multi-tenant environment with no additional security configuration offers weak isolation, as other customers' virtual machines may run on the same hypervisor, increasing the risk of data exposure or side-channel attacks. Option C is wrong because public object storage services are not a compute hosting option; they are for storing data, not running applications, and encryption by default does not address the need for compute-level separation. Option D is wrong because a remote desktop service on the cheapest shared instance provides no dedicated hardware or strong isolation, and the instance is still shared with other tenants, failing to meet the required separation.

Full explanation →

963

MCQmedium

Several users on the same subnet report intermittent loss of access to the default gateway. A packet capture shows repeated unsolicited ARP replies mapping the gateway IP address to a different MAC address. Traffic is occasionally sent through an unknown workstation. What attack is most likely occurring?

A.ARP poisoning

B.DNS cache poisoning

C.Replay attack

D.Amplification attack

AnswerA

ARP poisoning is a Layer 2 attack that exploits the lack of authentication in the Address Resolution Protocol. An attacker on the same subnet sends forged ARP replies, associating the default gateway IP address with the attacker's MAC address. Victims update their ARP cache incorrectly, so all outbound traffic intended for the gateway is sent to the attacker's device. This causes intermittent connectivity as the attacker may drop, delay, or forward frames selectively, and the unusual ARP traffic would be visible in packet captures.

Why this answer

The attack is ARP poisoning (also known as ARP spoofing). The attacker sends unsolicited ARP replies to associate the gateway's IP address with the attacker's MAC address, causing traffic destined for the gateway to be redirected through the attacker's workstation. This results in intermittent connectivity as the attacker can forward or drop packets, and the repeated unsolicited replies overwrite the legitimate ARP cache entries on the victim hosts.

Exam trap

The trap here is confusing ARP poisoning with DNS cache poisoning because both involve 'poisoning' a cache, but ARP operates at Layer 2 (MAC addresses) while DNS operates at Layer 7 (domain names), and the symptoms of intermittent gateway access and unsolicited ARP replies are unique to ARP attacks.

How to eliminate wrong answers

Option B (DNS cache poisoning) is wrong because that attack corrupts DNS resolver caches to redirect domain names to malicious IP addresses, not to manipulate Layer 2 MAC-to-IP mappings via ARP. Option C (Replay attack) is wrong because a replay attack involves capturing and retransmitting valid data packets to impersonate a user or gain unauthorized access, not sending unsolicited ARP replies to redirect traffic. Option D (Amplification attack) is wrong because amplification attacks (e.g., DNS amplification, NTP amplification) exploit stateless protocols to flood a target with large responses from many servers, not to poison ARP caches on a local subnet.

Full explanation →

964

MCQmedium

Based on the exhibit, which integration best lets the SaaS application trust the company's existing identity provider so users can sign in with their corporate credentials?

A.Establish SAML federation so the SaaS app trusts the corporate identity provider.

B.Enable password synchronization so the SaaS app stores the same password as the directory.

C.Create a shared local administrator account for all subsidiary users.

D.Configure MAC address filtering on company laptops to allow portal access.

AnswerA

SAML 2.0 federation establishes the SaaS application as a service provider that trusts the corporate identity provider (IdP). When a user attempts to access the SaaS app, the app redirects them to the IdP, which authenticates them against the corporate directory and issues a digitally signed XML assertion. The SaaS app verifies the signature and grants session access, so users never need a separate SaaS password and account provisioning can be centrally managed.

Why this answer

SAML (Security Assertion Markup Language) federation allows the SaaS application to trust the corporate identity provider (IdP) by exchanging signed XML assertions. This enables users to authenticate against their corporate credentials without the SaaS app ever storing or managing those credentials, providing single sign-on (SSO) across domains.

Exam trap

The trap here is that candidates confuse password synchronization (a legacy or on-premises approach) with federation (SAML), thinking that syncing passwords achieves the same 'trust' without realizing it requires the SaaS app to handle credentials directly, which is less secure and not true federation.

How to eliminate wrong answers

Option B is wrong because password synchronization replicates the password hash to the SaaS app, which still requires the app to store and manage credentials, violating the principle of federated trust and increasing the attack surface. Option C is wrong because creating a shared local administrator account violates the principle of least privilege and non-repudiation, as it cannot tie actions to individual users and poses a massive security risk. Option D is wrong because MAC address filtering is a network access control mechanism that restricts which devices can connect to the network; it does not provide identity-based authentication or trust between the SaaS app and the corporate IdP.

Full explanation →

965

MCQeasy

A SIEM alert shows 120 failed logins for one user account from three different countries within 10 minutes, followed by a successful login. What should the analyst do first?

A.Close the alert because the login eventually succeeded.

B.Verify the activity with related logs and check whether the account owner confirms the login.

C.Immediately delete the account to stop further access.

D.Reimage the user's laptop before collecting any information.

AnswerB

The correct first step in alert triage is to validate the alert by correlating related logs—such as authentication servers, VPN gateways, and endpoint activity—to determine the source IPs, geolocation, time patterns, and whether the failures were followed by a success from the same or different origin. Simultaneously, contacting the account owner confirms whether they initiated the logins, which distinguishes a legitimate user's forgotten password from a malicious brute-force attempt. This verification process ensures the alert is not a false positive and provides necessary context for deciding on further containment, eradication, or recovery actions.

Why this answer

The analyst must first validate the alert by correlating the SIEM data with additional logs (e.g., authentication logs, firewall logs) and contacting the account owner to confirm whether the successful login was legitimate. This follows the incident response process of verification before action, preventing unnecessary disruption if the activity is benign (e.g., the user traveling with VPN).

Exam trap

The trap here is that candidates assume a successful login after failures means the attack succeeded and jump to containment (Option C or D), but the SY0-701 emphasizes that verification with the user and additional logs is the mandatory first step in the incident response process.

How to eliminate wrong answers

Option A is wrong because a successful login after multiple failed attempts is a classic sign of a brute-force or credential-stuffing attack; closing the alert ignores the potential compromise. Option C is wrong because immediately deleting the account destroys evidence and may lock out a legitimate user without investigation, violating the principle of least disruption. Option D is wrong because reimaging the laptop is a drastic containment step that should only occur after confirming compromise and preserving forensic evidence; it also assumes the attack vector is local, which may not be the case (e.g., remote credential abuse).

Full explanation →

966

MCQmedium

Based on the exhibit, which action best addresses both the unsanctioned software problem and the need for consistent endpoint configuration? Exhibit: Device group: Sales-Laptops Baseline check: - Approved browser: installed - Approved EDR: installed - Unapproved remote admin tool: detected on 14 endpoints - Local administrator rights: granted to all users in group - Patch compliance: 68% Management wants to prevent unauthorized software from running and keep future builds consistent.

A.Deploy application allowlisting through centralized endpoint management and remove local administrator rights.

B.Keep users as local admins but require stronger email passwords for better overall security.

C.Disable the EDR agent during software installs to avoid false alerts from approved apps.

D.Store approved installers on a shared drive and let users choose what to install.

AnswerA

Application allowlisting is the best fit because it prevents unapproved tools from executing even if they are present on a device. Removing local administrator rights also reduces the chance that users can install or alter software outside the baseline. Combined, these controls support consistent endpoint hardening and make it much harder for risky utilities to appear across the fleet.

Why this answer

Application allowlisting (via AppLocker or Windows Defender Application Control) centrally enforces which software can run, directly addressing the unsanctioned remote admin tool. Removing local administrator rights prevents users from bypassing the allowlist or making unauthorized configuration changes, ensuring consistent endpoint builds and improving patch compliance by limiting user-driven modifications.

Exam trap

The trap here is that candidates may think removing admin rights alone is sufficient, but without application allowlisting, users can still run unapproved software from writable directories like AppData or Temp, so both controls are needed together.

How to eliminate wrong answers

Option B is wrong because keeping users as local admins perpetuates the root cause of unsanctioned software installation and inconsistent configurations, and stronger email passwords do not prevent unauthorized software execution. Option C is wrong because disabling the EDR agent during installs would allow malicious software to run undetected, violating the requirement to prevent unauthorized software and undermining endpoint security. Option D is wrong because storing installers on a shared drive and letting users choose what to install does not enforce any control over software execution, failing to prevent unsanctioned software and leading to inconsistent configurations.

Full explanation →

967

MCQeasy

A help desk technician receives a ticket asking for a password reset on a manager's account. The requester says the manager is traveling and cannot be reached. What is the best action before making any change?

A.Reset the password immediately to avoid delaying the manager's work.

B.Verify the request through an approved identity-check process before taking action.

C.Tell the requester to ask a coworker to share the manager's existing password.

D.Ignore the ticket until the manager returns from travel.

AnswerB

The best action is to verify the requester and the request using the organization's approved process before changing access. This helps prevent social engineering and unauthorized account changes. Account resets are sensitive because they can give an attacker control if the help desk relies only on a convincing story or urgent pressure.

Why this answer

The principle of least privilege and proper identity verification are critical before performing any privileged action like a password reset. Without verifying the requester's identity through an approved process (e.g., out-of-band verification, knowledge-based authentication, or manager callback), the technician risks unauthorized access, which could lead to a security breach. This aligns with the CompTIA SY0-701 objective on implementing identity and access management controls.

Exam trap

The trap here is that candidates may assume urgency (Option A) is acceptable, but CompTIA emphasizes that security controls must never be bypassed for convenience, and password sharing (Option C) is always a violation of security best practices.

How to eliminate wrong answers

Option A is wrong because resetting the password immediately without verification violates security policy and could enable an impersonation attack or social engineering, potentially compromising the manager's account. Option C is wrong because sharing an existing password violates the principle of non-repudiation and password confidentiality, and it is never an acceptable practice in any secure environment.

Full explanation →

968

MCQhard

A tester enters a crafted search term into an internal web application and sees no error message, but the page response always delays by exactly five seconds when the input includes a single quote followed by a conditional sleep function. The returned results look normal, so the tester repeats the request several times and the timing remains consistent. Which attack is most likely being attempted?

A.Reflected cross-site scripting, because the tester's input is being echoed back into the response.

B.Command injection, because the application is pausing while executing system-level sleep commands.

C.Time-based blind SQL injection, because the attacker is inferring database behavior from delayed responses.

D.Session fixation, because the tester is manipulating how the application handles user input over time.

AnswerC

The timing pattern is the critical clue. When an application does not reveal errors or data directly, an attacker can still infer whether injected SQL changes control flow by measuring response delays. A single quote plus a conditional sleep is a classic sign of time-based blind SQL injection. The normal-looking results and consistent pauses show the query is being influenced even without visible error output.

Why this answer

The consistent five-second delay triggered by a single quote followed by a conditional sleep function (e.g., ' OR SLEEP(5)) indicates a time-based blind SQL injection. The tester is inferring database behavior from response timing because the application does not display error messages or output differences, but the database executes a sleep command when the injected SQL is syntactically valid. This technique exploits the database's ability to conditionally pause execution, allowing an attacker to extract data bit by bit based on true/false conditions.

Exam trap

The trap here is that candidates confuse a time-based delay with command injection (Option B) because both involve a pause, but the key differentiator is the single quote syntax and the database-specific sleep function, not an OS-level command.

How to eliminate wrong answers

Option A is wrong because reflected cross-site scripting requires the tester's input to be echoed back in the HTML/JavaScript context, not a server-side delay; the absence of error messages and the consistent timing point to database-level behavior, not client-side script execution. Option B is wrong because command injection would involve system-level commands (e.g., 'ping -n 5 127.0.0.1') and typically shows a delay from the OS, not a database-specific sleep function triggered by a single quote; the application is a web application, not a command shell. Option D is wrong because session fixation involves an attacker forcing a known session ID on a victim to hijack their session later, not manipulating input to cause server-side delays; the tester's repeated requests and timing analysis are unrelated to session management.

Full explanation →

969

MCQeasy

A security scan finds a critical patch missing on a public-facing web server. The patch has already been tested in the lab and approved for deployment. What should the operations team do next?

A.Ignore the finding because the server is already protected by a firewall

B.Deploy the patch through the normal change process as soon as possible

C.Mark the vulnerability as accepted risk without notifying the business

D.Remove the web server from the asset inventory to prevent the scanner from finding it

AnswerB

This is correct because it balances urgency with stability: the patch should already have been tested and validated through the organization's change advisory board, so deploying it through the standard change process minimizes operational risk while eliminating the known vulnerability. Rapid deployment reduces the time-to-exploit, especially since public servers are continuously probed by automated scanners. Deferring the patch leaves a confirmed, vendor-flagged critical vulnerability exposed.

Why this answer

The patch has already been tested and approved, meaning it is ready for deployment. The operations team should follow the normal change management process to deploy the patch as soon as possible, ensuring the public-facing web server is secured against the critical vulnerability without bypassing organizational controls.

Exam trap

The trap here is that candidates assume a firewall or risk acceptance can substitute for patching a known vulnerability, but the exam emphasizes that compensating controls (like firewalls) do not eliminate the need for patch management, and risk acceptance requires formal business notification and approval.

How to eliminate wrong answers

Option A is wrong because a firewall does not patch application-layer vulnerabilities; it only filters traffic at the network and transport layers, leaving the web server's software flaw exploitable if an attacker reaches the service. Option C is wrong because marking a critical vulnerability as an accepted risk without notifying the business bypasses the formal risk acceptance process, which requires documented approval from management and a clear understanding of the business impact.

Full explanation →

970

Drag & Dropmedium

Drag and drop the steps to configure a VPN tunnel using IPsec in tunnel mode into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

IPsec VPN setup involves two phases: IKE for key exchange, then IPsec for data encryption; the crypto map ties it to an interface.

Full explanation →

971

MCQeasy

Based on the exhibit, which finding should the security team remediate first?

A.LAP09 because user devices are always the easiest to patch

B.WEB01 because it is internet-facing and has a critical exploitable vulnerability

C.PRN01 because firmware issues can affect many users

D.FILE02 because internal servers are always more important than public ones

AnswerB

WEB01 should be remediated first because it is public-facing, rated critical, and already has a known exploit. Exposure and exploitability greatly increase risk, so this finding has the highest immediate urgency. When patching resources are limited, internet-facing critical vulnerabilities are typically prioritized before internal or low-severity issues.

Why this answer

WEB01 is internet-facing and has a critical exploitable vulnerability, meaning an attacker can directly compromise it from the public internet with minimal effort. This represents the highest risk because it combines high likelihood (exploit available) with high impact (full compromise of a public-facing server). Remediating this first aligns with the principle of prioritizing externally exposed systems with known critical flaws over internal or less severe issues.

Exam trap

The trap here is that candidates prioritize based on ease of remediation (A) or internal importance (D) instead of applying a risk-based approach that considers both the severity of the vulnerability and the exposure of the asset.

How to eliminate wrong answers

Option A is wrong because LAP09 being 'easiest to patch' does not equate to highest risk; patching ease is irrelevant when a critical internet-facing vulnerability exists. Option C is wrong because PRN01's firmware issue, while potentially affecting many users, is internal and typically lower severity than a critical remote code execution on a public server. Option D is wrong because internal servers are not inherently more important than public ones; the criticality and exposure of the vulnerability determine priority, not a blanket rule about server location.

Full explanation →

972

MCQmedium

Employees sign in once to the corporate portal and then open email, the ticketing system, and an HR application without entering credentials again. The external SaaS providers should trust the company's identity provider rather than creating separate user databases. What architecture is being used?

A.Local authentication on each application with synchronized passwords

B.Federation with single sign-on using the corporate identity provider

C.Network access control using 802.1X authentication

D.Role-based access control on the file server

AnswerB

Federation allows one organization to trust authentication performed by another identity provider. When combined with single sign-on, the user signs in once and then accesses multiple applications without repeated logins. This is exactly what the scenario describes, especially across separate SaaS services.

Why this answer

This scenario describes federation with single sign-on (SSO), where the corporate identity provider (IdP) authenticates the user once and issues a security token (e.g., SAML assertion or OIDC token) that external SaaS providers trust. This eliminates the need for separate user databases in each application and allows seamless access across multiple services without re-entering credentials.

Exam trap

The trap here is that candidates confuse 'single sign-on' with 'synchronized passwords' (Option A) or think that any centralized authentication mechanism (like 802.1X) can replace federated identity for external SaaS trust.

How to eliminate wrong answers

Option A is wrong because local authentication with synchronized passwords still requires each application to maintain its own user database and credential verification, which does not achieve the 'trust the company's identity provider' requirement and introduces password synchronization complexity. Option C is wrong because 802.1X network access control is a port-based authentication mechanism for network access (e.g., wired or Wi-Fi), not for web application SSO or federated identity across SaaS providers. Option D is wrong because role-based access control (RBAC) on the file server governs authorization (what a user can do) after authentication, not the authentication architecture or federated trust between an IdP and external applications.

Full explanation →

973

Multi-Selecteasy

A user forwards an email that says a shared document is available and must be reviewed within 10 minutes. The display name looks like a trusted vendor, but the Reply-To address points to a free webmail account. Which two details are strongest indicators that this is a phishing attempt? Select two.

Select 2 answers

A.The message creates a short deadline and pressures the user to act quickly.

B.The Reply-To address uses a free webmail domain instead of the vendor's corporate domain.

C.The message includes the company's logo and professional-looking formatting.

D.The email refers to a shared document that the user should review.

E.The message was received during normal business hours.

AnswersA, B

Urgency is a classic phishing tactic because it pushes recipients to react before verifying the request. A short deadline increases the chance that the user clicks a link or shares credentials without checking the sender or context.

Why this answer

Phishing attacks frequently use urgency and time pressure to bypass the victim's rational analysis, exploiting the psychological principle of scarcity to trigger impulsive clicks. The 10-minute deadline is a classic social engineering tactic to prevent the user from verifying the email's legitimacy through normal channels.

Exam trap

CompTIA often tests the distinction between easily spoofed visual elements (logos, formatting) and verifiable technical indicators (Reply-To domain mismatch, urgency cues) to catch candidates who rely on superficial appearance rather than email authentication mechanisms.

Full explanation →

974

MCQeasy

A security manager wants to require that all company laptops use at least a 14-character password and lock after 10 minutes of inactivity. Which document should define these mandatory settings?

A.Policy, because it is the broad statement of security intent only.

B.Standard, because it defines specific required technical values the company must follow.

C.Guideline, because it gives optional recommendations for device security.

D.Memo, because it is the normal formal document for security baselines.

AnswerB

A standard is the right document when the organization wants specific, mandatory technical requirements. Password length and screen-lock timeout are measurable settings, so they belong in a standard rather than a general policy. Standards make implementation consistent across systems and help administrators configure devices to the same baseline.

Why this answer

A standard is the document type that defines mandatory, specific technical requirements, such as a minimum 14-character password length and a 10-minute inactivity lock. Policies are high-level statements of intent, while standards provide the enforceable, measurable parameters that implement that intent. In this scenario, the security manager needs a binding baseline, which is precisely the role of a standard.

Exam trap

The trap here is confusing a policy (broad intent) with a standard (specific, mandatory technical values), leading candidates to choose Option A because they think all security rules are policies, when in fact standards define the enforceable numbers.

How to eliminate wrong answers

Option A is wrong because a policy is a broad statement of security intent and does not include specific technical values like password length or lockout timers; it would reference a standard for those details. Option C is wrong because a guideline offers optional recommendations, not mandatory settings, so it cannot enforce a required 14-character password or 10-minute lock. Option D is wrong because a memo is an informal communication tool, not a formal document type for defining security baselines; it lacks the authority and structure of a standard.

Full explanation →

975

MCQmedium

After a workstation reboot, users see many files renamed with random extensions. A ransom note demands cryptocurrency, and Volume Shadow Copies were deleted from the machine. What malware type is most likely?

A.Trojan, because the malware may have been disguised as a legitimate application.

B.Worm, because the malware likely spread automatically to other systems.

C.Ransomware, because the files were encrypted and payment was demanded.

D.Rootkit, because the attacker would want to hide persistence on the system.

AnswerC

Ransomware commonly encrypts files, deletes recovery options, and leaves a ransom note demanding payment. The random extensions and removed shadow copies are classic clues that the attacker wants to block restoration until payment is made.

Why this answer

The scenario describes files renamed with random extensions (indicating encryption), a ransom note demanding cryptocurrency, and deletion of Volume Shadow Copies (VSS) to prevent file recovery. These are hallmark behaviors of ransomware, specifically a crypto-ransomware variant that encrypts user data and removes backup copies to maximize extortion pressure.

Exam trap

The trap here is that candidates see 'files renamed' and 'ransom note' but may confuse the delivery method (Trojan) or propagation (Worm) with the actual malware type, which is defined by its payload—encryption for extortion—not how it arrived or spread.

How to eliminate wrong answers

Option A is wrong because a Trojan is a type of malware that disguises itself as legitimate software, but the core behavior here is file encryption and ransom demand, not just deception. Option B is wrong because a Worm self-replicates and spreads automatically across networks without user interaction, but the question focuses on the post-reboot encryption and ransom note, not propagation. Option D is wrong because a Rootkit is designed to hide its presence and maintain stealthy persistence, but the visible symptoms are encrypted files and a ransom demand, not hidden processes or stealth.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 901–975