Security+ SY0-701 SY0-701 Questions 901–975 | Page 13/14

901

Multi-Selecthard

A security analyst is investigating a recent security incident where an attacker gained unauthorized access to a server. The analyst suspects the attacker used a known vulnerability in an outdated web application. Which of the following are the MOST appropriate steps to mitigate this vulnerability in the future? (Choose two.)

Select 2 answers

A.Deploy a web application firewall (WAF) in blocking mode.

B.Implement a patch management process to regularly update the web application.

C.Implement network segmentation to isolate the web server.

D.Enable full disk encryption on the server.

E.Perform a vulnerability scan and remediate findings on a regular schedule.

AnswersB, E

Regular patching ensures that known vulnerabilities are remediated promptly. In this scenario, the outdated web application likely had a publicly known exploit that could have been fixed by applying vendor patches. A formal patch management process includes inventory, testing, and deployment, reducing the window of exposure and preventing similar incidents.

Why this answer

The most effective ways to mitigate a known vulnerability in an outdated web application are to patch it regularly and to proactively identify vulnerabilities through scanning and remediation. These steps directly address the root cause by eliminating the vulnerable code. Other options like WAF, segmentation, or encryption are compensating controls or defense-in-depth measures, but they do not fix the underlying flaw.

Exam trap

The trap here is selecting compensating controls like WAF or segmentation as primary mitigations, when the question asks for steps to mitigate the vulnerability itself.

Full explanation →

902

MCQmedium

A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?

A.SQL injection, because the attacker likely altered a database query.

B.Cross-site scripting, because the attacker could have injected script into the portal.

C.Insecure deserialization, because a crafted object triggered unexpected server-side actions.

D.CSRF, because the attacker may have forced an administrator to submit a form.

AnswerC

Insecure deserialization occurs when an application accepts untrusted serialized data and rebuilds it unsafely. That can allow an attacker to trigger code paths, remote lookups, or even command execution, which matches the LDAP activity and account creation.

Why this answer

The scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.

Exam trap

The trap here is that candidates may confuse insecure deserialization with other injection attacks (SQLi or XSS) because all involve untrusted input, but only deserialization directly allows server-side object reconstruction and arbitrary method invocation without proper validation.

How to eliminate wrong answers

Option A is wrong because SQL injection involves manipulating database queries through input fields, not through serialized objects; the described behavior (LDAP calls and account creation) is not typical of SQL injection, which primarily targets data extraction or modification. Option B is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, not server-side object deserialization; XSS cannot directly cause the server to make outbound LDAP calls or create local accounts.

Full explanation →

903

MCQmedium

A security manager at a financial services company is evaluating the effectiveness of a newly deployed security awareness training program. The program included modules on recognizing phishing emails, password security, and tailgating. One month after the training, the manager wants to assess whether employees are applying the learned behaviors to reduce the risk of phishing attacks. Which of the following metrics would provide the most valid indication of the training's behavioral impact?

A.The percentage of employees who completed the training modules.

B.The average score on the post-training knowledge quiz.

C.The number of reported phishing incidents to the security team.

D.The reduction in the employee click-through rate on simulated phishing campaigns.

AnswerD

Simulated phishing campaigns provide a controlled, realistic threat environment that measures employees' actual clicking behavior rather than their theoretical knowledge. Comparing pre-training baseline click-through rates to post-training rates isolates the training's behavioral impact, directly showing whether employees now recognize and avoid phishing lures. This metric is the gold standard for security awareness effectiveness because it captures the exact risky behavior the training aims to reduce.

Why this answer

The reduction in the employee click-through rate on simulated phishing campaigns directly measures a change in behavior—specifically, whether employees are applying the training to avoid clicking malicious links. Unlike knowledge scores or completion rates, this metric captures real-world application of the learned behavior in a controlled, measurable environment.

Exam trap

The trap here is that candidates confuse knowledge assessment (quiz scores) or participation metrics (completion rates) with behavioral metrics, but the exam specifically tests the distinction between measuring 'knowing' versus 'doing' in security awareness programs.

Why the other options are wrong

Completion percentage measures participation, not behavioral change. The manager wants to assess whether employees are applying learned behaviors to reduce phishing risk, not just that they took the training.

The average score on the post-training knowledge quiz measures theoretical understanding, not actual behavioral change. The question specifically asks for evidence that employees are applying learned behaviors to reduce phishing risk, which requires a behavioral metric like click-through rate reduction.

The number of reported phishing incidents does not directly measure behavioral change; it may increase due to better reporting rather than reduced susceptibility. The question asks for the impact on reducing phishing risk, which is best measured by click-through rates on simulated phishing campaigns.

When would these options actually be correct?

A question asking for a metric to ensure training delivery compliance, such as 'Which metric best indicates that all employees have received the required security awareness training?'

This option would be correct if the question asked: 'Which metric best indicates that employees understood the training content?' or 'Which metric should be used to evaluate the immediate knowledge retention from the training program?'

This metric would be correct if the question asked: 'Which metric best indicates employees are actively reporting suspicious emails after security awareness training?' In that context, an increase in reported incidents demonstrates application of reporting behavior.

Why candidates pick the wrong answer

Candidates may confuse training completion with training effectiveness, assuming that if everyone completed the training, it must have been effective.

Candidates may assume that a high quiz score directly translates to real-world behavior, overlooking the gap between knowledge and action. They might also think that post-training assessment is the standard way to measure training effectiveness.

Candidates may think that more reported incidents indicate greater security awareness, overlooking that reporting is a separate behavior from avoiding phishing clicks, and that increased reporting can occur even if click rates remain high.

Full explanation →

904

Matchingeasy

Match each control type to the best description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Stops a threat before it succeeds.

Identifies an event after or while it is happening.

Fixes a problem after it has occurred.

Discourages an attacker from trying.

Provides an alternate safeguard when the preferred control is not possible.

Why these pairings

Control types are categorized by nature: administrative involves rules, technical involves technology, physical involves tangible barriers, logical involves software-based access, operational involves processes, and legal/regulatory involves compliance.

Full explanation →

905

MCQhard

Based on the exhibit, which change best improves recovery resilience against a repeat ransomware incident?

A.Keep the current design and add more NAS storage capacity.

B.Move the NAS to the same subnet as the file server for faster backups.

C.Use an immutable or offline backup copy that production credentials cannot modify.

D.Shorten the backup retention period to reduce storage use.

AnswerC

The incident showed that the attacker could encrypt both production and the backup share because the backup target stayed online and writable. An immutable or offline copy breaks that dependency and prevents the same credentials from destroying recovery data. In ransomware recovery, backup survivability matters more than convenience, so this change gives the strongest resilience improvement.

Why this answer

Ransomware often encrypts or deletes accessible backups. An immutable or offline backup copy (e.g., using S3 Object Lock, Write Once Read Many (WORM) storage, or air-gapped tape) ensures that even if production credentials are compromised, the backup data cannot be modified or deleted by the attacker. This directly preserves a clean recovery point after a ransomware incident.

Exam trap

The trap here is that candidates often assume faster backups (Option B) or more capacity (Option A) improve resilience, but they overlook the fundamental requirement that backups must be protected from modification by the attacker, which only immutability or an air gap provides.

How to eliminate wrong answers

Option A is wrong because adding more NAS storage capacity does not protect existing backups from being encrypted or deleted by ransomware; it only increases the volume of data at risk. Option B is wrong because moving the NAS to the same subnet as the file server exposes the backup storage to the same network-based attacks and lateral movement, making it easier for ransomware to reach and corrupt the backups. Option D is wrong because shortening the backup retention period reduces the number of available recovery points, increasing the risk of data loss and potentially eliminating the last clean backup before the ransomware attack.

Full explanation →

906

MCQmedium

Based on the exhibit, which attack is most likely being attempted against the application?

A.Cross-site scripting, because the attacker is trying to inject script into the victim's browser session.

B.Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.

C.Cross-site request forgery, because the attacker is forcing an authenticated user to submit an unwanted request.

D.SQL injection, because the attacker is manipulating a query parameter to expose backend data.

AnswerB

The application accepts a URL parameter and then makes outbound requests to internal resources, including the cloud metadata endpoint. That is the hallmark of SSRF. The attacker is causing the server to reach addresses that should not normally be accessible through a public request path.

Why this answer

The exhibit shows an attacker manipulating a URL parameter (e.g., `?url=http://169.254.169.254/latest/meta-data/`) to make the application fetch an internal resource. This is a classic Server-Side Request Forgery (SSRF) attack, where the application is tricked into making requests to internal services (like cloud metadata endpoints) on the attacker's behalf, bypassing network segmentation.

Exam trap

CompTIA often tests SSRF by showing a URL parameter like `?url=` or `?file=` pointing to an internal IP (e.g., 127.0.0.1 or 169.254.169.254), and candidates confuse it with CSRF because both involve 'forged requests,' but SSRF is server-side while CSRF is client-side.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into a victim's browser, not manipulating server-side requests to internal resources. Option C is wrong because cross-site request forgery (CSRF) forces an authenticated user to submit an unwanted request (e.g., via a forged HTTP POST), but the exhibit shows the attacker directly controlling the request URL, not relying on a victim's session. Option D is wrong because SQL injection targets database queries via input fields (e.g., `' OR 1=1--`), not URL parameters that trigger server-side HTTP requests to internal IPs.

Full explanation →

907

Multi-Selectmedium

EDR flags encoded PowerShell launched by a spreadsheet application and an outbound HTTPS connection to a rare domain. Which two response actions are best to take from the EDR console first? Select two.

Select 2 answers

A.Isolate the endpoint from the network through the EDR platform

B.Collect a triage package or memory snapshot before remediation, if supported

C.Uninstall the spreadsheet application immediately

D.Reboot the endpoint to clear the suspicious script

E.Wait for a second alert before taking any action

AnswersA, B

Endpoint isolation via the EDR agent should be the immediate response because it severs active command-and-control channels and prevents lateral movement to adjacent hosts, while the management plane remains available for authorized forensic actions. Unlike unplugging the network cable, EDR-based isolation allows the responder to push collection tools or pull telemetry, preserving the host's state for memory analysis. This containment step aligns with incident response priorities: stop the spread before eradication, and retain visibility into the attacker's activity.

Why this answer

Isolating the endpoint from the network (A) is correct because it immediately stops the outbound HTTPS connection to the rare domain, preventing potential command-and-control (C2) data exfiltration or further payload download. Collecting a triage package or memory snapshot (B) is correct because the encoded PowerShell script and suspicious process chain are volatile artifacts that may be lost on reboot or remediation, and capturing them preserves forensic evidence for analysis.

Exam trap

CompTIA often tests the misconception that rebooting or uninstalling the application is a valid first response, when in fact both destroy volatile evidence and fail to contain the active threat.

Full explanation →

908

Multi-Selectmedium

A company wants to detect unauthorized changes to production server configurations before users notice an outage. Which two controls best fit this goal? Select two.

Select 2 answers

A.File integrity monitoring on critical system files

B.Centralized alerting on configuration-change events from the SIEM

C.Full-disk encryption on the server volumes

D.Multifactor authentication for remote administrators

E.Network segmentation between user VLANs and server VLANs

AnswersA, B

File integrity monitoring (FIM) on critical system files is a detective control that establishes a cryptographic baseline (e.g., SHA-256 hashes) for protected files and configuration artifacts. On a periodic or real-time basis, FIM agents recalculate hashes and compare them against that baseline, flagging any deviation that could indicate unauthorized tampering. For example, changes to /etc/shadow, Windows registry keys, or web server configuration files immediately generate an alert, satisfying the requirement to detect unauthorized changes even though it does so after the fact.

Why this answer

File integrity monitoring (FIM) on critical system files is correct because it detects unauthorized changes by comparing current file hashes against a known-good baseline. When a change occurs, FIM generates an alert, enabling the security team to investigate before users notice an outage. This directly addresses the goal of detecting configuration tampering proactively.

Exam trap

The trap here is that candidates often confuse preventive controls (like encryption or MFA) with detective controls (like FIM and SIEM alerting), leading them to select options that prevent access but do not detect changes after they happen.

Full explanation →

909

Multi-Selecteasy

A company wants employees to sign in once with corporate credentials and access multiple SaaS apps without creating separate passwords for each service. Which two features best support this goal? Select two.

Select 2 answers

A.Federation trust between the corporate identity provider and the SaaS provider.

B.Single sign-on so users authenticate once and reuse that session across apps.

C.Shared generic accounts for each department.

D.Storing the same password inside every SaaS application.

E.Disabling MFA so the sign-in process is faster.

AnswersA, B

Federation trust is a technical relationship established between the corporate identity provider (IdP) and the SaaS provider's service (SP), often via standards like SAML 2.0 or OIDC. The SP relies on security assertions/tokens issued by the IdP, eliminating the need for separate accounts or passwords in the SaaS application. This enables centralized identity governance, immediate revocation when an employee leaves, and a single compliant authentication policy across all connected services.

Why this answer

Federation trust, typically implemented via standards like SAML 2.0 or OpenID Connect, establishes a trust relationship between the corporate identity provider (IdP) and each SaaS provider. This allows the SaaS app to accept authentication assertions from the corporate IdP, enabling users to sign in with their corporate credentials without needing separate passwords for each service.

Exam trap

The trap here is that candidates may confuse SSO (Option B) with federation (Option A) as being redundant, but they are complementary—federation establishes the trust relationship, while SSO provides the seamless session reuse—so both are required to meet the goal of signing in once with corporate credentials across multiple SaaS apps.

Full explanation →

910

MCQeasy

A login form sends user input directly into a database query. When a tester enters a single quote character, the application returns a database error. What attack is most likely?

A.Cross-site scripting

B.SQL injection

C.Session hijacking

D.Insecure deserialization

AnswerB

This is SQL injection because the application appears to concatenate unsanitized input into a database query. A single quote often breaks query syntax and reveals that user input is being interpreted as part of the SQL command. That is a common sign the application is vulnerable to injection attacks.

Why this answer

The application directly concatenates user input into a database query without sanitization. Entering a single quote breaks the SQL syntax, causing a database error, which is a classic indicator of SQL injection (SQLi). This vulnerability allows an attacker to manipulate the query structure and potentially extract or modify database contents.

Exam trap

The trap here is that candidates may confuse the immediate error response with cross-site scripting (XSS), but the database error clearly indicates the injection is targeting the SQL layer, not the browser's DOM.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, not directly into database queries, and a single quote would not typically trigger a database error in an XSS context. Option C is wrong because session hijacking targets an authenticated user's session token (e.g., via theft or fixation) and does not involve injecting characters into a login form to cause a database error. Option D is wrong because insecure deserialization exploits the processing of serialized objects (e.g., PHP or Java serialization) to execute arbitrary code or manipulate application logic, not by sending a single quote into a database query.

Full explanation →

911

MCQmedium

A monthly scan finds a critical remote-code-execution issue on an internet-facing VPN appliance. The vendor has released a fix, but the appliance can only be rebooted during the weekend maintenance window in five days. What is the BEST immediate action to lower risk until patching can occur?

A.Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features

B.Wait for the weekend because the exploit is not confirmed

C.Remove logging from the appliance to improve performance during the wait

D.Run another scan every hour and do nothing else

AnswerA

Restricting access to trusted source IPs and disabling nonessential remote access features reduces the appliance's exploitable attack surface without a reboot. This compensating control satisfies the stem's five-day constraint, lowering risk until the vendor fix can be applied during the weekend maintenance window.

Why this answer

Applying a compensating control—such as restricting access to trusted source IPs via an ACL and disabling nonessential remote access features like unused VPN protocols or administrative interfaces—immediately reduces the attack surface. This mitigates the risk of exploitation of the remote-code-execution vulnerability on the internet-facing VPN appliance until the vendor patch can be applied during the scheduled maintenance window. The key is to implement network-layer controls that block untrusted sources from reaching the vulnerable service, buying time without requiring a reboot.

Exam trap

The trap here is that candidates may think waiting for the maintenance window is acceptable because the vulnerability is unconfirmed, but the exam expects proactive risk reduction through compensating controls rather than passive delay.

How to eliminate wrong answers

Option B is wrong because waiting for the weekend assumes the exploit is not confirmed, but a critical remote-code-execution vulnerability on an internet-facing appliance is inherently high-risk; the scan finding indicates a real issue, and delaying action without compensating controls leaves the organization exposed to active exploitation. Option C is wrong because removing logging from the appliance does not lower risk; it actually reduces visibility into potential attacks and may violate compliance requirements, while doing nothing to prevent exploitation of the vulnerability. Option D is wrong because running another scan every hour and doing nothing else provides no risk reduction; scanning repeatedly does not block or mitigate the vulnerability, and it wastes resources without addressing the immediate threat.

Full explanation →

912

Matchinghard

Match each design requirement to the best security architecture control. Use each control once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

DMZ

Bastion host

Microsegmentation

Zero Trust Network Access (ZTNA)

Load balancer

Why these pairings

Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Full explanation →

913

MCQmedium

An HR system marks employees as hired, transferred, or terminated. The security team wants those changes to create, update, or disable accounts in multiple SaaS apps automatically after the user authenticates through the company identity provider. Which capability should be added?

A.SAML federation alone, with no additional account lifecycle automation.

B.Password synchronization between every application.

C.SCIM provisioning integrated with the SSO platform.

D.Local administrator groups on each SaaS application.

AnswerC

SCIM provisioning integrated with the SSO platform provides a standard REST-based API for automatically creating, updating, and disabling user accounts when HR marks employees as hired, transferred, or terminated. The HR system becomes the authoritative source, and the SSO platform propagates those lifecycle events to all connected applications in near real time. This enables centralized, auditable, and consistent identity lifecycle management across SaaS apps.

Why this answer

SCIM (System for Cross-domain Identity Management) is the correct choice because it provides a standardized protocol for automating the creation, update, and deletion of user accounts across multiple SaaS applications. When integrated with an SSO platform (like SAML), SCIM handles the lifecycle events (hire, transfer, terminate) by sending RESTful API calls to each SaaS app, ensuring accounts are created, updated, or disabled without manual intervention. SAML alone only handles authentication, not account provisioning, making SCIM essential for the described automation.

Exam trap

The trap here is that candidates often confuse SAML federation (which only handles authentication) with full identity lifecycle management, leading them to pick option A, but the question explicitly requires automated account creation, update, and disablement—a capability only SCIM provides.

How to eliminate wrong answers

Option A is wrong because SAML federation alone only handles authentication (single sign-on) and does not include any account lifecycle management—it cannot create, update, or disable accounts automatically. Option B is wrong because password synchronization between applications is a legacy approach that does not automate account provisioning or deprovisioning; it only keeps passwords consistent and introduces security risks without addressing the core requirement of lifecycle automation. Option D is wrong because local administrator groups on each SaaS application are a manual, per-application access control mechanism that does not provide any automated account lifecycle management or integration with the identity provider.

Full explanation →

914

MCQmedium

A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?

A.Rely only on the cloud provider's service health dashboard and billing alerts.

B.Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.

C.Encrypt the virtual machine disks and disable all logging to reduce exposure.

D.Install only a web application firewall because that covers server log collection.

AnswerB

This combines host-level visibility with cloud network telemetry. Audit logs capture logons and system activity inside the virtual machine, while flow logs show network connections. Forwarding both to a SIEM gives analysts the context needed to correlate suspicious behavior across layers.

Why this answer

It directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.

Exam trap

The trap here is that candidates may think cloud provider dashboards or encryption are sufficient for security monitoring, but they fail to recognize that the specific data types required (OS events and network flows) must be explicitly enabled and forwarded from the guest OS and network layer, not inferred from provider-level metrics.

How to eliminate wrong answers

Option A is wrong because relying solely on the cloud provider's service health dashboard and billing alerts provides only infrastructure-level availability and cost data, not the required OS login events, process activity, or network flow metadata. Option C is wrong because encrypting disks and disabling all logging would eliminate the very data needed for investigations, directly contradicting the goal of making that data available in the SIEM.

Full explanation →

915

Multi-Selecthard

An accounts payable clerk receives an email that appears to come from a long-time vendor. The message asks for an urgent change to bank routing information, says the CFO is traveling, and requests that no one call back because the matter is confidential. The display name looks legitimate, but the reply-to address is different from the sender identity. Which three findings most strongly indicate a pretexting or business email compromise attempt? Select three.

Select 3 answers

A.The message requests a payment change outside the normal approval workflow.

B.The reply-to address does not match the claimed sender identity.

C.The recipient is told to keep the request confidential and avoid calling back.

D.The email contains a professional logo and a consistent signature block.

E.The email uses correct spelling and grammar throughout.

AnswersA, B, C

Unauthorized changes to payment instructions are a classic business email compromise tactic. This bypasses established controls and tries to exploit urgency. It is one of the strongest indicators because legitimate vendors normally accept verification through established channels, not a one-off email request.

Why this answer

The request for a payment change outside the normal approval workflow is a classic indicator of business email compromise (BEC). Attackers exploit the absence of standard verification steps, such as dual authorization or manager sign-off, to redirect funds fraudulently. This bypass of established procedures directly aligns with the social engineering technique of pretexting, where the attacker fabricates a scenario (urgent, confidential, CFO traveling) to pressure the victim into violating policy.

Exam trap

CompTIA often tests the misconception that surface-level professionalism (logos, grammar) indicates legitimacy, when in fact these are easily replicated and the true red flags are procedural violations and header mismatches.

Full explanation →

916

MCQeasy

Field staff use company-owned tablets that also run approved personal apps. Security wants corporate email and documents separated from personal data, with the ability to wipe only the work data if a device is lost. What is the best control?

A.Use a work profile or container managed by a mobile device management platform.

B.Disable all personal apps by removing internet access from the tablet.

C.Install only a screen lock and require a longer PIN for the tablet.

D.Use a USB cable lock so the tablet cannot be physically moved.

AnswerA

A managed work profile or container is the best answer because it separates corporate data from personal applications on the same mobile device. That allows the organization to enforce policies on work data, protect corporate email and documents, and selectively remove only the business container if the tablet is lost or the user leaves. It supports a practical BYOD or COPE style deployment without wiping the user's personal content.

Why this answer

A work profile or container managed by a mobile device management (MDM) platform creates a separate, encrypted partition on the device for corporate data. This allows the organization to enforce policies and perform a selective wipe of only the work container without affecting personal apps or data, meeting the requirement for separation and targeted remote wipe.

Exam trap

The trap here is that candidates may think a screen lock or disabling internet is sufficient for data separation, but the exam specifically tests the concept of containerization and selective wipe as the only method that meets both separation and targeted data removal requirements.

How to eliminate wrong answers

Option B is wrong because disabling internet access on the tablet would block all network connectivity, preventing both personal and corporate apps from functioning, and does not provide any data separation or selective wipe capability. Option C is wrong because a screen lock and longer PIN only protect the device from unauthorized access at rest; they do not separate corporate data from personal data, nor do they enable a selective wipe of work data only.

Full explanation →

917

MCQmedium

An organization is redesigning access for a finance application. Employees should be able to approve expense reports only within their assigned job roles, and every approval must be traceable to the individual user who performed it. Which access model best fits this requirement?

A.Mandatory access control, because a central authority labels each expense report by sensitivity.

B.Role-based access control, because permissions are assigned by job function and tied to named users.

C.Discretionary access control, because individual employees decide who can approve expenses.

D.Rule-based access control, because approval rights are determined only by the time of day.

AnswerB

RBAC matches a finance workflow where users inherit permissions based on job roles such as approver, reviewer, or auditor. It is easy to administer, supports least privilege, and works well when access should be consistent for groups with similar duties. The requirement to trace approvals to individuals is also satisfied when each person uses a unique account and actions are logged.

Why this answer

Role-based access control (RBAC) is the correct choice because it assigns permissions based on job functions (e.g., 'Finance Approver') and links those permissions to named user accounts. This ensures that only employees in the appropriate role can approve expense reports, and each approval action is logged against the specific user, providing non-repudiation and traceability.

Exam trap

The trap here is that candidates often confuse 'rule-based access control' (which uses condition-based rules like time-of-day) with 'role-based access control' (which uses job functions), leading them to select option D despite the question's clear focus on job roles and user traceability.

How to eliminate wrong answers

Option A is wrong because mandatory access control (MAC) uses system-enforced labels (e.g., classification levels) to control access, not job roles, and it does not inherently tie approvals to named users for traceability. Option C is wrong because discretionary access control (DAC) allows individual data owners to set permissions, which would violate the requirement that approvals be restricted to assigned job roles and would not guarantee centralized traceability. Option D is wrong because rule-based access control (RBAC is often confused with rule-based, but here the option describes time-of-day rules only, which is a specific attribute-based condition, not a model that assigns permissions by job function or ensures user-level traceability.

Full explanation →

918

MCQmedium

Based on the exhibit, what type of attack is most likely being used against the accounts payable team?

A.Phishing, because the message asks recipients to open a file and respond quickly.

B.Spear phishing, because the email is tailored to a specific team, project, and recipient.

C.Pretexting, because the sender claims to have spoken with the recipient before.

D.Baiting, because the attacker offers a useful file related to the project.

AnswerB

This is spear phishing because the attacker uses personalized details such as the recipient's name, the internal project name, and a plausible business deadline. Those details are meant to increase trust and pressure the victim into taking action. The goal is to trick a specific target or group, not to send an indiscriminate message to everyone.

Why this answer

B is correct because spear phishing is a targeted attack where the email is customized for a specific individual or group, using personal details like the recipient's name, team, and project to increase credibility. The exhibit shows the email addresses the recipient by name, references the 'Acme Corp Q3 audit' project, and is sent to the accounts payable team, which matches the tailored nature of spear phishing. This makes it more convincing than generic phishing, as the attacker has researched the target to craft a relevant lure.

Exam trap

The trap here is that candidates confuse spear phishing with generic phishing because both involve email, but the key differentiator is the level of personalization—spear phishing uses specific details like the recipient's name and project, while phishing uses generic greetings like 'Dear Customer'.

How to eliminate wrong answers

Option A is wrong because phishing is a broad, untargeted attack sent to many recipients, while the email in the exhibit is specifically addressed to a named individual on the accounts payable team and references a specific project, indicating it is tailored. Option C is wrong because pretexting involves creating a fabricated scenario (e.g., impersonating a colleague or authority figure) to gain trust, but the email does not establish a false identity or backstory beyond claiming a prior conversation, which is a common spear phishing tactic, not a full pretext. Option D is wrong because baiting typically offers a physical item (e.g., a USB drive) or a digital download (e.g., a free file) to lure victims, but the email asks the recipient to open an attached file related to the project, which is a delivery mechanism for malware, not the core attack type—spear phishing better describes the targeted social engineering.

Full explanation →

919

MCQmedium

A vulnerability scan finds that an old print server still has SMBv1 enabled. The business says the vendor will not support a patch for at least two months, but the server must stay online. What is the best temporary mitigation?

A.Move the server to a restricted network segment and allow SMB access only from required hosts.

B.Turn off endpoint logging to reduce performance impact until the vendor releases a patch.

C.Increase the password length requirement for all users and keep the server on the same network.

D.Schedule a weekly reboot to clear any malicious sessions and reduce the chance of exploitation.

AnswerA

Isolating the server on a restricted network segment is a sound compensating control; it shrinks the attack surface to only those hosts that legitimately require SMB access, reducing the number of potential exploit sources while the vendor patch is pending. Because SMBv1 is remotely exploitable without authentication in many cases, limiting connectivity via firewall rules is more effective than relying on host-level hardening. This approach aligns with network segmentation principles and does not hide or destroy security-relevant data.

Why this answer

Network segmentation is the most effective temporary mitigation when a patch is unavailable. By moving the print server to a restricted VLAN or firewall zone and applying an access control list (ACL) that permits SMB traffic only from known, required hosts, you reduce the attack surface and prevent widespread exploitation of SMBv1 vulnerabilities (e.g., EternalBlue). This approach follows the principle of least privilege and containment, buying time until the vendor releases a patch.

Exam trap

The trap here is that candidates may choose a reactive measure like rebooting or a non-technical control like password changes, failing to recognize that containment via network segmentation is the only proactive defense that directly limits the exploit's reach without requiring a patch.

How to eliminate wrong answers

Option B is wrong because turning off endpoint logging reduces visibility into potential attacks, making it harder to detect exploitation of SMBv1; it does not address the vulnerability. Option C is wrong because increasing password length does not mitigate the SMBv1 protocol-level flaws (e.g., lack of pre-authentication integrity checks, susceptibility to relay attacks); it only strengthens authentication, which is irrelevant to the unpatched service. Option D is wrong because scheduling a weekly reboot does not prevent exploitation; attackers can re-establish malicious sessions quickly after reboot, and the vulnerability remains fully exploitable between reboots.

Full explanation →

920

MCQmedium

A Linux host is patched, but the scanner still flags the package as vulnerable. The vendor advisory says the distribution backported the fix, so the package version did not change. What should the analyst do before closing the ticket?

A.Verify the vendor advisory and package metadata, then document evidence of the fixed build.

B.Close the ticket immediately because the patch was installed successfully.

C.Raise the severity of the finding because the scanner still reports it.

D.Disable the scanner until the next maintenance window to avoid repeated alerts.

AnswerA

A version number alone can be misleading when a vendor backports a fix without changing the upstream version. The analyst should confirm the remediation using vendor notes, package release metadata, or other authoritative evidence. That ensures the finding is truly remediated before the ticket is closed and prevents a false assumption based only on a scanner result.

Why this answer

When a vendor backports a security fix to an older package version without incrementing the version number, the vulnerability scanner may still flag the package based on its version string. The analyst must verify the vendor advisory and package metadata (e.g., using `rpm -q --changelog` or `dpkg --status`) to confirm the fix is present, then document this evidence to close the ticket with proper justification.

Exam trap

The trap here is that candidates assume a patched system always has a newer package version, but CompTIA tests the understanding that backported fixes keep the same version string, requiring manual verification of the changelog or vendor advisory.

How to eliminate wrong answers

Option B is wrong because closing the ticket without verification ignores the scanner's alert and the need for evidence that the backported fix is actually installed. Option C is wrong because raising the severity is inappropriate; the package is not vulnerable, and the scanner's false positive does not warrant escalation. Option D is wrong because disabling the scanner avoids the issue rather than resolving it, and the scanner should be tuned or the finding documented as a false positive.

Full explanation →

921

Multi-Selectmedium

After restoring a virtual file server from backup, users can open shares, but the accounting application shows the previous day's transactions are missing. Which two steps should the administrator take next? Select two.

Select 2 answers

A.Verify whether the backup included application-consistent data and transaction logs

B.Restore the missing records from the latest pre-incident application backup or log backup

C.Leave the server as is because file shares are accessible

D.Delete the current backup set to avoid restoring the wrong version again

E.Reimage the server immediately without checking the restore point

AnswersA, B

This is the essential first step because a file-level or crash-consistent backup of a virtual machine may capture the disk state but does not guarantee that applications like SQL Server or Exchange have flushed all committed transactions to disk. Application-consistent backups use VSS or equivalent mechanisms to quiesce the application, ensuring the data files and transaction logs are in a recoverable, synchronized state. Inspecting the backup's metadata and logs reveals whether it supports point-in-time recovery or whether you must fall back to a different recovery source.

Why this answer

The accounting application's missing transactions indicate the backup may not have captured application-consistent data, such as open transaction logs or database writes. Without application consistency (e.g., using Volume Shadow Copy Service or a database-aware backup agent), the restore point may reflect a crash-consistent state where recent transactions were lost. Verifying the backup type ensures the administrator understands whether the data is recoverable from transaction logs or requires a separate application-level restore.

Exam trap

The trap here is that candidates assume file share accessibility equals full data recovery, overlooking the distinction between file-level and application-consistent backups, which is a core concept in CompTIA SY0-701 Domain 3.0 (Security Operations).

Full explanation →

922

MCQmedium

A company manages 300 laptops and wants to reduce risk from missed patches while avoiding a widespread outage if an update has compatibility issues. Which patching approach is the best choice?

A.Install patches manually on each laptop after users report problems.

B.Deploy all patches to every laptop immediately with no testing.

C.Use a phased rollout with a pilot group, then expand deployment after validation, while keeping a standard baseline configuration.

D.Wait for annual maintenance windows so all changes happen at once.

AnswerC

A phased or ring-based rollout balances speed and stability. A pilot group catches compatibility issues early, and the baseline keeps endpoint settings consistent across the fleet. This approach reduces risk from vulnerabilities without creating unnecessary operational disruption.

Why this answer

A phased rollout with a pilot group allows the IT team to validate patches on a small subset of laptops before full deployment, reducing the risk of widespread outages from compatibility issues. Maintaining a standard baseline configuration ensures consistency across all 300 laptops, which simplifies patch management and reduces the likelihood of missed patches. This approach balances risk mitigation with operational continuity, aligning with best practices for enterprise patch management.

Exam trap

The trap here is that candidates may choose Option B (immediate deployment) because they prioritize speed and simplicity over risk management, failing to recognize that unvalidated patches can cause cascading failures that negate any security benefits.

How to eliminate wrong answers

Option A is wrong because installing patches manually only after users report problems is a reactive approach that leaves laptops vulnerable to known exploits for extended periods, increasing the risk of security breaches. Option B is wrong because deploying all patches to every laptop immediately with no testing ignores the potential for compatibility issues that could cause widespread outages, application failures, or system instability across the entire fleet.

Full explanation →

923

MCQmedium

A file server is actively renaming documents and generating ransom notes. The server hosts a shared drive used by finance, and users are still online. What is the best immediate action?

A.Shut the server down immediately to stop all activity as fast as possible.

B.Isolate the server from the network to contain the spread while preserving evidence.

C.Restore the file server from backup before checking whether the infection is still active.

D.Run a full antivirus scan and wait for the results before taking any other action.

AnswerB

Network isolation is the best immediate containment step because it limits lateral movement and reduces the chance that ransomware spreads to other systems or continues encrypting shared data. It is also less destructive than a hard shutdown, which can interfere with evidence collection. In incident response, containment should stop the impact while preserving the ability to investigate what happened.

Why this answer

Isolating the server from the network stops the ransomware from encrypting more files or spreading laterally, while preserving volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. In a live incident, immediate disconnection (not shutdown) is the standard containment step per NIST SP 800-61 and SANS incident response guidelines, as it halts the attack without destroying data in memory or logs.

Exam trap

The trap here is that candidates confuse 'stopping the attack' with 'shutting down the system,' but CompTIA emphasizes that isolation (disconnecting the network cable or disabling the port) is the first step in containment to preserve evidence and avoid data loss.

How to eliminate wrong answers

Option A is wrong because shutting down the server destroys volatile evidence (e.g., active network connections, running ransomware processes in RAM) and may trigger the ransomware to delete or further encrypt files on shutdown, as many modern ransomware variants have persistence mechanisms that activate on system halt. Option C is wrong because restoring from backup before confirming the infection is neutralized risks re-infection if the backup itself is compromised or if the ransomware is still active on the network, and it bypasses the need for forensic preservation. Option D is wrong because running a full antivirus scan while the server is still online allows the ransomware to continue encrypting files and spreading to other systems, and signature-based scans often miss polymorphic or zero-day ransomware strains.

Full explanation →

924

MCQmedium

After imaging laptops, the security team wants to ensure screen-lock timeouts, local admin restrictions, and USB storage controls remain consistent on every device even after users make changes. What is the best approach?

A.Rely on users to follow the build sheet during setup and avoid future changes.

B.Enforce a hardened baseline with configuration management and compliance checks.

C.Increase antivirus scan frequency so policy settings do not change.

D.Apply full disk encryption only, since it covers all endpoint hardening needs.

AnswerB

Correct. A hardened baseline defines the approved secure settings, and configuration management helps enforce those settings consistently across all laptops. Compliance checks detect drift after deployment, which is important when users or software might change security-related options. This approach directly supports secure configuration and repeatability at scale.

Why this answer

Configuration management tools (e.g., Microsoft Intune, Group Policy, or Ansible) can enforce a hardened baseline by applying settings like screen-lock timeouts, local admin restrictions, and USB storage controls. These tools also perform compliance checks to detect and remediate any drift caused by user changes, ensuring consistency across all devices.

Exam trap

The trap here is that candidates may confuse security controls like antivirus or encryption with configuration management, thinking they can prevent or revert policy changes, when in fact only a dedicated configuration management and compliance solution can enforce and remediate baseline settings.

How to eliminate wrong answers

Option A is wrong because relying on users to follow a build sheet is not enforceable; users can intentionally or accidentally change settings, leading to configuration drift and security gaps. Option C is wrong because increasing antivirus scan frequency does not prevent or revert changes to screen-lock, admin, or USB policies; antivirus focuses on malware detection, not configuration enforcement. Option D is wrong because full disk encryption protects data at rest but does not enforce screen-lock timeouts, local admin restrictions, or USB storage controls; it addresses only one aspect of endpoint hardening.

Full explanation →

925

MCQmedium

A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?

A.Worm

B.Logic bomb

C.Rootkit

D.Spyware

AnswerB

A logic bomb is malicious code embedded within a legitimate application that remains inactive until a predefined condition is met, such as a specific date, an event, or an account status change. In this scenario, the finance application functioning normally for weeks and then suddenly deleting files aligns precisely with a time- or event-based trigger, making a logic bomb the most likely cause.

Why this answer

The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.

Exam trap

The trap here is that candidates confuse a logic bomb with a worm because both can execute code automatically, but they fail to recognize that a worm's defining characteristic is self-propagation across networks, not a delayed, condition-based trigger.

How to eliminate wrong answers

Option A is wrong because a worm is self-replicating malware that spreads automatically across networks without user intervention, whereas this scenario involves a hidden task that does not replicate or spread. Option C is wrong because a rootkit is designed to hide the presence of malware or unauthorized processes by modifying the operating system kernel or using hooking techniques, not to trigger a delayed destructive action based on a date. Option D is wrong because spyware is focused on covertly collecting and exfiltrating user data (e.g., keystrokes, browsing habits) without the user's knowledge, not on deleting files or self-removal after a time-based trigger.

Full explanation →

926

MCQmedium

A security analyst is examining a Windows workstation that has been exhibiting unusual outbound traffic to an IP address in a foreign country. The analyst runs `netstat -anob` and sees a process named `svchost.exe` listening on TCP port 4444 and maintaining an established connection to that foreign IP. The analyst knows that `svchost.exe` normally hosts legitimate Windows services. Which of the following is the MOST likely explanation for this finding?

A.The `svchost.exe` process is hosting the Windows Time service and synchronizing with an external NTP server.

B.The `svchost.exe` process has been trojanized and is being used as a backdoor listener.

C.A remote administration tool such as Remote Desktop is running on a non-standard port.

D.The workstation is participating in a legitimate peer-to-peer Windows Update delivery.

AnswerB

Legitimate svchost.exe listens on local RPC ports but never on an arbitrary high port with an external established connection. Malware often injects into or replaces svchost.exe to blend in, creating a backdoor listener on a port like 4444. The established session to a foreign IP confirms command-and-control or remote access activity, making this the best explanation.

Why this answer

A legitimate svchost.exe process hosts Windows services and does not listen on arbitrary high ports or maintain external established connections. The presence of a listener on TCP 4444 with an active session to a foreign IP indicates a backdoor, often achieved by injecting malicious code into svchost.exe or replacing it. This behavior is a classic sign of a remote access trojan or command-and-control channel.

Exam trap

The trap here is assuming that any svchost.exe process is benign because it is a legitimate Windows process, when malware frequently masquerades as or injects into svchost.exe.

Full explanation →

927

MCQmedium

Employees use several SaaS applications, and the security team wants one corporate login, MFA for unmanaged devices, and centralized account provisioning. Which architecture should be used?

A.Create separate usernames and passwords for each SaaS application.

B.Use federated single sign-on with the corporate identity provider and conditional access policies.

C.Share one generic account for the team so access is easier to audit.

D.Put all users on a VPN and let each SaaS application trust the internal network automatically.

AnswerB

Federated single sign-on with the corporate identity provider lets users authenticate once—typically with MFA—and receive a SAML or OIDC assertion that each SaaS application trusts. Conditional access policies evaluate real-time signals such as user risk, device compliance, or geolocation before issuing the token, enabling dynamic controls like blocking unmanaged devices or requiring step-up authentication. This approach centralizes identity lifecycle management and enforces uniform security policy across every connected application.

Why this answer

Federated single sign-on (SSO) with a corporate identity provider (IdP) allows users to authenticate once using their corporate credentials and access multiple SaaS applications without separate logins. Conditional access policies can enforce MFA specifically for unmanaged devices, and centralized account provisioning (e.g., via SCIM) ensures accounts are created, updated, and deprovisioned from a single directory. This architecture meets all three requirements: single corporate login, MFA for unmanaged devices, and centralized provisioning.

Exam trap

The trap here is that candidates confuse network-level controls (VPN) with identity-level controls (federation), assuming that a VPN provides the same authentication and authorization granularity as SSO with conditional access.

How to eliminate wrong answers

Option A is wrong because creating separate usernames and passwords for each SaaS application violates the requirement for a single corporate login, increases password fatigue, and makes centralized provisioning impossible. Option C is wrong because sharing one generic account eliminates individual accountability, violates the principle of least privilege, and makes auditing impossible since actions cannot be traced to a specific user. Option D is wrong because VPNs only provide network-level access and do not integrate with SaaS application authentication; SaaS apps cannot 'trust the internal network automatically' without federation, and VPNs do not enforce MFA or provide centralized account provisioning.

Full explanation →

928

MCQmedium

A security analyst at a financial firm detects an unusual spike in outbound network traffic from a database server that normally only communicates with internal web servers. The traffic is directed to numerous external IP addresses in various countries. According to established incident response procedures, what should be the analyst's immediate next step?

A.Disconnect the server from the network at the switch level.

B.Run a comprehensive antivirus scan on the server.

C.Notify the Chief Information Security Officer (CISO) of the incident.

D.Power off the server to prevent further damage.

AnswerA

Isolating the server at the switch port is the proper containment step because it severs the network path used for data exfiltration without disrupting the host's power or volatile memory. This preserves running processes, open network connections, and other live forensic evidence, aligning with the NIST incident response framework's containment phase. It immediately halts the unauthorized data transfer while allowing the analyst to gather evidence from the live system.

Why this answer

Disconnecting the server at the switch level (e.g., shutting down the switch port or placing it in a quarantine VLAN) is the immediate containment step per incident response procedures. This stops the outbound data exfiltration without risking data loss or corruption that could occur from a hard power-off, and it preserves volatile memory evidence for forensic analysis.

Exam trap

The trap here is that candidates confuse 'immediate containment' with 'immediate notification' or 'immediate remediation,' but the SY0-701 incident response framework prioritizes stopping the active threat (containment) over escalation or scanning.

Why the other options are wrong

Running a comprehensive antivirus scan is a time-consuming step that delays containment. In this scenario, the immediate priority is to stop the data exfiltration by disconnecting the server from the network, not to analyze the malware.

In this scenario, the immediate priority is containment to prevent data exfiltration. Notifying the CISO is a later step after containment and initial analysis, not the immediate next action.

Powering off the server would destroy volatile evidence (e.g., memory contents, active network connections) and may not stop data exfiltration if the attacker has persistence. The immediate priority is containment via network isolation, not power-off.

When would these options actually be correct?

This would be correct if the question described a suspected malware infection on a non-critical system with no signs of active data exfiltration, and the incident response procedure required initial triage with antivirus before any network isolation.

This would be correct as the immediate next step if the incident response procedure requires notification of the CISO before any containment actions, or if the analyst lacks authority to disconnect and must escalate first.

In a scenario where a server is experiencing a destructive malware infection (e.g., ransomware encrypting files) and there is no need for forensic preservation, powering off can prevent further damage. For example, if a server is rapidly deleting critical data and network isolation is insufficient, power-off may be warranted.

Why candidates pick the wrong answer

Candidates often default to scanning for malware as a first step, not realizing that containment (disconnection) takes precedence when there is clear evidence of ongoing data exfiltration.

Candidates may think that escalation is always the first step in incident response, but containment takes precedence when active data exfiltration is suspected.

Candidates may think that stopping the server entirely is the fastest way to halt malicious activity, overlooking the importance of preserving evidence and the fact that network isolation achieves containment without losing volatile data.

Full explanation →

929

MCQhard

During routine checks, configuration management finds several branch firewalls drifted from the approved baseline because a contractor changed settings locally. An automation job now compares each device nightly and automatically reapplies the approved configuration without waiting for a human ticket. Which control type is the automation?

A.Directive control

B.Detective control

C.Corrective control

D.Deterrent control

AnswerC

The automation runs after drift is detected and restores the approved baseline, which means it is correcting the affected system back to a known-good state. It does more than report the problem; it remediates the configuration. That is why the best answer is corrective control rather than detective or preventive control.

Why this answer

The automation job corrects a detected drift by automatically reapplying the approved configuration, which is a classic corrective control. Corrective controls are designed to remediate or reverse an unwanted change or security event after it has been detected. In this scenario, the nightly comparison is detective, but the automatic reapplication is the corrective action.

Exam trap

The trap here is that candidates see 'compares each device nightly' and mistakenly classify the entire process as detective, ignoring that the automatic reapplication is the corrective action that distinguishes the control type.

How to eliminate wrong answers

Option A is wrong because directive controls are policies, standards, or guidelines that define acceptable behavior (e.g., 'firewalls must use the approved baseline'), not automated remediation actions. Option B is wrong because detective controls identify or log a deviation (e.g., the nightly comparison itself), but the automation goes further by actively fixing the drift. Option D is wrong because deterrent controls discourage unwanted behavior through fear of consequences (e.g., warning banners or audit trails), not by automatically correcting configuration changes.

Full explanation →

930

MCQmedium

A branch office uses a NAS for nightly backups, but the NAS is joined to the same domain as the production servers. After ransomware encrypted both production data and backups, management wants the most effective change to reduce the chance of backup tampering without a major redesign. Which control should be implemented?

A.Increase the retention period so deleted files can be recovered for longer.

B.Move backups to a larger NAS with more available storage capacity.

C.Keep one backup copy offline or immutable and outside the production domain.

D.Run backups more frequently to the same NAS so newer files are captured sooner.

AnswerC

An offline or immutable copy is the strongest practical protection against ransomware that can reach the network backup target. Separating that copy from the production domain also reduces the chance that compromised admin credentials can alter it. This improves resilience without requiring a full redesign, and it gives the organization a trusted recovery source even if online backups are encrypted or deleted.

Why this answer

Keeping one backup copy offline or immutable and outside the production domain ensures that even if ransomware compromises the domain, it cannot encrypt or tamper with that isolated copy. This breaks the chain of trust between the production environment and the backup storage, directly addressing the root cause of the incident.

Exam trap

The trap here is that candidates often choose more frequent backups or larger storage, thinking that having more copies or more space provides protection, when the real vulnerability is the shared domain trust that allows ransomware to access and encrypt backups.

How to eliminate wrong answers

Option A is wrong because increasing the retention period only keeps deleted files longer, but does not prevent ransomware from encrypting or deleting the backups themselves on the same domain-joined NAS. Option B is wrong because moving to a larger NAS with more storage capacity does not change the fact that the NAS is still joined to the same domain, leaving backups vulnerable to the same ransomware attack. Option D is wrong because running backups more frequently to the same NAS only creates more copies that are all equally susceptible to encryption or deletion by ransomware that has domain access.

Full explanation →

931

MCQhard

Based on the exhibit, which principle should the organization enforce to reduce fraud risk while keeping the business process functional?

A.Least privilege, because each employee should only have the fewest permissions needed for the shared account.

B.Separation of duties, because no single user should be able to complete every high-risk finance step alone.

C.Need-to-know, because only employees with confidential financial data should see the workflow details.

D.Defense in depth, because the organization should add more security layers around the finance process.

AnswerB

Separation of duties is the best answer because the workflow shows one shared identity can create vendors, enter invoices, approve payments, and change bank details. That concentration enables fraud without a second set of eyes. Splitting those tasks across different roles prevents one person from controlling the entire transaction chain and creates accountability for each critical step.

Why this answer

Separation of duties (SoD) is the correct principle because it prevents any single employee from completing all steps in a high-risk financial transaction alone. By requiring at least two people to authorize and execute critical actions—such as initiating a payment and approving it—the organization reduces the risk of internal fraud without blocking the business workflow. This directly addresses the scenario where a single user could otherwise create, approve, and release a fraudulent payment.

Exam trap

The trap here is that candidates confuse least privilege (which limits permissions for a single user) with separation of duties (which splits a process across multiple users), even though the exhibit clearly shows a sequential workflow where a single user could perform all steps.

How to eliminate wrong answers

Option A is wrong because least privilege limits permissions for a shared account, but the core fraud risk here is not about excessive permissions on a shared account—it is about a single user being able to complete an entire high-risk process alone. Option C is wrong because need-to-know restricts access to confidential data based on job role, but the exhibit shows a workflow where the risk is sequential task completion, not data visibility. Option D is wrong because defense in depth adds multiple security layers (e.g., firewalls, IDS), but it does not specifically address the procedural control of splitting critical financial steps among different users.

Full explanation →

932

MCQhard

Based on the exhibit, what is the MOST likely explanation for the network traffic? The affected host is not showing a large amount of internet-bound traffic, but its DNS behavior is highly unusual.

A.DNS tunneling used for command-and-control or data transfer

B.ARP poisoning causing the host to redirect traffic to a rogue gateway

C.A browser cache synchronization feature repeatedly polling a cloud service

D.A misconfigured static route sending all web traffic to the wrong subnet

AnswerA

The repeated queries to long, randomly generated subdomains, combined with the prevalence of NXDOMAIN responses and the absence of ordinary browsing traffic, are classic indicators of DNS tunneling. In this technique, malware encapsulates command-and-control messages or exfiltrated data into the domain namespace, encoding payloads in subdomain labels and receiving instructions or data in DNS replies such as TXT records. The NXDOMAIN responses may represent either intentional 'no data' signals from the malicious authoritative server or failed resolution attempts that are still part of the tunnel's call-and-response pattern.

Why this answer

The exhibit shows a host with minimal internet-bound traffic but highly unusual DNS behavior, such as frequent queries to a single domain or large DNS query sizes. This pattern is characteristic of DNS tunneling, where data is encoded in DNS queries and responses to bypass network controls, often used for command-and-control (C2) communication or covert data exfiltration. The lack of other traffic indicates the host is not performing normal web browsing or data transfers, making DNS tunneling the most likely explanation.

Exam trap

The trap here is that candidates may overlook the significance of 'unusual DNS behavior' and minimal internet traffic, instead focusing on common attacks like ARP poisoning or benign browser features, which would produce different traffic patterns (e.g., high traffic or periodic HTTP requests).

How to eliminate wrong answers

Option B is wrong because ARP poisoning would cause the host to redirect traffic to a rogue gateway, resulting in a large amount of internet-bound traffic as the host communicates through the attacker's system, not minimal traffic with unusual DNS behavior. Option C is wrong because a browser cache synchronization feature repeatedly polling a cloud service would generate consistent, periodic HTTP/HTTPS traffic to a known cloud provider, not the highly unusual DNS queries (e.g., high query rates, large TXT records) seen in the exhibit, and would not explain the lack of other internet-bound traffic.

Full explanation →

933

MCQeasy

A department wants to keep using a cloud printing service even though the vendor has not yet completed the company's security questionnaire. The business owner agrees to add extra log monitoring until the review is finished. What is the best term for the added monitoring?

A.A compensating control, because it reduces risk while the normal control is unavailable.

B.Residual risk, because all risk is eliminated once monitoring is added.

C.Risk acceptance, because the business owner has approved continued use of the service.

D.Due diligence, because the company is actively reviewing the vendor.

AnswerA

A compensating control is an alternative safeguard used when the preferred control is missing, delayed, or not fully effective. Extra log monitoring helps reduce exposure while the vendor review is still in progress. It does not eliminate the underlying vendor risk, but it is a reasonable temporary measure to reduce likelihood of missing suspicious activity.

Why this answer

The added log monitoring is a compensating control because it provides an alternative security measure to mitigate risk while the primary control (the vendor's completed security questionnaire) is not yet in place. Compensating controls are temporary or alternative safeguards that reduce risk exposure when the preferred control cannot be implemented immediately. In this scenario, the monitoring does not eliminate the need for the questionnaire but reduces the risk of undetected malicious activity until the vendor's security posture is formally assessed.

Exam trap

The trap here is that candidates confuse risk acceptance (which involves no new controls) with risk mitigation (which involves implementing a compensating control), leading them to pick Option C despite the clear action of adding monitoring.

How to eliminate wrong answers

Option B is wrong because residual risk is the risk that remains after controls are applied, not the control itself; adding monitoring reduces but does not eliminate all risk, so the statement 'all risk is eliminated' is incorrect. Option C is wrong because risk acceptance is a management decision to acknowledge and tolerate a risk without implementing additional controls, but here the business owner is actively adding extra log monitoring, which is a risk mitigation action, not pure acceptance. Option D is wrong because due diligence refers to the ongoing investigation and review process (like completing the security questionnaire), not the specific technical control (log monitoring) implemented to reduce risk during that review.

Full explanation →

934

MCQeasy

A development team wants to skip testing and deploy a major application change directly to production to meet a release date. What should the security team require?

A.Disable logging temporarily so the release is less likely to fail.

B.Require change approval and testing in a nonproduction environment first.

C.Deploy only to one server and monitor from there before deciding.

D.Let developers decide without review because they understand the code best.

AnswerB

Change approval and testing in a separate environment are basic controls that reduce the chance of introducing defects or security issues into production. This approach supports safe deployment while still allowing the project to move forward in a controlled way.

Why this answer

Security policy requires that all changes to production systems undergo formal change management, including approval and testing in a nonproduction environment first. Skipping testing violates the principle of change control and could introduce vulnerabilities or misconfigurations that compromise confidentiality, integrity, or availability. The security team must enforce this process to ensure the change is reviewed for security impact and validated before deployment.

Exam trap

The trap here is that candidates may think a phased rollout (Option C) is an acceptable compromise, but the SY0-701 exam emphasizes that change approval and testing in a nonproduction environment are mandatory before any production deployment, regardless of scale.

How to eliminate wrong answers

Option A is wrong because disabling logging would remove the audit trail needed to detect and investigate security incidents, violating compliance requirements and best practices. Option C is wrong because deploying to a single server without prior testing still bypasses the required change approval and nonproduction validation, and monitoring alone cannot catch all security flaws or configuration errors. Option D is wrong because developers may not have full visibility into security implications, and bypassing review undermines segregation of duties and the change management process.

Full explanation →

935

MCQhard

A security team is drafting a service-level agreement (SLA) with a cloud provider that will host the company's customer relationship management (CRM) system. The legal department wants to ensure that the provider is contractually obligated to notify the company of any security breach involving customer data within a specific timeframe. Which element of the SLA should the security team recommend including?

A.Data ownership clause

B.Right-to-audit clause

C.Service level objective (SLO) for uptime

D.Breach notification clause

AnswerD

A breach notification clause specifies the provider's obligation to inform the customer of a security incident, including the timeframe and method of notification. This directly addresses the legal department's requirement to be alerted promptly about any breach involving customer data. It is a standard component of SLAs for cloud services that handle sensitive information, ensuring transparency and enabling the customer to take mitigating actions.

Why this answer

The breach notification clause is the correct element because it contractually requires the cloud provider to inform the customer of any security breach involving customer data within a specified timeframe. This enables the customer to respond appropriately and meet regulatory obligations. The other options—right-to-audit, data ownership, and uptime SLO—address different aspects of the SLA and do not satisfy the legal department's specific request for breach notification.

Exam trap

The trap here is selecting a right-to-audit clause because it sounds security-related, but it does not guarantee timely notification of a breach, which is the explicit requirement.

Full explanation →

936

MCQmedium

A help desk lead notices that several support technicians have broad administrator access across every department's systems so they can resolve tickets faster. After a phishing incident, management wants to reduce the damage if one technician account is compromised. What is the best security principle to apply when redesigning access?

A.Defense in depth

B.Least privilege

C.Need-to-know

D.Zero trust

AnswerB

Least privilege means each user receives only the access required to perform assigned duties. Reducing broad administrative rights lowers the impact of credential theft, malware, or accidental misuse. It is especially effective for support staff because their daily tasks usually need access to a limited set of systems rather than full administrative control across the environment.

Why this answer

The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. By applying least privilege, each technician would receive access only to the specific systems and resources required for their role, rather than broad administrator access across all departments. This containment directly limits the blast radius of a compromised account, preventing an attacker from moving laterally to other departmental systems.

Exam trap

CompTIA often tests the distinction between least privilege and need-to-know, where candidates mistakenly choose need-to-know because it sounds similar, but least privilege is the correct principle for limiting system-level access rights and permissions.

How to eliminate wrong answers

Option A is wrong because defense in depth is a layered security strategy that combines multiple controls (e.g., firewalls, antivirus, intrusion detection) to protect assets; it does not specifically address the reduction of individual user permissions. Option C is wrong because need-to-know is a principle for data classification and access based on the necessity of information for a specific task, but it is typically applied to information access rather than administrative system privileges; least privilege is the more precise principle for limiting system-level permissions.

Full explanation →

937

MCQeasy

A small internal reporting server has a low-severity vulnerability. Fixing it now would require several hours of downtime, while the business impact of exploitation is considered low. What is the BEST risk treatment for this situation?

A.Transfer the risk to a third party

B.Accept the risk after documenting the decision

C.Avoid the risk by shutting down the server permanently

D.Mitigate the risk by immediately replacing the server

AnswerB

When both likelihood and impact are low, and remediation would create more disruption than benefit, accepting the risk can be the most practical choice. The key is to document the rationale, obtain the appropriate approval, and revisit the decision later if the system or threat landscape changes.

Why this answer

The best risk treatment is to accept the risk because the vulnerability is low-severity, the business impact of exploitation is low, and the cost of remediation (several hours of downtime) exceeds the potential loss. Documenting the acceptance ensures auditability and informed management approval, which is a standard practice in risk management frameworks like NIST SP 800-37.

Exam trap

The trap here is that candidates may confuse 'accepting risk' with ignoring it, or they may overestimate the need to transfer or avoid risk, failing to recognize that documented acceptance is a valid and often optimal treatment for low-impact, high-remediation-cost scenarios.

How to eliminate wrong answers

Option A is wrong because transferring the risk to a third party (e.g., purchasing cyber insurance or outsourcing) is unnecessary and cost-ineffective for a low-severity, low-impact vulnerability; it would introduce additional expense and administrative overhead without proportional benefit. Option C is wrong because avoiding the risk by permanently shutting down the server is an extreme measure that would disrupt internal reporting functions entirely, causing greater business harm than the vulnerability itself, and is disproportionate to the low severity and low exploitation impact.

Full explanation →

938

MCQmedium

A security analyst is reviewing logs after a successful phishing attack. The attacker used a fake login page that mimicked the company's single sign-on portal to harvest usernames and passwords. The attacker then used the stolen credentials to access the corporate email system. Which type of attack best describes the initial compromise?

A.On-path attack

B.Credential harvesting via phishing

C.Brute-force attack

D.Password spraying

AnswerB

Correct. The attacker used a deceptive email or website to trick users into voluntarily entering their credentials. This is the defining characteristic of phishing-based credential harvesting. The stolen credentials were then reused to access the corporate email system.

Why this answer

The initial compromise was achieved by luring the victim to a fake login page that mimicked the company's single sign-on portal, which is a classic phishing technique. The attacker harvested the credentials directly from the user's submission, making this a credential harvesting attack via phishing. This aligns with the definition of phishing as a social engineering attack that uses deception to obtain sensitive information, distinct from brute-force or password spraying which rely on guessing or trying multiple passwords.

Exam trap

The trap here is that candidates may confuse credential harvesting via phishing with an on-path attack, because both involve intercepting credentials, but phishing relies on user deception to voluntarily submit credentials, whereas an on-path attack captures them transparently during an existing session.

Why the other options are wrong

The initial compromise was achieved through a fake login page that harvested credentials, which is credential harvesting via phishing, not an on-path attack. An on-path attack involves intercepting or modifying communications between two parties, not tricking users into entering credentials on a fake site.

The initial compromise was achieved through a fake login page that harvested credentials, not by systematically guessing passwords. Brute-force attacks involve automated guessing of many password combinations, which is not described here.

Password spraying involves trying a few common passwords against many accounts, not using a fake login page to harvest credentials from a single phishing attack.

When would these options actually be correct?

An on-path attack would be correct if the question described an attacker intercepting network traffic (e.g., ARP spoofing or man-in-the-middle) to capture credentials or modify data in transit, without using a fake login page.

A question describing an attacker repeatedly trying different passwords against a single account until successful, such as 'An attacker gains access to a user account by trying thousands of password combinations in a short period.'

A security analyst notices multiple failed login attempts using the same password (e.g., 'Spring2024!') across hundreds of user accounts within a short time frame. This indicates a password spraying attack.

Why candidates pick the wrong answer

Candidates may confuse on-path attacks with phishing because both involve credential theft, but on-path attacks focus on intercepting live traffic rather than deceiving users into entering credentials on a fake site.

Candidates may confuse credential harvesting with password guessing, or assume that any attack involving passwords is a brute-force attack, overlooking the phishing vector.

Candidates may confuse password spraying with credential harvesting because both involve obtaining passwords, but they overlook the distinct method of using a fake login page in phishing.

Full explanation →

939

MCQhard

Administrators must manage network switches from home. Requirements: encrypted management traffic, MFA for users, no management ports exposed to the Internet, and centralized logging of admin sessions. Which solution best meets the requirements?

A.Open SSH directly on each switch and allow access from the entire Internet.

B.Use a VPN with MFA that terminates on a hardened jump host, then reach switches over SSH or HTTPS.

C.Use port forwarding through the firewall to RDP on each switch.

D.Build an IPSec tunnel only between office routers and share a common admin password on the switches.

AnswerB

A VPN with MFA that terminates on a hardened jump host provides authenticated, encrypted remote access while ensuring switch management protocols are never exposed directly to the internet. The jump host acts as a controlled pivot point, so administrators reach switches only via SSH or HTTPS after passing both the VPN and MFA, and it centralizes logging and auditing of management sessions.

Why this answer

It satisfies all requirements: a VPN with MFA encrypts management traffic, the hardened jump host provides a secure intermediary that keeps switch management ports off the Internet, and centralized logging can be implemented on the jump host to record all admin sessions. This architecture aligns with the principle of defense-in-depth by combining encrypted tunnels, strong authentication, and network segmentation.

Exam trap

The trap here is that candidates may think a VPN alone is sufficient, forgetting that the jump host is necessary to avoid exposing switch management ports and to enable centralized logging and MFA enforcement.

How to eliminate wrong answers

Option A is wrong because opening SSH directly on each switch from the entire Internet exposes management ports to the public, violating the requirement that no management ports be exposed to the Internet, and it lacks MFA. Option C is wrong because port forwarding RDP to each switch exposes management ports (RDP uses port 3389) to the Internet, and RDP is not the native management protocol for network switches (switches typically use SSH or HTTPS), nor does it inherently provide MFA or centralized logging. Option D is wrong because an IPSec tunnel between office routers does not address MFA (it uses a shared common password, which is weak), and it does not provide centralized logging of admin sessions.

Full explanation →

940

MCQmedium

A scan finds two issues: a critical flaw on a lab server reachable only through VPN, and a high-severity flaw on an internet-facing file transfer appliance with active exploitation in the wild. Which should be remediated first?

A.The lab server, because critical severity is always higher than high severity.

B.The internet-facing file transfer appliance, because exploitability and exposure increase risk.

C.Both issues at the same time, because prioritization is unnecessary when two findings are present.

D.The lab server, because systems behind VPN are always more trusted than public systems.

AnswerB

The internet-facing appliance should be fixed first because it is exposed to untrusted users and already being exploited in the wild. Risk-based prioritization considers not only severity but also exposure, exploit availability, and business impact. A high-severity flaw with active exploitation on a public-facing system is usually more urgent than a critical flaw on a restricted lab server.

Why this answer

The internet-facing file transfer appliance with active exploitation in the wild presents a higher risk because it is directly exposed to untrusted networks and has a known exploit that attackers are actively using. Even though the lab server has a critical severity rating, its reachability only through VPN significantly reduces its attack surface and likelihood of exploitation. Risk is a function of both severity and exploitability/exposure, so the actively exploited, internet-facing asset should be remediated first.

Exam trap

The trap here is that candidates assume CVSS severity alone dictates remediation order, ignoring that exploitability and exposure (e.g., internet-facing vs. VPN-restricted) are critical factors in risk-based prioritization.

How to eliminate wrong answers

Option A is wrong because severity alone does not determine remediation priority; a critical flaw on a VPN-restricted lab server is less exploitable than a high-severity flaw on an internet-facing system with active exploitation. Option C is wrong because prioritization is essential when resources are limited; remediating both simultaneously is often impractical and ignores the higher immediate risk posed by the actively exploited internet-facing appliance.

Full explanation →

941

Multi-Selectmedium

Which four of the following are key components of a successful security awareness and training program within an organization? (Choose four.)

Select 4 answers

.Role-based training tailored to specific job functions

.Phishing simulations to reinforce practical skills

.Annual one-time training with no follow-up assessments

.Metrics to measure effectiveness, such as click rates on simulated phishing emails

.Executive-level sponsorship and support for the program

.Outsourcing all training content development to a single vendor without internal review

Why this answer

Role-based training is correct because it ensures that employees receive security education relevant to their specific job functions, such as data handling for finance or system access for IT, which increases the practical applicability and retention of security principles. Phishing simulations are correct as they provide hands-on reinforcement of skills, allowing employees to practice identifying and reporting malicious emails in a controlled environment, which directly reduces real-world risk. Metrics like click rates on simulated phishing emails are correct because they provide quantifiable data to measure program effectiveness, identify high-risk groups, and guide continuous improvement.

Executive-level sponsorship is correct because it provides the necessary authority, resources, and organizational commitment to prioritize security awareness, ensuring the program is taken seriously across all departments.

Exam trap

The SY0-701 exam often tests the misconception that a one-time annual training is sufficient for compliance, but the SY0-701 exam emphasizes that effective security awareness requires continuous, role-specific training with measurable outcomes and leadership support.

Full explanation →

942

MCQmedium

A security analyst is reviewing web server logs from an e-commerce application. The logs show repeated requests containing URLs with appended strings such as: `' OR '1'='1' --` and `'; DROP TABLE Users; --`. The application returned HTTP 200 responses with unexpected data in several instances. Which type of attack is most likely being attempted?

A.SQL injection

B.LDAP injection

C.Command injection

D.Cross-site scripting (XSS)

AnswerA

Correct. The log entries show SQL syntax such as `OR '1'='1'` and `DROP TABLE`, which are classic indicators of SQL injection attempts. This attack exploits improper input sanitization to manipulate database queries. These payloads are appended to SQL statements executed by the web application's backend database, allowing an attacker to bypass authentication or alter data.

Why this answer

The repeated requests contain classic SQL injection payloads, such as `' OR '1'='1' --` (used to bypass authentication or extract data) and `'; DROP TABLE Users; --` (used to delete database tables). The HTTP 200 responses with unexpected data confirm that the application is vulnerable to SQL injection, as the injected SQL code is being executed against the backend database. This attack targets the SQL database layer, not LDAP directories or operating system commands.

Exam trap

The trap here is that candidates may confuse SQL injection with command injection because both use special characters like `'` and `;`, but command injection requires OS command separators and system commands, whereas SQL injection uses database-specific syntax and keywords.

Why the other options are wrong

The logs show SQL syntax like `' OR '1'='1' --` and `DROP TABLE Users`, which are classic SQL injection payloads, not LDAP injection. LDAP injection uses LDAP query syntax, not SQL.

The logs show SQL syntax patterns like ' OR '1'='1' and DROP TABLE, which are classic SQL injection attempts. Command injection typically involves system commands (e.g., ; ls -la) and would not produce SQL-like strings.

The logs show SQL syntax (' OR '1'='1' --, DROP TABLE) and HTTP 200 responses with unexpected data, indicating database manipulation, not client-side script execution. XSS involves injecting scripts into web pages viewed by other users, not direct database queries.

When would these options actually be correct?

An LDAP injection question would involve an application that authenticates users against an LDAP directory, with logs showing payloads like `*)(uid=*))(|(uid=*` or `admin*` in login fields, causing unauthorized access or data exposure.

Command injection would be correct if the logs showed URL parameters with system commands, such as '; ls -la' or '| dir', and the application returned command output in the HTTP response, indicating the server executed the commands.

A security analyst finds that a web application reflects user input in HTTP responses without sanitization, and a proof-of-concept payload like <script>alert('XSS')</script> executes in a browser. The question would specify that the attack targets other users via stored or reflected scripts.

Why candidates pick the wrong answer

Candidates may confuse injection attacks, thinking any injection that manipulates a query is similar, or they may not distinguish between SQL and LDAP syntax.

Candidates may confuse injection types, thinking any injected string is a command, or they may not recognize the specific SQL syntax patterns, leading them to choose a broader injection category.

Candidates may confuse injection attacks or think that any malicious input in web requests is XSS, especially when the response contains unexpected data, without recognizing the SQL-specific syntax and database commands.

Full explanation →

943

MCQmedium

A web team is moving a customer portal behind a new inspection device. They need something that can examine HTTP requests, block malicious patterns like injection attempts, and still allow normal browsing. Which control is most appropriate?

A.IDS, because it alerts on suspicious traffic without affecting application delivery.

B.WAF, because it understands web requests and can block malicious application-layer traffic.

C.DLP, because it can stop sensitive data from being posted to the portal.

D.NAC, because it verifies whether devices are allowed onto the network.

AnswerB

A web application firewall is deployed inline in front of the portal and operates at Layer 7, where it decodes and inspects HTTP/HTTPS requests, including headers, cookies, parameters, and request bodies. By matching traffic against signature-based rules (such as the OWASP Core Rule Set) and behavior, it can distinguish normal requests from SQL injection, cross-site scripting, and other application-layer attacks, then actively block or sanitize them before they reach the backend. This real-time, application-aware blocking is exactly what the team needs for a customer-facing portal that accepts untrusted input.

Why this answer

A WAF (Web Application Firewall) is the correct choice because it operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic. It can parse web requests, identify malicious patterns such as SQL injection or XSS payloads, and block them while allowing legitimate traffic to pass through to the customer portal.

Exam trap

The trap here is that candidates often confuse an IDS with an IPS (Intrusion Prevention System) and assume an IDS can block traffic, but an IDS is passive and only generates alerts, whereas a WAF is an active, inline control that can both detect and block application-layer attacks.

How to eliminate wrong answers

Option A is wrong because an IDS (Intrusion Detection System) is a passive device that only alerts on suspicious traffic; it cannot block malicious requests inline, so it would not prevent injection attempts from reaching the portal. Option C is wrong because DLP (Data Loss Prevention) focuses on detecting and preventing unauthorized transmission of sensitive data, not on blocking web application attacks like injection attempts. Option D is wrong because NAC (Network Access Control) verifies device compliance and access rights at the network layer, but it does not inspect application-layer HTTP requests or block injection patterns.

Full explanation →

944

MCQmedium

A DevOps team builds container images in a CI/CD pipeline. Security wants to reduce the chance of deploying vulnerable libraries and also wants the cluster to reject images that have not been approved. Which approach best meets both requirements?

A.Increase CPU and memory limits for the containers so they run more safely.

B.Allow developers to pull images from any registry as long as the tags look familiar.

C.Disable pipeline scanning to speed releases and rely on runtime monitoring after deployment.

D.Scan images in the pipeline and enforce signature verification or admission control before deployment.

AnswerD

Build-time scanning helps identify vulnerable packages before release, while signature verification or admission control ensures only approved images can run in the cluster. Together, these controls reduce both content risk and deployment risk. This is the strongest combined answer because it addresses prevention and policy enforcement.

Why this answer

It combines two essential security controls: scanning container images for known vulnerabilities (e.g., using Trivy or Clair) during the CI/CD pipeline, and enforcing signature verification (e.g., using Notary or Cosign) or admission control (e.g., using OPA/Gatekeeper or Kyverno) to ensure only signed or approved images are deployed. This directly reduces the risk of deploying vulnerable libraries and prevents unapproved images from running in the cluster.

Exam trap

The trap here is that candidates may think runtime monitoring (Option C) is sufficient, but it fails to prevent the initial deployment of vulnerable or unapproved images, which is the core requirement of the question.

How to eliminate wrong answers

Option A is wrong because increasing CPU and memory limits does not address vulnerability scanning or image approval; it only affects runtime resource allocation, not security posture. Option B is wrong because allowing images from any registry based on tag familiarity is insecure—tags can be easily spoofed or overwritten, and this bypasses any approval or integrity verification. Option C is wrong because disabling pipeline scanning removes the vulnerability detection step entirely, and relying solely on runtime monitoring cannot prevent the initial deployment of vulnerable or unapproved images.

Full explanation →

945

MCQhard

A help desk technician receives a call from someone claiming to be a new contractor whose MFA app failed during travel. The caller knows the company org chart, names the technician's supervisor, and says the technician should use a callback number included in a text message they just sent. What is the safest first action?

A.Reset MFA immediately, since the caller has provided enough internal details to seem credible.

B.Ask the caller to read a one-time code aloud so the technician can confirm their identity.

C.End the call and verify the request through a published help desk number or ticketing system.

D.Approve the request if the caller can name the supervisor and the contractor's project team.

AnswerC

The safest first action is to stop using information supplied by the caller and verify through a trusted, independently obtained contact path. Because the attacker already knows internal details and provided a callback number in a text, those channels cannot be trusted. Using a published help desk number or the official ticketing system preserves least risk and prevents social engineering from extending into account reset abuse.

Why this answer

The safest first action when receiving an unsolicited call requesting privileged actions (like MFA reset) is to independently verify the request through official channels. The caller's knowledge of internal details (org chart, supervisor name) and the request to use a callback number from a text message are classic social engineering red flags, as the callback number could be attacker-controlled. Hanging up and calling back via a published help desk number ensures the request is legitimate and prevents MFA bypass or account takeover.

Exam trap

The trap here is that candidates may assume the caller's knowledge of internal details (supervisor name, org chart) is sufficient proof of identity, but CompTIA tests the principle that any unsolicited request for privileged actions must be independently verified through a trusted channel, not through information the caller provides.

How to eliminate wrong answers

Option A is wrong because resetting MFA immediately based on internal details alone is dangerous; attackers can gather org chart and supervisor names via OSINT or previous breaches, and MFA reset is a high-risk action that should require verified identity. Option B is wrong because asking the caller to read a one-time code aloud is insecure; a one-time code sent to the caller's device could be intercepted or the caller could be the attacker who generated the code themselves, and this method does not verify the caller's identity against a trusted source. Option D is wrong because naming a supervisor and project team is not sufficient authentication; these details are often publicly available or easily guessed, and approving the request without independent verification violates the principle of least privilege and allows unauthorized access.

Full explanation →

946

MCQhard

A team stores sensitive archives on cloud block storage. The provider already encrypts disks at rest, but the company wants copies of the disks to remain unreadable even if a cloud administrator can snapshot and mount the volume. Which control is best?

A.Enable provider-managed encryption at rest only and rotate the storage passwords monthly.

B.Use client-side encryption before upload and keep the keys in an external HSM or key service.

C.Place the storage account in a private subnet and block all Internet access.

D.Rely on immutable snapshots and versioning to prevent unauthorized access.

AnswerB

Client-side encryption means the data is encrypted by your own application or tooling before any bytes are transmitted to the provider, so the provider never receives plaintext or the encryption keys. Keeping the keys in an external HSM or key service (separate from the cloud account) ensures that even if the storage account, snapshots, or mounted disks are copied or accessed by the provider's administrators, the ciphertext remains unreadable without the externally held keys. This achieves a zero-knowledge architecture where the provider cannot decrypt the data, directly addressing the risk of unauthorized administrative access to the cloud storage platform.

Why this answer

Client-side encryption ensures data is encrypted before it ever reaches the cloud provider's storage. By keeping the encryption keys in an external HSM or key service, the cloud provider (including its administrators) never has access to the plaintext keys, so even if they snapshot and mount the volume, the data remains unreadable. This addresses the threat model where the provider's own administrators could otherwise access the data at rest.

Exam trap

The trap here is that candidates assume provider-managed encryption at rest is sufficient against insider threats, but it does not protect against a cloud administrator who has access to the underlying infrastructure and can use snapshot/mount operations to bypass the encryption layer.

How to eliminate wrong answers

Option A is wrong because provider-managed encryption at rest still gives the cloud provider access to the encryption keys (or the means to decrypt), so a cloud administrator with snapshot and mount privileges could read the data. Rotating storage passwords does not change this fundamental access issue. Option C is wrong because placing the storage account in a private subnet and blocking Internet access only restricts network-level access; it does not prevent a cloud administrator from taking a snapshot and mounting it internally, nor does it encrypt the data to protect against that insider threat.

Full explanation →

947

MCQmedium

Users on a wired subnet report intermittent outages when reaching an internal application. A packet capture shows the default gateway IP address repeatedly mapped to a different workstation MAC address, and traffic is being forwarded through that workstation. What attack is most likely occurring?

A.DNS poisoning, because the hostname is resolving to the wrong server.

B.ARP spoofing, because false Layer 2 address mappings are redirecting traffic.

C.Replay attack, because packets are being resent to the gateway.

D.Rogue DHCP service, because clients are losing access to the default gateway.

AnswerB

ARP spoofing, also called ARP poisoning, happens when a host sends forged ARP messages that associate a target IP address with the attacker’s MAC address. In this case, the gateway IP is repeatedly being mapped to a workstation MAC, and traffic is being relayed through that workstation. That is a classic man-in-the-middle setup on a local network segment.

Why this answer

B is correct because ARP spoofing (also known as ARP poisoning) involves an attacker sending forged ARP messages over a local area network. This results in the attacker's MAC address being associated with the IP address of the default gateway, causing traffic destined for the gateway to be forwarded to the attacker's workstation instead. The packet capture evidence of the default gateway IP repeatedly mapped to a different workstation MAC address is the classic signature of this attack.

Exam trap

The trap here is that candidates often confuse ARP spoofing with DNS poisoning because both involve redirecting traffic, but ARP spoofing operates at Layer 2 (MAC address manipulation) while DNS poisoning operates at Layer 7 (hostname resolution).

How to eliminate wrong answers

Option A is wrong because DNS poisoning involves corrupting the DNS resolver cache or DNS server records to map a domain name to an incorrect IP address, not manipulating Layer 2 MAC-to-IP mappings on a local subnet. Option C is wrong because a replay attack involves capturing and retransmitting valid data packets to trick the receiver, not altering ARP tables to redirect traffic through a rogue host. Option D is wrong because a rogue DHCP service would assign incorrect IP configuration (including a fake gateway IP) to clients, but the symptom described is a specific MAC-to-IP mapping conflict for the existing gateway, not a DHCP lease issue.

Full explanation →

948

MCQmedium

A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?

A.Place all servers in the same VLAN and apply a host-based firewall on the database server.

B.Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.

C.Encrypt all data in transit using TLS and at rest using AES-256.

D.Implement network intrusion detection systems on all network segments.

AnswerB

This design creates a clear cardholder data environment (CDE) boundary. The dedicated firewall restricts access so only the application server can communicate with the database server on a specific port. The web server and application server can be placed outside the CDE if they do not directly transmit or store cardholder data, thereby reducing the PCI DSS scope.

Why this answer

Isolating the database server in a separate network segment with a dedicated firewall that restricts traffic to only the application server on the required port creates a clear network segmentation boundary. This segmentation limits the cardholder data environment (CDE) to just the database server, thereby minimizing the scope of the PCI DSS assessment by excluding the web and application servers from the CDE.

Exam trap

The trap here is that candidates often confuse security controls (encryption, IDS) with architectural segmentation, mistakenly believing that encryption or monitoring alone can reduce PCI DSS scope, when only network isolation with a firewall boundary achieves that.

Why the other options are wrong

Placing all servers in the same VLAN does not isolate the database server, so the entire network segment is in scope for PCI DSS. A host-based firewall on the database server alone does not reduce the network segmentation required to minimize scope.

Encryption protects data confidentiality but does not isolate the database server from the rest of the network; PCI DSS scope is determined by network segmentation, not encryption. Without segmentation, all servers are in scope.

Implementing network intrusion detection systems (NIDS) does not reduce the scope of PCI DSS assessment because scope is determined by the systems that store, process, or transmit cardholder data, not by security controls like NIDS.

When would these options actually be correct?

In a scenario where the question asks for a cost-effective security control to protect a single critical server within a flat network, and the primary concern is limiting lateral movement from compromised peers, placing all servers in the same VLAN with a host-based firewall on the critical server could be a valid answer.

A question asking how to protect cardholder data in transit and at rest to meet PCI DSS encryption requirements, without regard to reducing assessment scope.

A question asking for a security control to detect and alert on potential attacks against cardholder data environments, where the goal is to improve monitoring and incident response capabilities, not to reduce PCI DSS scope.

Why candidates pick the wrong answer

Candidates may think that a host-based firewall provides sufficient isolation, not realizing that PCI DSS requires network segmentation (e.g., separate subnet with a firewall) to reduce scope, not just host-level controls.

Candidates often confuse security controls (encryption) with scope reduction, believing that encrypting data eliminates the need for network segmentation.

Candidates may think that adding security controls like NIDS automatically reduces compliance scope, but PCI DSS scope is about network segmentation and data flow, not just security tools.

Full explanation →

949

MCQhard

A Linux server is missing expected security-agent processes, but users can still connect to the application. Local command output does not show a suspicious daemon that another monitoring tool says is listening on port 4444. A raw disk scan reveals a kernel module loaded at boot, and several files appear only when viewed outside the normal operating system tools. What malware type is most likely?

A.Trojan, because it could have introduced the suspicious service after the initial compromise.

B.Spyware, because it may collect data while leaving the application functional.

C.Rootkit, because kernel-level components are hiding processes and files from normal user-mode visibility.

D.Logic bomb, because the malware activates after startup and changes what administrators see.

AnswerC

A rootkit is the best answer because the evidence points to concealment at the operating system level. A kernel module loaded at boot, missing processes in standard listings, and files visible only through raw disk examination all indicate malicious hiding behavior. Rootkits are designed to obscure other malware or unauthorized access, making them especially dangerous and difficult to detect with normal administrative tools.

Why this answer

The scenario describes a rootkit: a kernel-level rootkit can load a malicious kernel module at boot, intercept system calls (e.g., `open`, `readdir`, `netstat`), and hide processes, files, and network listeners from user-mode tools like `ps`, `ls`, or `netstat`. The raw disk scan reveals files invisible to normal OS tools, and the missing security-agent processes and hidden daemon on port 4444 are classic signs of kernel-mode hooking that bypasses standard visibility.

Exam trap

The trap here is that candidates may confuse a rootkit with a Trojan or spyware because all three can persist, but only a rootkit operates at kernel level to hide its artifacts from user-mode commands like `ps`, `ls`, and `netstat`.

How to eliminate wrong answers

Option A is wrong because a Trojan is a type of malware that disguises itself as legitimate software but does not inherently provide kernel-level hiding capabilities; the key evidence here is kernel module loading and file/process concealment, which is the hallmark of a rootkit, not a Trojan. Option B is wrong because spyware focuses on data collection and typically does not modify the kernel to hide its own processes or files; the described behavior of hiding a daemon and files from normal tools goes far beyond spyware's typical user-mode surveillance.

Full explanation →

950

Matchingeasy

Match each PKI term to what it does.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Issues and signs digital certificates.

Binds an identity to a public key.

Can be shared with others to encrypt data or verify signatures.

Must be kept secret and is used to decrypt or sign.

Removes trust from a certificate that should no longer be used.

Why these pairings

CA issues certificates, RA verifies identities, CRL lists revoked certificates, public key encrypts, private key decrypts, digital signature provides integrity and non-repudiation.

Full explanation →

951

MCQmedium

A security manager publishes a document that tells help desk staff exactly how to verify identity, reset an admin password, record the ticket number, and close out the request during a maintenance window. What type of governance artifact is this?

A.Policy

B.Standard

C.Procedure

D.Guideline

AnswerC

A procedure is the correct choice because it provides a detailed, step-by-step set of actions that must be performed in order to complete a task reliably and consistently. The security manager's document tells help desk staff exactly how to handle an issue, ensuring that every employee follows the same sequence and meets security and quality expectations. Procedures are essential for routine operational tasks, such as verifying identity before resetting a password, because they reduce ambiguity and support auditing and training.

Why this answer

A procedure is a step-by-step, ordered list of tasks required to perform a specific operational activity. The document describes exactly how to verify identity, reset an admin password, record the ticket number, and close out the request, which matches the definition of a procedure in governance frameworks.

Exam trap

The trap here is confusing a procedure with a policy or standard, where candidates often pick 'policy' because they think any security document is a policy, but the detailed step-by-step nature uniquely identifies a procedure.

How to eliminate wrong answers

Option A is wrong because a policy is a high-level statement of management intent, not a detailed step-by-step instruction. Option B is wrong because a standard defines mandatory requirements or specifications (e.g., password complexity rules), not the exact sequence of actions. Option D is wrong because a guideline offers recommendations or best practices, not mandatory, prescriptive steps.

Full explanation →

952

Multi-Selecteasy

A user's workstation suddenly renames documents with a new extension, displays a ransom note, and blocks access to a shared drive. Which two indicators support ransomware? Select two.

Select 2 answers

A.Files are renamed or encrypted and no longer open normally

B.A ransom note demands payment for decryption or restoration

C.The mouse pointer moves slowly after long idle periods

D.The browser homepage changed after a software update

E.A new USB keyboard is detected by the operating system

AnswersA, B

Ransomware typically enumerates user files and applies symmetric encryption (e.g., AES) with a per-file key, then appends an extension such as .locked or .crypt. Renaming and encrypting prevents normal access via the OS file system, because the original file system metadata and content are replaced. This behavior is a direct, observable consequence of the malware's core objective: to hold data hostage until a ransom is paid.

Why this answer

Ransomware typically encrypts files and renames them with a new extension (e.g., .encrypted, .locked), making them unopenable without the decryption key. This behavior directly matches the scenario where documents are renamed and access is blocked, confirming file encryption as a core indicator of ransomware.

Exam trap

The trap here is that candidates may confuse general system performance issues (like a slow mouse) with ransomware indicators, but ransomware focuses on file encryption and ransom demands, not on input device behavior.

Full explanation →

953

Multi-Selectmedium

A help desk technician receives a call from someone claiming to be a contractor whose MFA device was lost during travel. The caller knows the company org chart and asks for a new device enrollment. Which three responses are appropriate? Select three.

Select 3 answers

A.Refuse to bypass identity verification requirements.

B.Use a known callback number or approved ticketing process to confirm identity.

C.Report the interaction to the security team if the call seems suspicious.

D.Read the current MFA reset code over the phone to speed up recovery.

E.Enroll the new device immediately because the caller knows company names and roles.

AnswersA, B, C

Knowing internal names is not enough; identity checks must still follow the approved process.

Why this answer

Bypassing identity verification for MFA device enrollment would undermine the security that MFA provides. The caller's knowledge of the org chart does not constitute proof of identity; social engineering attacks often leverage such information. Refusing to bypass verification ensures that only authorized users can enroll new MFA tokens, maintaining the integrity of the authentication process.

Exam trap

The trap here is that candidates may assume knowledge of internal details (like the org chart) is sufficient proof of identity, but social engineering attacks frequently exploit such information to bypass security controls.

Full explanation →

954

Multi-Selectmedium

A software supplier is adding a new subcontractor to process your company's customer data. The security team wants to understand the new exposure before allowing the change. Which three items should it request or review first? Select three.

Select 3 answers

A.A list of the subcontractor's locations and where the data will be processed.

B.The subcontractor's logo and marketing brochure.

C.A data-processing agreement that flows down security and notification obligations.

D.An independent security assessment, such as a SOC report or equivalent.

E.The supplier's quarterly sales forecast.

AnswersA, C, D

Knowing the specific locations where a subcontractor operates and where it will process data allows the organization to map data flows to legal jurisdictions. This is essential for assessing compliance with data protection regulations such as GDPR, which restrict cross-border transfers to countries without an adequacy decision, and for understanding whether data will be subject to foreign government access or conflicting privacy laws. Without this information, the organization cannot properly perform a risk assessment or meet its own regulatory obligations.

Why this answer

Understanding where data will be processed and the subcontractor's physical locations is critical for assessing jurisdictional risks, data sovereignty requirements, and compliance with regulations like GDPR or CCPA. The security team needs this information to evaluate potential exposure to different legal frameworks and physical security controls before granting access to customer data.

Exam trap

The trap here is that candidates may mistakenly think marketing materials or logos are relevant for security assessments, when in fact only operational, legal, and technical documentation (like locations and DPAs) provide actionable risk information.

Full explanation →

955

MCQhard

Based on the exhibit, what is the BEST response by the employee? The message appears to come from a trusted internal support team, but the sender details and request do not align with normal procedures.

A.Verify the request using a known internal help desk number or portal before taking any action.

B.Reply with the six-digit code so the help desk can complete the repair quickly.

C.Open the linked repair page from the email and sign in immediately to avoid suspension.

D.Forward the message to the manager and continue using the account until the suspension occurs.

AnswerA

The employee should verify the request through an independently known help desk number or portal, not through any contact details embedded in the email. This message combines urgency, a mismatched reply-to address, and a request for an MFA code — classic indicators of a phishing or vishing attempt. Calling the official help desk number or logging into the official support portal confirms whether the repair request is legitimate before any sensitive action is taken. This out-of-band verification prevents both credential theft and MFA token compromise.

Why this answer

Verifying the request through a known internal help desk number or portal is the standard security practice to confirm the legitimacy of any unexpected communication, especially when sender details and procedures do not align. This approach mitigates the risk of social engineering attacks, such as phishing or business email compromise (BEC), where attackers impersonate trusted entities to trick employees into revealing sensitive information or performing unauthorized actions. By using an independently verified contact method, the employee ensures they are not falling victim to a fraudulent request that could lead to account compromise or data breach.

Exam trap

The trap here is that candidates may assume the email is legitimate because it appears to come from a trusted internal source, leading them to choose an action that involves direct interaction with the email (like replying or clicking a link) rather than verifying through an independent channel, which is the core principle of social engineering defense.

How to eliminate wrong answers

Option B is wrong because replying with a six-digit code directly to the email sender could provide an attacker with a one-time passcode (OTP) or verification code, enabling them to bypass multi-factor authentication (MFA) or gain unauthorized access to the employee's account. Option C is wrong because opening a linked repair page from the email and signing in immediately could lead to a credential harvesting site that captures the employee's username and password, compromising their account. Option D is wrong because forwarding the message to the manager and continuing to use the account until suspension occurs does not prevent potential compromise; the employee remains vulnerable to further exploitation while the manager investigates, and the account could be used maliciously in the interim.

Full explanation →

956

Multi-Selecteasy

A security team wants to reduce the chance that employees boot unmanaged tools from removable media and wants only approved software to run on laptops. Which two controls should they use? Select two.

Select 2 answers

A.Secure Boot

B.Application control or allowlisting

C.DNS forwarding

D.Longer screen-lock timeout

E.Public DNS resolvers

AnswersA, B

Secure Boot helps ensure the device starts using trusted boot components instead of unapproved pre-boot code. That reduces the risk of tampered boot media or rogue recovery tools.

Why this answer

Secure Boot is correct because it ensures that only signed, trusted firmware and bootloaders execute during system startup, preventing unauthorized bootable media (e.g., USB drives with unmanaged OS images) from loading. This directly reduces the chance that employees can boot unmanaged tools from removable media by enforcing a chain of trust from UEFI firmware to the operating system kernel.

Exam trap

The trap here is that candidates may confuse DNS forwarding (a network service) with DNS filtering or security controls, or think that a longer screen-lock timeout improves security, when in fact it weakens physical security by extending the window of opportunity for unauthorized access.

Full explanation →

957

MCQmedium

A branch office has users, finance workstations, printers, and IP phones on one flat LAN. After a malware outbreak on a user PC, management wants to limit lateral movement without blocking printing or voice traffic. What should the network team implement?

A.Move all devices into one larger subnet and rely on endpoint antivirus for separation.

B.Create separate VLANs for device groups and apply inter-VLAN ACLs that permit only required traffic.

C.Place all devices behind a single proxy server and block all internal east-west traffic.

D.Enable port security on the switch and disable all VLAN tagging to reduce complexity.

AnswerB

Segmenting the flat LAN into VLANs by device role, then enforcing inter-VLAN ACLs that permit only required flows, contains lateral movement while preserving printing and voice. This satisfies management's constraint of restricting spread without disrupting legitimate services.

Why this answer

Segmenting devices into separate VLANs (e.g., users, finance, printers, IP phones) and applying inter-VLAN ACLs restricts lateral movement by default while permitting only necessary traffic like printing (TCP 9100) and voice (RTP/UDP 16384-32767). This aligns with the principle of least privilege and zero trust segmentation, preventing malware from spreading across the flat LAN without disrupting critical services.

Exam trap

The trap here is that candidates often confuse 'limiting lateral movement' with 'blocking all east-west traffic,' forgetting that printing and voice require specific peer-to-peer flows that a proxy or full-block would break.

How to eliminate wrong answers

Option A is wrong because moving all devices into one larger subnet increases the attack surface and does nothing to limit lateral movement; endpoint antivirus alone cannot prevent east-west propagation. Option C is wrong because placing all devices behind a single proxy server blocks east-west traffic entirely, which would break local printing (direct IPP/SMB) and voice (RTP) traffic that requires direct peer-to-peer communication. Option D is wrong because enabling port security only controls MAC address flooding and disabling VLAN tagging would collapse all traffic into a single broadcast domain, eliminating segmentation and increasing lateral movement risk.

Full explanation →

958

MCQmedium

After containment and eradication of malware on several laptops, the team restores the devices from known-good images and verifies that users can authenticate and access email. Which action should occur NEXT to complete the incident response lifecycle and reduce future impact?

A.Close the ticket immediately because the systems are working again

B.Perform a lessons-learned review and update playbooks, controls, or detections based on the incident

C.Reimage the laptops again even though they were already restored and tested

D.Disable all email access for the organization until the next quarterly meeting

AnswerB

A lessons-learned review is the formal post-incident activity in the NIST and SANS incident response frameworks. It examines what worked, what failed, and which detection rules, playbooks, or security controls need adjustment, turning the incident into actionable intelligence. Updating playbooks and detections based on the observed TTPs (tactics, techniques, and procedures) reduces recurrence and improves response time for future incidents. This is the correct step because it captures continuous improvement rather than merely restoring service.

Why this answer

The incident response lifecycle includes a post-incident activity phase where the team conducts a lessons-learned review to identify gaps in security controls, update playbooks, and improve detection signatures. This step ensures that the organization reduces the likelihood and impact of similar incidents in the future, completing the lifecycle beyond just restoring operations.

Exam trap

The trap here is that candidates assume the incident response lifecycle ends once systems are restored and operational, overlooking the mandatory post-incident activity phase that ensures continuous improvement and prevents recurrence.

How to eliminate wrong answers

Option A is wrong because closing the ticket immediately after restoration skips the critical post-incident review phase, leaving vulnerabilities unaddressed and missing opportunities to improve defenses. Option C is wrong because reimaging the laptops again is redundant and wastes resources; the devices have already been restored from known-good images and verified for functionality. Option D is wrong because disabling all email access until a quarterly meeting is an extreme, unnecessary measure that disrupts business operations and does not address the root cause or improve security posture.

Full explanation →

959

MCQmedium

A security analyst receives an alert from the intrusion detection system indicating that a workstation in the finance department has established an outbound connection to a known malicious IP address using an encrypted protocol. The analyst verifies the alert and checks the user's activity logs, which show no legitimate business reason for the connection. According to the incident response process, what should the analyst do NEXT?

A.Begin the eradication phase by immediately reimaging the workstation.

B.Isolate the workstation from the network to contain the threat.

C.Conduct a full forensic analysis of the workstation's hard drive.

D.Update the firewall rule to block all outbound traffic to the malicious IP.

AnswerB

Isolation is the immediate containment step in the NIST incident response lifecycle, and it should be performed as soon as a compromise is confirmed. By moving the workstation to a quarantine VLAN, disabling its network interface, or physically disconnecting it, you sever the active command-and-control channel and prevent the attacker from using this host to pivot laterally. This action also preserves volatile evidence in memory for later forensic acquisition, making it the correct first response to an intrusion alert.

Why this answer

According to the NIST SP 800-61 incident response process, containment is the immediate priority after verification to prevent further damage or data exfiltration. Since the workstation has an active encrypted outbound connection to a known malicious IP with no legitimate business reason, isolating the network interface (e.g., disabling the port, blocking the MAC address, or unplugging the cable) stops the threat from communicating while preserving the system state for later analysis. This aligns with the containment phase, which must precede eradication or full forensic analysis.

Exam trap

The SY0-701 exam often tests the order of the incident response phases (Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident) and the trap here is that candidates jump to eradication or forensic analysis without first containing the active threat, which violates the fundamental priority of stopping the bleeding before cleaning up.

Why the other options are wrong

In the incident response process, containment (isolating the workstation) must precede eradication (reimaging). Reimaging without containment could allow the threat to spread or lose volatile evidence.

In the incident response process, containment (isolating the workstation) must occur before eradication or forensic analysis. Conducting a full forensic analysis at this stage would delay containment and allow the threat to persist or spread.

After confirming an active threat, the immediate priority is containment (isolating the workstation) to prevent further damage, not updating firewall rules, which is a longer-term preventive measure.

When would these options actually be correct?

This option would be correct if the question stated that containment has already been performed (e.g., the workstation is already isolated) and the analyst has confirmed the system is compromised with no need for forensic preservation, so the next step is eradication.

A question where the incident has already been contained, and the analyst is now in the eradication or post-incident activity phase, such as: 'After isolating the compromised workstation and blocking the malicious IP, what should the analyst do NEXT to gather evidence for legal proceedings?'

This would be correct if the question stated that the analyst had already contained the threat and was now implementing permanent controls to prevent recurrence, or if the scenario involved a known malicious IP that needed to be blocked proactively across the network.

Why candidates pick the wrong answer

Candidates may think reimaging is a quick fix to remove malware, but they overlook the critical containment step required to prevent lateral movement and preserve evidence.

Candidates may think forensic analysis is the immediate next step to understand the attack, but they overlook the priority of containment to prevent further damage.

Candidates may think blocking the IP is a quick fix to stop the connection, but they overlook that the workstation is already compromised and needs isolation first.

Full explanation →

960

MCQmedium

A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?

A.95% of employees completed the training within the deadline.

B.The number of employees reporting phishing attempts to the SOC increased by 40%.

C.The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.

D.The number of helpdesk tickets related to password resets decreased by 10%.

AnswerC

A simulated phishing click-through rate is a direct behavioral measure: it tests precisely the skill the training is designed to improve, and the marked drop from 18% to 6% shows employees are applying their knowledge in realistic conditions. Unlike self-reports or knowledge quizzes, this metric captures actual decision-making under a simulated attack, making it strong evidence of decreased susceptibility. The pre/post comparison controls for prior awareness and isolates the training’s impact on the target behavior, which is why it is the most convincing effectiveness indicator.

Why this answer

Directly measures the reduction in risky behavior (clicking phishing links) after training, which is the core goal of security awareness training. A drop from 18% to 6% demonstrates a measurable behavior change, not just knowledge acquisition. This aligns with the Kirkpatrick Model's 'Behavior' level of evaluation, which is the strongest indicator of training effectiveness.

Exam trap

The trap here is that candidates often choose Option B (increased reporting) because it sounds proactive, but the question specifically asks for evidence of 'changing employee behavior' away from clicking, not just improving reporting habits.

Why the other options are wrong

Completion rate (95%) measures training participation, not behavior change. The goal is to reduce risky actions like clicking phishing links, not just completing modules.

An increase in reporting phishing attempts indicates improved awareness, but it does not directly measure behavior change in terms of reducing risky actions like clicking. The question specifically asks for evidence of behavior change, and reporting is a secondary action, not the primary risky behavior.

A decrease in password reset tickets is not directly tied to security awareness training; it could result from other factors like improved password policies or self-service tools, and does not measure behavioral change regarding phishing or security awareness.

When would these options actually be correct?

A question asking for evidence of training program adoption or compliance, e.g., 'Which metric best indicates that employees completed the mandatory training on time?'

This option would be correct if the question asked: 'Which metric best indicates that employees are more vigilant and actively participating in the security program?' or 'Which metric demonstrates an increase in security-conscious behavior following training?'

This metric would be correct if the question asked for evidence that the training improved password hygiene or reduced account compromise incidents, such as after a training module on password security and multi-factor authentication.

Why candidates pick the wrong answer

Candidates confuse completion rates with effectiveness, assuming high participation automatically means behavior change.

Candidates may think that more reporting directly correlates with better security behavior, overlooking that the core goal is to reduce clicks, not just increase reports. They might also confuse awareness (knowing to report) with behavior change (not clicking).

Candidates may assume that any positive metric following training indicates effectiveness, overlooking that password resets are not a direct measure of security awareness behavior change.

Full explanation →

961

MCQmedium

A vulnerability scan reports a critical finding on a legacy application server. The security team verifies that the flagged package is installed, but the vulnerable code path is disabled by configuration and cannot be exploited in the current deployment. The vendor will not support a patch until next quarter. What is the best next step?

A.Ignore the finding because the scanner produced a false positive

B.Request a risk exception and document compensating controls until patching is possible

C.Disable the vulnerability scanner to prevent repeated alerts

D.Immediately retire the server even though the application is still business-critical

AnswerB

This is the best response because the team has confirmed the issue cannot be immediately remediated, but the organization still needs formal risk ownership. A risk exception documents the temporary acceptance, while compensating controls capture what is being done to reduce exposure until a supported patch becomes available. That is the right balance between operational constraints and security governance.

Why this answer

The vulnerability is real (the package is installed), but the risk is mitigated by a compensating control (the vulnerable code path is disabled). A risk exception formally documents this compensating control and the planned patch timeline, ensuring the finding is tracked and not forgotten. This aligns with the SY0-701 objective of managing risk through formal acceptance and compensating controls when immediate remediation is not possible.

Exam trap

The trap here is that candidates confuse a 'false positive' (scanner error) with a 'vulnerability that is mitigated by a compensating control' — the scanner is correct, but the risk is lower than the raw CVSS score suggests.

How to eliminate wrong answers

Option A is wrong because the scanner did not produce a false positive; the vulnerable package is indeed installed, and the scanner correctly identified it. The fact that the code path is disabled is a compensating control, not a false positive. Option C is wrong because disabling the vulnerability scanner would eliminate visibility into all findings, including legitimate ones, and violates security monitoring best practices.

Option D is wrong because retiring a business-critical server without a replacement or migration plan would cause unacceptable operational impact, and the risk is already mitigated by the disabled code path.

Full explanation →

962

MCQmedium

A security team suspects a rootkit after seeing hidden processes, boot-time persistence, and altered system files on a laptop. What is the best next step after confirming the suspicion?

A.Run a quick cleanup script and return the laptop to the user

B.Disconnect the laptop, then reimage it from a known-good source

C.Disable the user account and leave the device in place

D.Delete the suspected hidden files manually from Windows Explorer

AnswerB

Disconnecting the laptop isolates it from the network, stopping any ongoing command-and-control communication, data exfiltration, or lateral movement. Reimaging from a known-good source (after securely erasing the disk, and ideally verifying firmware integrity) removes not only the visible malware but also any kernel-level or boot-level persistence mechanisms. This is the only option that provides a trustworthy, verifiable baseline for returning the device to service.

Why this answer

Once a rootkit is confirmed, the system's integrity is compromised at the kernel or boot level, making any software-based cleanup unreliable. Reimaging from a known-good source ensures all malicious code, including bootkits and hidden processes, is completely eradicated. This aligns with the SY0-701 domain of incident response, where containment and eradication require a trusted baseline.

Exam trap

The trap here is that candidates may think a cleanup script or manual deletion is sufficient, but rootkits operate below the OS level, making reimaging the only reliable method to restore integrity.

How to eliminate wrong answers

Option A is wrong because a quick cleanup script cannot remove rootkits that operate at ring 0 or modify the Master Boot Record (MBR); the malware will persist or reinfect. Option C is wrong because disabling the user account does not remove the rootkit from the laptop, leaving the device compromised and potentially spreading to other systems on the network. Option D is wrong because manually deleting files from Windows Explorer cannot remove kernel-mode rootkits that hide their processes and files from user-mode tools, and it may trigger anti-forensic mechanisms.

Full explanation →

963

MCQmedium

Field technicians use company-owned tablets that also run approved personal apps. Security needs corporate email and documents isolated from personal data, selective wipe of only business content if a device is lost, and compliance checks before access is allowed. What should be deployed?

A.Full-disk encryption on the tablets with no additional device management.

B.Mobile device management with a work profile or container and conditional access.

C.A mobile VPN client with split tunneling enabled for user convenience.

D.An antivirus app with a blacklist of approved and unapproved mobile apps.

AnswerB

Mobile device management (MDM) with a work profile or container creates a hard logical separation between corporate data and personal apps on the same tablet. Conditional access policies can then require device compliance (such as patch level, root/jailbreak status, and lock screen strength) before granting access to corporate email or internal applications. This architecture allows IT to selectively wipe only the managed corporate container without touching personal data, and to enforce app-level restrictions. Together, containerization and conditional access directly address the need to manage company-owned tablets that also serve personal use, unlike encryption, VPN, or antivirus alone.

Why this answer

Mobile device management (MDM) with a work profile or container (e.g., Android Work Profile or iOS Managed Open In) provides the required isolation between corporate and personal data. Conditional access enforces compliance checks (e.g., device health attestation, OS patch level) before granting access to corporate resources. This combination also enables selective wipe of only the work container without affecting personal apps or data, meeting the lost-device requirement.

Exam trap

The trap here is that candidates confuse full-disk encryption (which only protects data at rest) with the isolation and selective-wipe capabilities of a managed work profile, or they assume a VPN or antivirus alone can enforce data separation and compliance checks.

How to eliminate wrong answers

Option A is wrong because full-disk encryption protects data at rest but does not isolate corporate from personal data, nor does it support selective wipe or compliance-based access control. Option C is wrong because a mobile VPN with split tunneling only controls network routing for user convenience; it provides no data isolation, no selective wipe capability, and no compliance enforcement. Option D is wrong because an antivirus app with an app blacklist only blocks or allows specific applications; it cannot isolate corporate data, perform selective wipes, or enforce compliance checks before access.

Full explanation →

964

Multi-Selectmedium

A finance workflow currently lets one employee create a payment batch and approve it in the same session. Audit findings say the design increases fraud risk. Which two access architecture changes best reduce that risk while keeping the process functional? Select two.

Select 2 answers

A.Split the workflow into separate creator and approver roles.

B.Require the approver to be a different authenticated user before release.

C.Grant all finance users local administrator rights to speed up exception handling.

D.Store the payment password in a shared mailbox so the team can continue when someone is absent.

E.Remove approval steps entirely and rely on log reviews after payment runs.

AnswersA, B

Separating creator and approver responsibilities implements separation of duties and prevents one person from completing the full fraud-prone action alone. This preserves the workflow while requiring a second trusted person to review and approve the batch. It is a classic access architecture control for payment and procurement systems.

Why this answer

Implementing separation of duties (SoD) by splitting the payment batch creation and approval into distinct roles ensures that no single user can both create and approve a transaction. This directly mitigates the fraud risk identified in the audit by requiring collusion between two users to execute a fraudulent payment. The process remains functional because the workflow is simply reordered into two sequential steps performed by different users.

Exam trap

The trap here is that candidates may confuse 'functional efficiency' with 'security best practices' and incorrectly choose option C, thinking that local admin rights will speed up exception handling, when in fact it violates least privilege and separation of duties.

Full explanation →

965

MCQmedium

A customer portal runs from a primary data center. Management wants the secondary site to take over within minutes if the primary site loses power, and the secondary site should already have current systems and data ready to serve users. Which design best fits this requirement?

A.A cold site with nightly backups stored offsite

B.A hot site with synchronized data replication and automated failover

C.RAID 0 across two storage arrays in the primary data center

D.A single backup server with larger disks and more memory

AnswerB

A hot site is already prepared to operate and can receive traffic quickly when the primary site fails. Synchronized replication keeps data current, and automated failover minimizes manual intervention and recovery time. This is the best match for a near-immediate continuity requirement.

Why this answer

A hot site with synchronized data replication and automated failover is the correct choice because it maintains an exact, real-time copy of systems and data at the secondary site. Synchronous replication ensures zero data loss (RPO=0), and automated failover enables the secondary site to become operational within minutes (RTO measured in minutes), meeting the requirement for immediate takeover after a power loss at the primary site.

Exam trap

The trap here is that candidates confuse a cold site with nightly backups as sufficient for rapid recovery, failing to recognize that the RTO of minutes requires pre-staged, synchronized systems and automated failover, not manual restoration from backups.

How to eliminate wrong answers

Option A is wrong because a cold site has no pre-installed hardware or current data; it requires manual setup and restoration from nightly backups, which takes hours or days, not minutes, and cannot achieve the required RTO. Option C is wrong because RAID 0 provides striping for performance but offers no fault tolerance; if either array fails, all data is lost, and it does not address site-level failover or power loss at the primary data center.

Full explanation →

966

MCQmedium

Sales representatives use company-managed smartphones for email, CRM, and document access. If a phone is lost, IT must remove only the corporate apps and work data without erasing the employee's personal photos and contacts. Which control should be used?

A.Perform a full factory reset remotely as soon as any device is reported lost.

B.Use selective wipe through a mobile device management platform.

C.Disable password complexity so the user can regain access more easily after replacement.

D.Install a VPN profile and assume corporate data is safe if the network traffic is encrypted.

AnswerB

Selective wipe, executed through an MDM platform, targets only the corporate container or managed objects on the device, including work email, calendar, VPN profiles, certificates, and managed applications. Because personal data remains intact, this approach aligns with BYOD and COPE deployment models where users retain a privacy expectation. The remote administrative action also supports immediate response to a lost device without the collateral damage of a full factory reset.

Why this answer

Mobile Device Management (MDM) platforms support selective wipe, which uses management APIs (e.g., Android Enterprise Work Profile or iOS Managed Open In) to remove only corporate apps, accounts, and data while leaving personal content intact. This satisfies the requirement to protect corporate data without infringing on the employee's personal privacy.

Exam trap

The trap here is that candidates often confuse full factory reset (option A) with selective wipe, assuming any remote wipe will suffice, but the exam specifically tests the distinction between wiping all data versus only corporate-managed data.

How to eliminate wrong answers

Option A is wrong because a full factory reset erases all data on the device, including personal photos and contacts, which violates the requirement to preserve personal data. Option C is wrong because disabling password complexity weakens device security and does not address the need to selectively remove corporate data; it also does not help regain access after replacement. Option D is wrong because installing a VPN profile only encrypts network traffic in transit and does not provide any mechanism to remotely remove corporate data from a lost device.

Full explanation →

967

Multi-Selectmedium

A security team is reviewing vulnerabilities in a web application. Which three of the following are common web application vulnerabilities that should be addressed? (Choose three.)

Select 3 answers

.Cross-site scripting (XSS)

.ARP poisoning

.SQL injection

.XML external entity (XXE) injection

.DNS cache poisoning

.Evil twin attack

Why this answer

Cross-site scripting (XSS) is a common web application vulnerability where an attacker injects malicious scripts into web pages viewed by other users, often through input fields or URL parameters. SQL injection occurs when an application improperly sanitizes user input in SQL queries, allowing attackers to manipulate the database. XML external entity (XXE) injection exploits poorly configured XML parsers to process external entities, leading to data disclosure or server-side request forgery.

These three are consistently listed in the OWASP Top 10 as critical web application flaws.

Exam trap

The SY0-701 exam often tests the distinction between web application vulnerabilities (like XSS, SQLi, XXE) and network-level attacks (like ARP poisoning, DNS cache poisoning, evil twin), so candidates mistakenly select network attacks because they are familiar, but they are not specific to web applications.

Full explanation →

968

MCQeasy

After a file server is restored from backup, users can open the share, but the business wants to be sure the recovery was successful. What should the administrator verify next?

A.Only that the restore completed without any error message.

B.That representative files open correctly and the restored data matches the required recovery point.

C.That the server has enough free disk space for future growth.

D.That the backup software icon appears green on the console.

AnswerB

This is the best answer because restore verification should confirm both data usability and recovery accuracy. A successful job status alone is not enough; the team should test sample files, confirm permissions, and ensure the data reflects the expected recovery point objective. That proves the backup can actually support operations after an outage and not just complete technically.

Why this answer

Verifying that representative files open correctly and match the required recovery point (RPO) confirms data integrity and completeness, not just that the restore process ran without errors. This aligns with the backup validation principle of performing a data integrity check, such as comparing file hashes or checking timestamps, to ensure the restored data is usable and meets the business's recovery objectives.

Exam trap

The trap here is that candidates assume a successful restore job status (no errors) is sufficient, but CompTIA tests the understanding that validation requires actual data verification against the recovery point, not just process completion.

How to eliminate wrong answers

Option A is wrong because a restore completing without error messages only confirms the process finished, not that the data is intact or usable; silent corruption or missing files can occur. Option C is wrong because verifying free disk space for future growth is a capacity planning task unrelated to validating the success of a specific recovery operation. Option D is wrong because a green icon on the backup software console only indicates the backup job ran, not that the restored data is correct or meets the recovery point objective.

Full explanation →

969

MCQmedium

An email gateway receives a macro-enabled spreadsheet from an external supplier. Signature-based scanning does not flag it, but the security team wants to observe whether it drops files, creates persistence, or contacts suspicious domains before delivery to the user. Which tool best meets this need?

A.DLP, because it prevents any document from leaving the organization.

B.Sandboxing, because it detonates the file and observes malicious behavior safely.

C.NAC, because it can block the supplier's laptop from the network.

D.A SIEM, because it can block the attachment and quarantine the message.

AnswerB

Sandboxing is designed to execute suspicious files in a controlled environment and watch what they do. That makes it ideal when signature-based tools miss a potentially malicious attachment and the team wants to see whether it drops files, modifies persistence settings, or reaches out to command-and-control infrastructure. It gives analysts behavior-based insight before the attachment reaches the end user.

Why this answer

Sandboxing is the correct choice because it detonates the file in an isolated, controlled environment to observe its runtime behavior, such as dropping files, creating persistence mechanisms, or making outbound connections to suspicious domains. Unlike signature-based scanning, sandboxing can detect unknown or zero-day malware by analyzing behavioral indicators without risking the production network.

Exam trap

CompTIA often tests the distinction between passive detection (signature-based, SIEM correlation) and active behavioral analysis (sandboxing), leading candidates to choose SIEM because they confuse log aggregation with dynamic file analysis.

How to eliminate wrong answers

Option A is wrong because DLP (Data Loss Prevention) focuses on preventing unauthorized exfiltration of sensitive data, not on analyzing file behavior for malware. Option C is wrong because NAC (Network Access Control) enforces access policies based on device compliance, not on detonating and analyzing attachments. Option D is wrong because a SIEM (Security Information and Event Management) aggregates and correlates logs for detection and alerting, but it does not actively detonate files or observe runtime behavior; it relies on data from other tools.

Full explanation →

970

Drag & Dropmedium

Drag and drop the steps for the RADIUS authentication process into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

RADIUS uses UDP; the NAS acts as a client to the RADIUS server, which authenticates and authorizes the user.

Full explanation →

971

MCQmedium

A security analyst detects repeated outbound traffic from a single workstation to an IP address listed on a public threat intelligence feed as a known command-and-control server. The user reports that the workstation is behaving slowly and that antivirus software is up to date. According to incident response best practices, what should the analyst do FIRST?

A.Disconnect the workstation from the network

B.Run a full antivirus scan on the workstation

C.Notify the user that their workstation may be compromised

D.Check the firewall logs to confirm the destination IP

AnswerA

Disconnecting the workstation from the network—by unplugging the Ethernet cable, turning off Wi-Fi, or deactivating the virtual NIC—stops the observed outbound traffic instantly. This containment step severs the command-and-control channel and aborts any ongoing data exfiltration, which is the immediate priority in incident response. It also prevents the malicious process from spreading laterally to other systems on the same segment. While this may lose some volatile network connections, the value of halting the threat outweighs forensic collection at this stage.

Why this answer

The correct first step is to disconnect the workstation from the network to immediately contain the threat and prevent further command-and-control (C2) communication. Since the traffic is already confirmed to a known C2 server via a public threat intelligence feed, the priority is to stop data exfiltration and potential lateral movement, not to gather more evidence or notify the user. Incident response best practices emphasize containment before eradication or notification to minimize damage.

Exam trap

The trap here is that candidates often choose to gather more evidence (Option D) or run a scan (Option B) first, forgetting that containment is the immediate priority once a live C2 connection is confirmed, per the NIST SP 800-61 incident response lifecycle.

Why the other options are wrong

Running a full antivirus scan delays containment; the priority is to stop potential data exfiltration or lateral movement by immediately isolating the workstation from the network.

Notifying the user before containing the threat could cause panic or lead to the user taking actions that disrupt forensic evidence or further compromise the system. Incident response best practices prioritize containment (disconnecting the network) over communication.

Checking firewall logs to confirm the destination IP is a secondary step; the priority is immediate containment by disconnecting the workstation to prevent further C2 communication.

When would these options actually be correct?

This would be correct if the question stated that the antivirus was not up to date and the analyst had already verified the traffic as suspicious but not yet confirmed malicious, making a scan the next logical step before escalation.

In a scenario where the analyst has already contained the threat (e.g., disconnected the workstation) and needs to inform the user about the incident and next steps, such as for an interview or data collection, notifying the user would be appropriate.

If the question asked for the first step after containment (e.g., 'After disconnecting the workstation, what should the analyst do next?'), then checking firewall logs to gather evidence and confirm the threat would be appropriate.

Why candidates pick the wrong answer

Candidates may assume antivirus is the primary defense and that scanning is the standard first response, overlooking the urgency of containing a confirmed C2 communication.

Candidates may think that informing the user is a logical first step to gather information or warn them, but they overlook the immediate need to stop the command-and-control communication to prevent data exfiltration or further compromise.

Candidates may think verification is necessary before action, but in incident response, containment takes precedence over confirmation when a clear indicator of compromise exists.

Full explanation →

972

Multi-Selecteasy

Company-owned tablets run both business apps and approved personal apps. Which two controls best keep company data separated and support selective wipe? Select two.

Select 2 answers

A.Mobile device management with a work profile or container for corporate data.

B.Selective remote wipe of only the managed corporate container.

C.Allow users to install any app if they promise not to open work files.

D.Store corporate files in the personal photo gallery for easier backup.

E.Disable screen locks so users can access business apps faster.

AnswersA, B

A mobile device management (MDM) work profile—such as Android Enterprise work profile or iOS managed app configuration—creates a cryptographically isolated container where corporate data, apps, and policies are managed separately from the personal environment. The container enforces its own PIN policy, encryption, app allowlisting, and traffic routing rules, so business data remains protected even on a shared device. This is the foundational control because it enables centralized administration without infringing on the user's personal apps and data.

Why this answer

Mobile Device Management (MDM) with a work profile or container creates a separate, encrypted partition on the device for corporate data. This container enforces policies (e.g., app whitelisting, VPN) and isolates business apps from personal apps, ensuring that company data remains protected even if the personal side is compromised.

Exam trap

The trap here is that candidates may confuse 'selective wipe' with a full device wipe, or assume that user promises (Option C) or convenience features (Option E) are acceptable security controls, when only containerization and managed wipe satisfy the separation and selective wipe requirements.

Full explanation →

973

Multi-Selecteasy

A records manager is told that some HR emails may be needed for an active investigation, while unrelated messages are still due for deletion under the retention schedule. Which two actions should the manager take? Select two.

Select 2 answers

A.Place the affected emails on legal hold

B.Delete all related records immediately to reduce storage costs

C.Keep the records until the legal team releases the hold

D.Move them into a personal archive folder

E.Rewrite the retention schedule without approval

AnswersA, C

A legal hold is a formal preservation notice issued when litigation or an investigation is reasonably anticipated. It immediately suspends normal retention and deletion schedules for the affected emails, including any automated purge processes, to prevent spoliation and ensure that all relevant evidence remains intact and searchable for the legal matter. This is the required first step before any other records action is taken.

Why this answer

A is correct because placing the affected emails on legal hold suspends the retention schedule for those specific records, ensuring they are preserved for the active investigation without altering the deletion policy for unrelated messages. This is a standard practice under eDiscovery and legal hold procedures, often implemented via Exchange Online or similar systems using litigation hold or in-place hold.

Exam trap

The trap here is that candidates may confuse 'legal hold' with simply archiving or delaying deletion, but only a formal hold ensures compliance with legal preservation requirements and prevents spoliation.

Full explanation →

974

Multi-Selecteasy

A small company is deploying a public web application with a front-end server, an application server, and a database. Which two design choices best reduce exposure of the backend systems? Select two.

Select 2 answers

A.Place the web server in a DMZ that is reachable from the internet.

B.Put the database on the same subnet as the web server for faster communication.

C.Place the database on an internal subnet that is not directly reachable from the internet.

D.Allow every tier to communicate freely to simplify troubleshooting.

E.Use one flat VLAN for all three servers and rely on strong passwords.

AnswersA, C

The web server is the system that must face external traffic, so placing it in a DMZ keeps it separate from internal resources. This limits the damage if the public server is compromised.

Why this answer

Placing the web server in a DMZ (demilitarized zone) allows it to be reachable from the internet while isolating it from the internal network. This design ensures that even if the web server is compromised, an attacker cannot directly access the application server or database, as traffic must pass through a firewall with strict rules. The DMZ acts as a buffer zone, reducing the attack surface of backend systems.

Exam trap

CompTIA often tests the misconception that placing all servers in a single VLAN with strong passwords is sufficient security, but the trap here is that network segmentation (DMZ and internal subnets) is essential to limit lateral movement, and passwords alone cannot stop an attacker who exploits a vulnerability in the web server.

Full explanation →

975

MCQmedium

Following a ransomware incident, management wants proof that the organization can actually recover from its backups before declaring the backups trustworthy. What should the security team do next?

A.Check that the backup job completed successfully during the last seven days.

B.Restore a backup into an isolated test environment and validate the result.

C.Increase the backup retention period to reduce the chance of future loss.

D.Compress the backup files further so they take up less storage.

AnswerB

Restoring a backup into an isolated test environment provides direct, empirical proof that the backup data can be successfully recovered and that the restored systems are functional. This validates backup integrity, the restore process, and whether the data meets recovery point and recovery time objectives, all without risking production systems. It is the only way to demonstrate with confidence that the organization can actually recover from the ransomware attack.

Why this answer

The only way to prove that backups are trustworthy after a ransomware incident is to perform a full restoration into an isolated test environment and validate the integrity, completeness, and functionality of the recovered data. Simply checking that backup jobs completed successfully (Option A) does not verify that the backup data is uncorrupted, free from ransomware, or restorable in a real scenario. A controlled restore test provides tangible evidence that the recovery process works and the data is usable, which is the core requirement of management’s request for proof of recoverability.

Exam trap

The trap here is that candidates often confuse backup completion success with backup recoverability, assuming that a successful backup job log is sufficient proof, when in reality only a full restore test in an isolated environment can validate that the data is usable and free from corruption or ransomware payloads.

How to eliminate wrong answers

Option A is wrong because verifying that a backup job completed successfully only confirms that the backup process ran without errors; it does not validate that the backup data is intact, free from encryption by ransomware, or restorable to a usable state. Option C is wrong because increasing the backup retention period only retains more historical copies of data, but does not test or prove that any of those backups can actually be recovered successfully. Option D is wrong because compressing backup files further reduces storage usage but does not test the recoverability of the data; in fact, excessive compression could introduce corruption or increase restore time without providing any validation of backup trustworthiness.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 901–975