Security+ SY0-701 SY0-701 Questions 151–225 | Page 3/14

151

MCQeasy

After installing a free utility from an unofficial website, a user's laptop starts quietly sending browsing data to an unknown server. What type of malware is most likely present?

A.Spyware

B.Ransomware

C.Worm

D.Rootkit

AnswerA

Spyware is a type of malicious software that covertly monitors user activity and transmits that information to a remote attacker. In this scenario, quietly harvesting browsing data is a hallmark behavior of spyware, which often arrives bundled with free utilities from unofficial sources. Unlike outright destructive malware, spyware focuses on data exfiltration and typically operates in the background without the user's knowledge, making it the best match for the described symptoms.

Why this answer

Spyware is designed to covertly collect user data, such as browsing habits, and transmit it to a remote server without consent. The scenario describes a free utility from an unofficial website that quietly exfiltrates browsing data, which is the classic behavior of spyware. Unlike other malware types, spyware focuses on surveillance and data theft rather than system damage or self-replication.

Exam trap

The trap here is that candidates may confuse spyware with a rootkit because both can operate stealthily, but the key differentiator is the primary objective: spyware focuses on data theft, while a rootkit focuses on hiding other malware or maintaining persistent access.

How to eliminate wrong answers

Option B is wrong because ransomware encrypts files or locks the system to demand a ransom, not to quietly exfiltrate browsing data. Option C is wrong because a worm self-replicates across networks without user interaction, whereas this infection required manual installation of a utility. Option D is wrong because a rootkit hides its presence by subverting OS-level functions (e.g., hooking system calls), but the described symptom—data exfiltration—is not the defining trait; spyware is the more direct classification for data theft.

Full explanation →

152

MCQmedium

After three months of phishing awareness training, the security team wants a metric that best shows whether employees are becoming harder to trick. Which metric is MOST useful?

A.The total number of phishing simulation emails sent to employees.

B.The percentage of users who report suspicious messages before clicking links.

C.The number of new usernames created in the email system.

D.The average screen resolution used by employees during the campaign.

AnswerB

Reporting rate is a strong indicator of awareness and response behavior because it measures whether employees recognize and escalate suspicious emails instead of interacting with them. A higher reporting rate generally shows improved vigilance and faster detection, which is more valuable than simply counting how many simulated messages were delivered.

Why this answer

The percentage of users who report suspicious messages before clicking links directly measures the effectiveness of phishing awareness training in changing user behavior. A higher reporting rate indicates that employees are recognizing phishing indicators and using the reporting mechanism (e.g., an integrated phishing report button or email forwarding to a security mailbox) instead of falling for the trick. This metric focuses on the desired outcome—reducing successful phishing—rather than activity volume.

Exam trap

CompTIA often tests the distinction between activity metrics (e.g., number of emails sent) and outcome metrics (e.g., reporting rate), and the trap here is assuming that more training or more simulations automatically means better security, when the real measure is behavioral change.

How to eliminate wrong answers

Option A is wrong because the total number of phishing simulation emails sent is a measure of campaign scale, not employee susceptibility; sending more simulations does not indicate whether users are harder to trick. Option C is wrong because the number of new usernames created in the email system is unrelated to phishing awareness; it reflects account provisioning or turnover, not security behavior. Option D is wrong because average screen resolution has no bearing on phishing detection; it is a display setting with no connection to email security or user vigilance.

Full explanation →

153

MCQmedium

An external auditor asks for proof that firewall rule changes were reviewed and approved before being implemented during the last quarter. Which evidence is MOST appropriate to provide?

A.A screenshot of the firewall management homepage showing that the system is online.

B.Change tickets showing requester, reviewer approval, implementation date, and rollback plan.

C.An email from the network team stating they remember reviewing the changes.

D.A list of the firewall vendor's product features from the company website.

AnswerB

Change tickets are strong audit evidence because they show who requested the change, who approved it, when it was implemented, and how the organization planned to reverse it if needed. That level of documentation demonstrates governance, traceability, and control over configuration changes, which is exactly what an auditor is trying to verify.

Why this answer

Change tickets provide a formal, auditable record of the entire change management process, including requester identification, reviewer approval, implementation date, and rollback plan. This directly satisfies the auditor's requirement for proof that firewall rule changes were reviewed and approved before implementation, aligning with the principle of separation of duties and change control.

Exam trap

The trap here is that candidates may choose Option C, mistakenly believing that a verbal or informal email confirmation is sufficient evidence, when auditors require documented, formal approval records with a clear audit trail.

How to eliminate wrong answers

Option A is wrong because a screenshot of the firewall management homepage showing the system is online only proves the firewall is operational, not that specific rule changes were reviewed and approved. Option C is wrong because an email from the network team stating they remember reviewing the changes is anecdotal and lacks the formal, timestamped, and auditable evidence required for compliance. Option D is wrong because a list of the firewall vendor's product features from the company website is irrelevant to the change management process and provides no evidence of review or approval.

Full explanation →

154

MCQmedium

A company wants employees to use one corporate login for multiple SaaS applications, require MFA when users sign in from unmanaged devices, and centralize account lifecycle management. Which design best meets these requirements?

A.Create separate local usernames and passwords in each SaaS application.

B.Use shared accounts for each department and keep one password vault for the team.

C.Implement federated single sign-on through a central identity provider with MFA and conditional access policies.

D.Require all users to connect through a VPN before any SaaS login and remove identity federation.

AnswerC

Federated SSO lets the identity provider authenticate users once and pass trusted assertions to multiple SaaS apps. MFA can be enforced centrally, and conditional access can require additional controls based on device trust or location. This also simplifies account creation, removal, and policy management.

Why this answer

Federated single sign-on (SSO) through a central identity provider (IdP) like Azure AD or Okta allows employees to use one corporate login across multiple SaaS applications via protocols such as SAML 2.0 or OIDC. The IdP enforces MFA for unmanaged devices through conditional access policies (e.g., device compliance checks) and centralizes account lifecycle management by provisioning/deprovisioning users from a single directory (e.g., LDAP or SCIM).

Exam trap

The trap here is that candidates may confuse 'shared accounts' (Option B) with SSO, not realizing that shared accounts lack individual accountability and cannot enforce per-user MFA or conditional access policies.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and passwords in each SaaS application violates the requirement for a single corporate login, does not enforce MFA based on device trust, and fragments account lifecycle management across silos. Option B is wrong because shared accounts for each department break non-repudiation and audit trails, password vaults do not provide SSO or conditional access, and they fail to centralize lifecycle management per user.

Full explanation →

155

MCQeasy

A project team needs to use a temporary file-sharing service for two weeks because the approved platform is under maintenance. The security manager wants the exception to be reviewed, time-limited, and documented with the business reason. Which governance document should be created?

A.A guideline, because it provides optional best practices for users to follow.

B.An exception request, because it records a deviation from the normal security requirement.

C.A standard, because it defines the mandatory company-wide rule for file sharing.

D.A procedure, because it gives step-by-step instructions for employees to follow.

AnswerB

An exception request documents a specific deviation from policy or standard, including the business justification, approval path, and expiration date. That is exactly what is needed when a team must temporarily use an alternative service. It keeps the deviation visible, reviewed, and accountable instead of silently bypassing security controls.

Why this answer

An exception request is the formal governance document used to record, review, and time-limit a deviation from the organization's security baseline. In this scenario, the temporary use of an unapproved file-sharing service for two weeks requires documented authorization, including the business reason, to ensure the risk is accepted and tracked until the approved platform returns.

Exam trap

The trap here is that candidates confuse an exception request with a standard or procedure, thinking any documented change to security controls requires a new policy document, rather than recognizing that an exception is a temporary, authorized waiver of an existing rule.

How to eliminate wrong answers

Option A is wrong because a guideline offers optional best practices, not a mechanism to formally authorize a temporary deviation from a mandatory security requirement. Option C is wrong because a standard defines a mandatory company-wide rule; creating a new standard would permanently change the policy rather than document a time-limited exception. Option D is wrong because a procedure provides step-by-step instructions for routine tasks, not a record of a specific, temporary deviation from approved tools.

Full explanation →

156

MCQhard

An analyst on the HR application team needs access to a production database replica only long enough to verify a column-mapping issue. The analyst should not be able to browse salary fields, export tables, or keep access after the task ends. Which principle best matches the desired access model?

A.Least privilege

B.Need-to-know

C.Separation of duties

D.Defense in depth

AnswerB

The analyst only needs a narrow slice of information for a specific task and should not be able to see unrelated sensitive fields. That is need-to-know. It focuses on limiting data visibility to what is required for the assignment. Least privilege is related, but the clue about salary fields and specific data exposure makes need-to-know the best answer.

Why this answer

The need-to-know principle restricts access to only the information required to perform a specific task. In this scenario, the analyst needs access to verify a column-mapping issue but must not see salary fields, export tables, or retain access afterward. Need-to-know ensures access is limited to the exact data and duration necessary, which aligns with granting temporary, scoped access to a production database replica without broader data exposure.

Exam trap

The trap here is confusing least privilege with need-to-know: least privilege limits permissions (e.g., read-only vs. write), while need-to-know limits the specific data content (e.g., excluding salary fields) and duration, which is the precise requirement in this question.

How to eliminate wrong answers

Option A is wrong because least privilege limits access rights to the minimum necessary to perform a job function, but it does not inherently restrict access to specific data fields (like salary) or enforce time-bound access; it focuses on permissions, not data scope. Option C is wrong because separation of duties divides critical tasks among multiple individuals to prevent fraud or error, but this scenario involves a single analyst needing temporary access, not splitting responsibilities. Option D is wrong because defense in depth is a layered security strategy using multiple controls (e.g., firewalls, encryption, IDS), not a model for granular, task-specific data access.

Full explanation →

157

MCQeasy

A security team wants to know whether a workstation has drifted away from the approved hardened configuration after several months of changes. What should they use to compare the current state against the approved setup?

A.A file compression tool

B.A configuration baseline

C.A password vault

D.A network cable tester

AnswerB

A configuration baseline is a documented set of security and operational settings that define the approved, secure state for a system, such as CIS benchmarks or organizational hardening guidelines. Drift detection works by regularly collecting the current configuration (e.g., via agent or assessment tool) and comparing it to this baseline, flagging any differences as non-compliance. This baseline serves as the authoritative reference point, enabling automated or manual identification of unauthorized or unintended changes. Hence, a configuration baseline is the correct tool for detecting drift.

Why this answer

A configuration baseline is the approved hardened state of a system, typically captured as a snapshot of settings, registry keys, file permissions, and installed software. By comparing the current workstation state against this baseline using tools like Microsoft Security Compliance Toolkit or CIS-CAT, the team can detect drift—unauthorized changes that deviate from the secure configuration. This is the standard method for maintaining compliance and security posture over time.

Exam trap

The trap here is that candidates confuse a configuration baseline with a backup or recovery tool, thinking a file compression tool could somehow 'compare' states, when in fact baselines are specifically designed for compliance drift analysis.

How to eliminate wrong answers

Option A is wrong because a file compression tool (e.g., WinRAR, gzip) only reduces file size for storage or transfer; it cannot compare system configurations or detect drift from a security baseline. Option C is wrong because a password vault (e.g., KeePass, LastPass) securely stores credentials but has no capability to assess system hardening or compare configuration states.

Full explanation →

158

MCQmedium

A caller claims to be from the company's SaaS provider and says a tenant migration will fail unless the help desk reads back a one-time verification code sent to an administrator's phone. The caller knows the admin's name and ticket number. What attack technique is being used?

A.Pretexting, because the attacker is inventing a believable support story to gain trust.

B.Watering hole, because the attacker is targeting a trusted web service used by employees.

C.Tailgating, because the attacker is attempting to bypass a physical security barrier.

D.Whaling, because the attacker is targeting a high-value executive account directly.

AnswerA

The attacker is using a fabricated identity and a credible business scenario to manipulate the help desk into revealing a verification code. That is classic pretexting. The known name and ticket number are used to increase legitimacy, but the key behavior is the false story intended to bypass normal trust checks.

Why this answer

The attacker is using pretexting by fabricating a plausible scenario (a tenant migration requiring a verification code) to manipulate the help desk into divulging sensitive information. This social engineering technique relies on building false trust through invented details like the admin's name and ticket number, rather than exploiting technical vulnerabilities. The goal is to obtain the one-time verification code, which could be used for unauthorized access or account takeover.

Exam trap

The trap here is that candidates may confuse pretexting with whaling because both involve impersonation, but whaling targets high-level executives directly, while pretexting uses a fabricated scenario to trick any employee into performing an action or revealing information.

How to eliminate wrong answers

Option B is wrong because a watering hole attack involves compromising a website or service that the target group frequently uses to infect them with malware, not a direct phone call requesting information. Option C is wrong because tailgating is a physical security attack where an unauthorized person follows an authorized individual into a restricted area, not a remote social engineering attempt. Option D is wrong because whaling specifically targets high-profile executives (like CEOs) with personalized phishing, whereas this attack targets a help desk employee using a fabricated support story, not a direct executive account compromise.

Full explanation →

159

Multi-Selectmedium

Which three of the following are commonly used to enforce separation of duties? (Choose three.)

Select 3 answers

.Requiring two different people to authorize a financial transaction

.Splitting the ability to create user accounts and assign privileges to different roles

.Using a dual-control process where two keys are needed to access a safe

.Allowing a single administrator to both approve and implement system changes

.Giving one person full responsibility for both IT security audits and daily operations

.Configuring a single user to manage both backup and restoration of data

Why this answer

Separation of duties is a security principle that prevents any single individual from having excessive control over critical processes. Requiring two different people to authorize a financial transaction ensures that no one person can both initiate and approve a payment, reducing fraud risk. Splitting the ability to create user accounts and assign privileges to different roles ensures that a single administrator cannot grant themselves unauthorized access.

Using a dual-control process where two keys are needed to access a safe physically enforces that two people must be present, preventing unilateral access to sensitive assets.

Exam trap

The trap here is that candidates may confuse separation of duties with least privilege or fail to recognize that combining authorization and implementation in one role is a direct violation, even if it seems efficient.

Full explanation →

160

Multi-Selectmedium

A SaaS vendor hosts a customer relationship platform for multiple organizations. Your company wants to know which two responsibilities typically remain with the customer rather than the SaaS provider. Select two.

Select 2 answers

A.Assigning user roles and approving access within the tenant.

B.Protecting the organization's data classification and sharing rules.

C.Patching the provider's underlying database engine.

D.Maintaining the vendor's physical data center power and cooling.

E.Replacing the provider's hypervisors during maintenance windows.

AnswersA, B

Customer organizations usually remain responsible for deciding who gets access and what role each user receives inside the SaaS tenant. The provider supplies the platform, but the customer controls business authorization decisions. This is a core shared responsibility item because access mistakes often come from tenant configuration rather than provider infrastructure.

Why this answer

In a SaaS model, the customer retains administrative control over user identities, roles, and access permissions within their own tenant. The SaaS provider manages the underlying application and infrastructure, but the customer must configure role-based access control (RBAC) to enforce least privilege and approve access requests. This aligns with the shared responsibility model where identity and access management (IAM) at the application layer falls to the customer.

Exam trap

The trap here is that candidates often confuse infrastructure maintenance tasks (like patching databases or replacing hypervisors) with customer responsibilities, but in SaaS, the provider handles all underlying infrastructure while the customer only manages tenant-specific configurations and data governance.

Full explanation →

161

MCQmedium

A SIEM alert shows 300 failed logins against the same VPN account from one source IP over 12 minutes, followed by a successful login from that same IP and a spike in mailbox access. The user says they did not initiate the session. What is the most likely cause?

A.A brute-force attack that eventually guessed the correct password

B.A password-spraying attempt against many different accounts

C.A normal VPN reconnect after a brief network outage

D.A false positive caused by email synchronization

AnswerA

The sequence of hundreds of failed authentication attempts against a single VPN account, followed by a successful login and immediate anomalous mailbox activity, is the classic signature of an online brute-force attack. Automated tools iterate through password lists or character combinations until one succeeds; after gaining access, the attacker exfiltrates or reads mail. The correlation of failure count, success, and post-authentication behavior confirms the credentials were compromised.

Why this answer

The sequence of 300 failed logins from a single source IP against one VPN account, followed by a successful login and abnormal mailbox access, is the classic pattern of a brute-force attack. The attacker systematically tried many passwords until they guessed the correct one, then used the compromised credentials to access the user's mailbox. The user's denial confirms the session was unauthorized, ruling out legitimate reconnection or synchronization.

Exam trap

The trap here is that candidates may confuse a brute-force attack with password spraying, but the key differentiator is the single target account versus many accounts, and the high volume of failures against that one account.

How to eliminate wrong answers

Option B is wrong because password spraying targets many different accounts with a few common passwords, not 300 attempts against a single account. Option C is wrong because a normal VPN reconnect after a brief network outage would not generate 300 failed logins; it would typically succeed on the first or second attempt after the outage resolves. Option D is wrong because email synchronization does not cause failed logins against a VPN account; it uses existing authenticated sessions and would not produce a spike in mailbox access from a new IP.

Full explanation →

162

Multi-Selectmedium

After restoring a virtual file server from backup, users can log in and browse shares, but finance says the last day's edits are missing. Which two steps should the administrator take before declaring recovery complete? Select two.

Select 2 answers

A.Verify the restore point meets the required recovery point objective and the business expects the data loss window.

B.Check whether application transaction logs or application-consistent snapshots need to be replayed.

C.Rebuild the server from scratch without checking the backup timestamp.

D.Disable all backup jobs until the next maintenance window.

E.Change the DNS records so users point to a different server name.

AnswersA, B

This is important because a restore can technically succeed while still missing more data than the business can tolerate. The RPO defines how much data loss is acceptable. Confirming the restore point against that expectation helps determine whether the backup strategy met recovery requirements or whether additional recovery work is needed.

Why this answer

The Recovery Point Objective (RPO) defines the maximum acceptable data loss. If the restore point is from before the last day's edits, the administrator must confirm that this data loss window is acceptable to the business. Option B is correct because application-consistent backups often require replaying transaction logs (e.g., SQL Server VSS writer logs) to bring the database to the latest committed state; skipping this step leaves the data incomplete.

Exam trap

The trap here is that candidates may assume a successful file-level restore is complete, overlooking the need to verify RPO alignment and replay application-specific transaction logs for consistency.

Full explanation →

163

MCQhard

A supplier portal is browser-based and used by external partner companies. Each partner already has its own identity provider. The portal must trust assertions from those IdPs and avoid creating separate local passwords for each partner. Which integration is best?

A.Use LDAP directory synchronization for all partner users.

B.Use SAML 2.0 federation with trust relationships to the partner identity providers.

C.Use NTLM pass-through authentication to each partner account.

D.Use PAP over TLS so the portal can collect partner passwords securely.

AnswerB

SAML 2.0 federation establishes explicit trust relationships between the portal as a service provider and each partner identity provider through exchanged metadata and signing certificates. Users authenticate at their own IdP, which sends a digitally signed SAML assertion to the portal via browser redirects, enabling SSO without sharing passwords. This is the standard for cross-organization web single sign-on and directly satisfies the requirement for external partner browser access.

Why this answer

SAML 2.0 federation is the correct choice because it enables the supplier portal to trust assertions from multiple external identity providers (IdPs) without creating local passwords. SAML uses XML-based tokens signed by the partner's IdP, allowing the portal to accept authentication claims via a trust relationship, which directly meets the requirement of avoiding separate local credentials for each partner.

Exam trap

The trap here is that candidates may confuse LDAP synchronization (which replicates accounts) with federation (which avoids storing accounts), or mistakenly think NTLM can be extended across organizational boundaries, when in fact NTLM is a legacy challenge-response protocol limited to a single Windows domain.

How to eliminate wrong answers

Option A is wrong because LDAP directory synchronization would require the supplier to replicate partner user directories into a local LDAP store, which still creates local accounts and passwords, violating the requirement to avoid separate local passwords. Option C is wrong because NTLM pass-through authentication is a Windows-specific protocol designed for on-premises Active Directory environments and cannot be used to federate with external partner identity providers over the internet.

Full explanation →

164

MCQmedium

A company is evaluating a new payroll SaaS provider that will store employee tax and bank details. Before signing the contract, which action BEST supports vendor due diligence?

A.Ask the vendor for a marketing brochure describing platform features and uptime claims.

B.Review a current independent security attestation and verify contractual security obligations.

C.Accept the vendor’s assurance that its customers have never experienced incidents.

D.Wait until after go-live and then review the security posture during the first annual audit.

AnswerB

Independent assurance reports, such as a recent SOC 2 Type II, help show whether the vendor’s controls were operating over time, and contract terms can require breach notification, data handling, and security responsibilities. Together, these steps give the organization evidence-based due diligence before sensitive payroll data is entrusted to the provider.

Why this answer

Vendor due diligence for a SaaS provider handling sensitive employee data (tax and bank details) requires verifying independent security attestations (e.g., SOC 2 Type II, ISO 27001 certification) and ensuring contractual security obligations (e.g., data encryption, breach notification, right to audit) are explicitly defined. This provides objective, audited evidence of the vendor's security posture rather than relying on marketing claims or unverified assurances.

Exam trap

The trap here is that candidates may choose Option A because marketing brochures appear to provide relevant information, but they fail to recognize that due diligence requires objective, third-party verified evidence rather than vendor-provided promotional materials.

How to eliminate wrong answers

Option A is wrong because a marketing brochure is a promotional document that may contain exaggerated uptime claims and lacks independent verification of security controls; it does not provide audited evidence of data protection practices. Option C is wrong because accepting a vendor's assurance that its customers have never experienced incidents is an unverifiable, self-serving statement that ignores the possibility of undisclosed breaches or the lack of incident detection capabilities; it does not constitute due diligence.

Full explanation →

165

MCQmedium

A team hosts a confidential document repository on an IaaS virtual machine. The provider secures the datacenter, hardware, and hypervisor. The organization wants to control who can decrypt the files and be able to revoke that access without changing providers. Which control is best?

A.Use the provider's default managed encryption keys for the storage service.

B.Rely on security groups and network ACLs to protect the document contents.

C.Use customer-managed encryption keys in the cloud KMS or HSM.

D.Enable automated snapshots so deleted files can be restored later.

AnswerC

Customer-managed encryption keys in a cloud KMS or HSM give the organization direct control over key rotation, revocation, and usage policies. When a key is revoked, the ciphertext remains but is effectively undecryptable, enabling crypto-shredding and independent revocation even if the provider's infrastructure is compromised. The provider performs cryptographic operations but does not own or solely govern the key material, strengthening separation of duties and meeting compliance requirements for confidential repositories. This is the correct control for enforcing that only the organization can grant or deny access to the document contents.

Why this answer

Customer-managed encryption keys (CMEK) in a cloud KMS or HSM allow the organization to retain control over key material, enabling them to decrypt files and revoke access independently of the cloud provider. This meets the requirement to control decryption and revocation without changing providers, as the provider cannot access the keys. In contrast, provider-managed keys do not offer the same level of tenant-controlled revocation.

Exam trap

The trap here is that candidates often confuse network access controls (security groups/ACLs) with encryption-based access control, failing to recognize that only cryptographic controls can enforce decryption revocation independently of the provider.

How to eliminate wrong answers

Option A is wrong because provider-managed default encryption keys give the organization no ability to independently revoke access to the encrypted files; the provider retains control over the key lifecycle. Option B is wrong because security groups and network ACLs are network-layer controls that protect access to the VM but do not encrypt the document contents or control decryption; they cannot enforce file-level decryption revocation. Option D is wrong because automated snapshots provide backup and recovery capabilities but do not control decryption or enable revocation of access to encrypted files.

Full explanation →

166

Multi-Selecteasy

A team is moving a workload to infrastructure as a service (IaaS). Which two items are usually the customer's responsibility? Select two.

Select 2 answers

A.Patch the guest operating system running on the cloud virtual machine.

B.Replace failed power supplies in the cloud provider's data center.

C.Configure the application's user permissions and access settings.

D.Maintain the cloud provider's hypervisor firmware.

E.Manage the physical firewall blades inside the provider's facility.

AnswersA, C

In IaaS, the customer retains responsibility for the guest OS, including applying security patches and kernel updates, because the cloud provider only delivers virtualized compute resources rather than a managed platform. Unpatched guest OSes are a leading exploitation vector, as known CVEs in services like SSH or web servers can be trivially attacked from the network. The provider manages the host and hypervisor, but not the OS running inside the VM, so patching is squarely on the customer.

Why this answer

In an IaaS model, the customer is responsible for managing the guest operating system, including applying security patches and updates. This is because the cloud provider only manages the underlying physical infrastructure and hypervisor, while the customer controls the OS and applications running on the virtual machine.

Exam trap

The trap here is that candidates often confuse IaaS with PaaS or SaaS, mistakenly thinking the provider handles all OS-level patching, but in IaaS, the customer retains full control and responsibility for the guest OS and application configuration.

Full explanation →

167

MCQmedium

An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?

A.Place all three servers on the same private subnet and control access only with strong passwords.

B.Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.

C.Put the database in the public zone so the web tier can query it directly from the internet.

D.Use a single reverse proxy for all three servers and disable network segmentation to simplify management.

AnswerB

This tiered placement supports a classic defense-in-depth design. The web server is internet-facing, the application tier is not directly exposed, and the database is placed in the most restricted zone. Network rules then allow only the necessary north-south and east-west traffic between tiers.

Why this answer

It implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.

Exam trap

The trap here is that candidates often confuse 'private subnet' with 'security' and fail to recognize that without network segmentation, a single compromised server can lead to full lateral access, or they mistakenly think placing the database in a public zone is acceptable for direct queries.

How to eliminate wrong answers

Option A is wrong because placing all three servers on the same private subnet with only strong passwords fails to provide network segmentation; if the web server is compromised, an attacker can directly access the application and database servers without any network-level barriers. Option C is wrong because placing the database in the public zone exposes it directly to the internet, violating the requirement that the database server can only be reached by the application tier and creating a severe security risk. Option D is wrong because using a single reverse proxy for all three servers and disabling network segmentation eliminates the isolation between tiers, allowing an attacker who compromises the proxy to reach all servers directly, contradicting the design requirement.

Full explanation →

168

Multi-Selecteasy

A developer finds a critical bug in a customer portal on Friday afternoon. The fix must be released quickly, but the team needs a way to reverse the change if testing reveals a problem and wants the release to follow the normal approval process. Which two practices should be used? Select two.

Select 2 answers

A.Deploy the fix directly to production without approval

B.Create a documented rollback plan

C.Skip testing to meet the deadline

D.Follow the normal change approval and testing process

E.Rename the release package to reduce risk

AnswersB, D

A documented rollback plan identifies the exact steps to restore the previously known-good version if the hotfix performs poorly, including database rollback procedures, configuration file reversions, and responsible personnel. It also specifies the verification criteria that indicate whether rollback is needed and the decision authority to trigger it. This plan directly reduces downtime and risk, which is why it is the most appropriate immediate action.

Why this answer

A documented rollback plan ensures that if the emergency fix introduces new issues during testing, the team can quickly and safely revert to the previous stable state. This aligns with the principle of change management, which requires a recovery procedure for any emergency change to minimize downtime and risk.

Exam trap

The trap here is that candidates may assume speed is the only priority in an emergency fix, overlooking the requirement for a controlled reversal mechanism and the need to follow the normal approval process even under time pressure.

Full explanation →

169

MCQmedium

A help desk analyst can reset passwords in the ticketing portal but cannot view payroll records, edit user profiles, or access other HR functions. Which security principle is the organization applying?

A.Least privilege

B.Defense in depth

C.Separation of duties

D.Zero trust

AnswerA

Least privilege grants users only the access needed for their duties, so the analyst resets passwords without viewing payroll records, editing profiles, or reaching other HR functions. This directly satisfies the stem's constraint of restricting permissions beyond the ticketing portal's password-reset capability.

Why this answer

The help desk analyst is granted only the permissions necessary to perform their job function—resetting passwords—while all other HR functions are explicitly denied. This is the core definition of least privilege: each user or system component receives the minimum set of access rights needed to complete their tasks. By restricting the analyst’s account to password reset operations only, the organization reduces the attack surface and limits potential damage from compromised credentials or insider misuse.

Exam trap

The trap here is that candidates often confuse 'least privilege' with 'separation of duties' because both involve restricting access, but separation of duties specifically requires dividing a single sensitive process among multiple people, whereas least privilege simply limits the scope of permissions for any one person or process.

How to eliminate wrong answers

Option B (Defense in depth) is wrong because that principle involves layering multiple independent security controls (e.g., firewall, IDS, encryption) to protect assets, not restricting individual user permissions. Option C (Separation of duties) is wrong because that principle requires splitting critical tasks among multiple people to prevent fraud (e.g., one person requests a purchase, another approves it), whereas this scenario is about limiting a single user’s access scope. Option D (Zero trust) is wrong because zero trust is a broader architectural model that assumes no implicit trust and continuously verifies every request regardless of origin, not simply a policy of assigning minimal permissions to a help desk role.

Full explanation →

170

MCQmedium

A security analyst notices that several employees have received an email with the subject line 'Urgent: Password Reset Required'. The email contains a link to a website that mimics the company's internal login portal. The email was sent from an external domain and addresses recipients by 'Dear Employee' rather than their actual names. Which type of social engineering attack is being described?

A.Spear phishing

B.Phishing

C.Vishing

D.Tailgating

AnswerB

Phishing is a broad social engineering technique that uses mass emails to trick users into divulging credentials or clicking malicious links. The generic greeting and external sender domain are consistent with a typical phishing attempt.

Why this answer

The email is sent to multiple employees, uses a generic greeting ('Dear Employee'), and originates from an external domain, which are hallmarks of a broad, untargeted phishing campaign. Spear phishing would involve personalized details (e.g., the recipient's actual name) and targeting specific individuals. Vishing is voice-based, not email.

Therefore, this is a standard phishing attack.

Exam trap

The trap here is that candidates confuse 'phishing' with 'spear phishing' because both use email and fake login pages, but the key differentiator is the level of personalization—generic vs. targeted—which the 'Dear Employee' greeting explicitly reveals.

Why the other options are wrong

The email is not personalized (uses 'Dear Employee') and targets a broad audience, not a specific individual or group, which distinguishes it from spear phishing.

When would these options actually be correct?

Spear phishing would be correct if the email was personalized with the recipient's name, job title, or other specific details, and targeted a particular individual or department within the organization.

Why candidates pick the wrong answer

Candidates may confuse spear phishing with phishing because both involve deceptive emails, but spear phishing requires targeted personalization, which is absent here.

Full explanation →

171

Multi-Selecthard

During a workstation review, analysts find a process injecting into explorer.exe and reading keyboard and clipboard events. They also see repeated outbound HTTPS beacons to a domain registered two days ago. The host is not renaming files or displaying a ransom note. Which two findings are most consistent with spyware? Select two.

Select 2 answers

A.A process injects into explorer.exe and monitors keyboard and clipboard activity.

B.The host sends repeated HTTPS beacons to a domain registered two days ago.

C.User files are renamed with a new extension and a ransom note appears.

D.CPU usage spikes only during a scheduled operating system update.

E.The browser certificate store was refreshed after applying a patch.

AnswersA, B

Process injection into a user shell process combined with keyboard and clipboard monitoring is highly consistent with spyware. Those behaviors are designed to silently capture sensitive information such as credentials, messages, and copied data while blending into normal desktop activity. That stealthy information-gathering focus is a hallmark of spyware.

Why this answer

Process injection into a trusted system process like explorer.exe, combined with monitoring keyboard and clipboard events, is a classic spyware technique. Spyware aims to covertly capture sensitive user input (keystrokes and clipboard data) for exfiltration, without causing immediate system damage or displaying a ransom note.

Exam trap

The trap here is that candidates may confuse spyware with ransomware (option C) or mistake normal system maintenance (options D and E) for malicious activity, failing to recognize that spyware's defining characteristics are stealthy data capture and covert C2 communication without overt file encryption or ransom demands.

Full explanation →

172

MCQeasy

Threat intelligence shows an attacker changes the domain name every day, but the malware file hash stays the same across incidents. What should defenders prioritize for blocking?

A.The daily domain names, because they are the easiest indicator to find.

B.The malware file hash, because it remains consistent across incidents.

C.The color of the phishing email, because visual style is unique to the attacker.

D.The user's browser homepage, because attackers often change it after infection.

AnswerB

A malware file hash is a deterministic cryptographic fingerprint computed over the entire binary; a given sample will produce the same hash value unless the attacker modifies a single byte. This stability makes hashes an excellent indicator for detecting and blocking known malicious artifacts across multiple incidents, even when the attacker changes domains, IPs, or phishing lures. However, attackers can use packing or recompilation to alter a hash, so it should be used in conjunction with other indicators.

Why this answer

The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a static, deterministic value derived from the malware's binary content. Since the attacker reuses the same malware across incidents, the hash remains consistent, making it a reliable indicator of compromise (IOC) for blocking via hash-based allow/deny lists in endpoint protection or network security controls. In contrast, domain names change daily (fast flux), so blocking them is less sustainable and requires constant updates.

Exam trap

The trap here is that candidates may assume domain names are the easiest to block because they are visible in logs, but the question tests the principle of prioritizing stable, consistent indicators over ephemeral ones, and CompTIA often tests this by contrasting static hashes with dynamic domains in fast-flux scenarios.

How to eliminate wrong answers

Option A is wrong because daily domain names are volatile and require frequent updates to block lists, making them less efficient than a static hash; they are not the 'easiest' indicator to find in practice, as they often use fast-flux DNS to evade detection. Option C is wrong because the color of a phishing email is a superficial, non-unique attribute that can be easily altered by the attacker and is not a reliable technical IOC for blocking. Option D is wrong because the user's browser homepage is a post-infection artifact that varies by user and system, not a consistent attacker-controlled indicator; attackers may change it, but it is not a primary blocking target.

Full explanation →

173

MCQeasy

Paper onboarding forms have reached the end of their retention period, and no legal hold applies. What should happen next?

A.Store them indefinitely in case the company needs them later.

B.Destroy them using an approved secure disposal method.

C.Scan them to a personal cloud account so they are not lost.

D.Mail copies to every manager for review before disposal.

AnswerB

This is correct because once retention requirements are satisfied and no legal hold exists, the records should be securely destroyed. Secure disposal reduces the chance of unauthorized disclosure and supports compliance with the retention schedule. For paper records, approved shredding or other secure destruction methods are appropriate.

Why this answer

Once paper onboarding forms have reached the end of their retention period and no legal hold applies, the organization must destroy them using an approved secure disposal method (e.g., cross-cut shredding, pulping, or incineration) to prevent unauthorized access to personally identifiable information (PII) and comply with data protection regulations such as GDPR or HIPAA. Retaining data beyond its required lifecycle violates the data minimization principle and increases breach risk.

Exam trap

The trap here is that candidates may think indefinite storage (Option A) is safer or that scanning to a personal cloud (Option C) preserves data, but the exam tests that data must be destroyed when retention expires and no legal hold exists, not retained or migrated.

How to eliminate wrong answers

Option A is wrong because storing forms indefinitely violates data retention policies and regulations like GDPR's storage limitation principle, exposing the organization to unnecessary legal and security risks. Option C is wrong because scanning forms to a personal cloud account bypasses corporate data governance controls, creates an unauthorized copy of sensitive data, and likely violates data classification and access control policies. Option D is wrong because mailing copies to every manager before disposal unnecessarily proliferates sensitive data, increases the attack surface, and contradicts the principle of least privilege—only authorized personnel should handle disposal, not all managers.

Full explanation →

174

Multi-Selecthard

A development team runs multiple customer workloads in a shared Kubernetes cluster. Security wants to reduce the risk that one compromised container can read another team's data or deploy an altered image. Which three actions best improve the design? Select three.

Select 3 answers

A.Require signed, scanned images from an approved registry before deployment.

B.Run each container as root so file permissions inside the container do not block apps.

C.Use namespaces and network policies to separate the workloads by trust zone.

D.Mount the host filesystem into every pod so support staff can troubleshoot more quickly.

E.Run containers with the minimum Linux capabilities and a read-only root filesystem where possible.

AnswersA, C, E

Image signing and scanning help ensure the cluster only deploys trusted builds that have been checked for known vulnerabilities. Using an approved registry adds supply-chain control and reduces the chance of pulling tampered or unreviewed images. This directly addresses the risk of altered or unsafe container content entering production.

Why this answer

Requiring signed, scanned images from an approved registry ensures that only trusted, vulnerability-free images are deployed. Image signing (e.g., using Docker Content Trust or Notary) verifies the image's integrity and origin, preventing tampered images from being deployed. Scanning catches known vulnerabilities before runtime, reducing the attack surface.

This directly addresses the risk of deploying an altered image.

Exam trap

The trap here is that candidates often think running containers as root is necessary for app functionality, but Kubernetes security best practices (and the CIS Benchmark for Kubernetes) explicitly require running containers with non-root users and read-only root filesystems to limit damage from a compromise.

Full explanation →

175

MCQmedium

A security architect is designing the wireless network for a new branch office. The branch will have two types of users: employees who need access to internal corporate resources, and guests who need internet-only access. The architect plans to use WPA3-Enterprise for the employee SSID and WPA3-SAE for the guest SSID. Which of the following additional configurations is MOST critical to prevent guests from accessing internal corporate resources?

A.Implement MAC address filtering on the guest SSID to allow only authorized guest devices.

B.Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.

C.Disable SSID broadcast for the guest network to make it less discoverable.

D.Require guests to accept a captive portal agreement before gaining internet access.

AnswerB

This is the most critical control because it enforces network segmentation at Layer 3: the guest VLAN has its own IP subnet and routing context, and the firewall rule explicitly denies any inbound traffic from the guest VLAN to the corporate VLAN. This prevents a guest device from directly reaching internal resources even if the wireless password is shared or compromised, because all inter-VLAN traffic must traverse the firewall, where the policy is enforced. Additionally, the guest VLAN can be configured with a default route only to the internet, typically via NAT, so guests get connectivity while the corporate network remains logically invisible and unreachable from the guest segment.

Why this answer

The most critical configuration is to isolate the guest network from the corporate network. Placing the guest SSID on a separate VLAN and implementing a firewall rule that blocks inbound traffic from the guest VLAN to the corporate VLAN ensures that even if a guest device is compromised or malicious, it cannot initiate connections to internal corporate resources. This leverages network segmentation and access control lists (ACLs) to enforce the principle of least privilege.

Exam trap

The trap here is that candidates focus on wireless security protocols (WPA3-SAE vs. Enterprise) or SSID hiding, but the exam tests the understanding that network segmentation and firewall rules are the critical controls for preventing unauthorized access between different trust zones, regardless of the wireless encryption method used.

Why the other options are wrong

MAC address filtering does not prevent guests from accessing internal resources; it only controls which devices can connect to the guest SSID. Once connected, guests could still reach corporate resources if network segmentation is not enforced.

Disabling SSID broadcast does not prevent guests from accessing internal resources; it only hides the network name from passive scans, which is a weak security measure easily bypassed.

A captive portal agreement only provides legal consent and does not enforce network segmentation; guests could still access corporate resources if they are on the same VLAN or subnet.

When would these options actually be correct?

A question asks for the best method to prevent unauthorized devices from connecting to a guest network, where the primary concern is device authentication rather than network segmentation. For example, a small office with a flat network where guest and employee traffic are not separated.

In a scenario where the goal is to reduce the visibility of a sensitive network to casual users or to comply with a policy that requires non-broadcast SSIDs for certain networks, disabling SSID broadcast would be the correct choice.

In a scenario where the question asks for the best method to enforce acceptable use policy or obtain legal consent for internet access, such as in a hotel or public Wi-Fi, requiring a captive portal agreement would be correct.

Why candidates pick the wrong answer

Candidates may think MAC filtering provides strong access control, but they overlook that it does not address network-layer isolation between guest and corporate networks.

Candidates may think that hiding the SSID adds a layer of security by making the network less discoverable, confusing obscurity with access control.

Candidates may mistakenly believe that a captive portal provides security by restricting access, but it only controls initial access and does not prevent lateral movement within the network.

Full explanation →

176

MCQmedium

Finance staff receive an email from the 'CFO' using a lookalike domain. The message requests an urgent gift-card purchase, says the recipient must keep it confidential, and pressures them to skip normal approval steps. What attack is this most likely?

A.Watering-hole attack targeting employees through a compromised website.

B.Smishing attempt delivered through a text message to a mobile phone.

C.Business email compromise using executive impersonation and urgency.

D.Credential stuffing against the CFO's mailbox using previously leaked passwords.

AnswerC

The attacker is impersonating a senior leader, using a lookalike domain, and pressuring the target to bypass normal controls. That combination is typical of business email compromise and executive impersonation. The request for secrecy and urgency is designed to defeat verification and approval workflows, which makes this attack especially effective in finance-related fraud attempts.

Why this answer

This scenario describes a business email compromise (BEC) attack where the threat actor impersonates an executive (the CFO) using a lookalike domain to trick a finance employee into making an unauthorized gift-card purchase. The use of urgency, confidentiality, and pressure to bypass normal approval processes are classic BEC social engineering tactics, not technical exploits.

Exam trap

The trap here is that candidates may confuse BEC with credential stuffing (option D) because both involve email accounts, but BEC relies on social engineering to trick the recipient into taking action, not on stealing credentials to access the CFO's mailbox.

How to eliminate wrong answers

Option A is wrong because a watering-hole attack involves compromising a website that the target group frequently visits to deliver malware, not sending a direct email impersonating an executive. Option B is wrong because smishing is a phishing attack delivered via SMS/text messages, not email; this scenario explicitly describes an email from a lookalike domain. Option D is wrong because credential stuffing uses previously leaked usernames and passwords to gain unauthorized access to an account, not social engineering via email to request a gift-card purchase.

Full explanation →

177

MCQmedium

A security analyst discovers that a critical internal payroll application has no vendor-supported patch for a recently announced remote code execution vulnerability. The application must remain available for at least six months until a replacement is deployed. Management asks the security team to recommend the most appropriate risk response. Which risk response should the analyst recommend?

A.Risk transference

B.Risk acceptance

C.Risk mitigation

D.Risk avoidance

AnswerB

Risk acceptance is appropriate because the organization acknowledges the vulnerability but continues operating the application due to business necessity and a planned future replacement. The risk is formally documented, approved by management, and monitored, which aligns with the definition of acceptance. Other responses like mitigation or transfer are not feasible without a patch or compensating control, and avoidance would disrupt critical payroll operations.

Why this answer

The correct response is risk acceptance because the organization cannot patch the application, must keep it running, and has a planned replacement. Formally accepting the risk with management approval and monitoring is the pragmatic choice. Mitigation, transference, and avoidance are either infeasible or would cause unacceptable business disruption.

The key is to recognize that acceptance is a valid strategy when other options are exhausted or impractical.

Exam trap

The trap here is assuming that any vulnerability must be mitigated immediately, overlooking that acceptance is a legitimate risk response when business constraints prevent other actions.

Full explanation →

178

Multi-Selectmedium

A company wants employees to sign in once to several SaaS apps, while the security team also wants to require extra verification when users sign in from unmanaged devices or unusual locations. Which two architecture changes best satisfy both requirements? Select two.

Select 2 answers

A.Federate authentication to a central identity provider.

B.Enable conditional access policies based on device posture and sign-in risk.

C.Create separate passwords for each SaaS app so compromise is contained.

D.Turn off MFA because single sign-on already reduces logins.

E.Use shared generic accounts for contractors to simplify onboarding.

AnswersA, B

Federation allows the organization to centralize authentication and give users a single identity across multiple SaaS applications. That is the architectural foundation for single sign-on because the SaaS apps trust the central identity provider instead of storing separate credentials. It also makes access governance easier because one identity system can enforce stronger controls and lifecycle management.

Why this answer

Federating authentication to a central identity provider (IdP) enables single sign-on (SSO) across multiple SaaS apps using standards like SAML 2.0 or OIDC. This allows employees to sign in once, while the IdP becomes a centralized point to enforce additional security controls.

Exam trap

The trap here is that candidates may think SSO eliminates the need for MFA or that separate passwords improve security, but the question specifically requires both single sign-on and extra verification for risky scenarios, which only federation plus conditional access can deliver.

Full explanation →

179

MCQmedium

A vulnerability scan reports three findings: a critical remote code execution issue on an internet-facing VPN appliance with a public exploit, a high-severity local privilege escalation on an isolated lab PC, and a medium-severity outdated browser plug-in on a workstation used for training. Which finding should be remediated first?

A.The isolated lab PC, because local privilege escalation is always the highest technical severity.

B.The internet-facing VPN appliance, because it combines critical severity, exposure, and public exploit availability.

C.The training workstation, because browser plug-ins are common entry points for attackers.

D.None of them, because all vulnerability findings should wait for the next planned maintenance cycle.

AnswerB

The VPN appliance should be first because it is exposed to the internet, has a critical vulnerability, and has known exploit code available. That combination significantly increases the likelihood and impact of compromise, making it the most urgent remediation target.

Why this answer

The internet-facing VPN appliance should be remediated first because it combines a critical severity rating, direct exposure to the internet, and a publicly available exploit. This creates an immediate and high-probability risk of remote code execution, which could lead to full compromise of the network perimeter. In contrast, the other findings are isolated or lower severity, making them less urgent.

Exam trap

The trap here is that candidates may prioritize based solely on severity score or common attack vectors (like browser plug-ins) without considering the combination of exposure, exploit availability, and the critical nature of the vulnerability.

How to eliminate wrong answers

Option A is wrong because local privilege escalation on an isolated lab PC, while serious, does not have the same risk as a critical remote code execution on an internet-facing device; the lab PC is not exposed to external threats and requires prior access. Option C is wrong because a medium-severity outdated browser plug-in on a training workstation is a lower priority than a critical vulnerability with a public exploit on an internet-facing system; browser plug-ins are common entry points but the severity and exposure are lower. Option D is wrong because waiting for the next planned maintenance cycle for a critical, internet-facing vulnerability with a public exploit is unacceptable; such issues require immediate remediation to prevent exploitation.

Full explanation →

180

MCQmedium

Based on the exhibit, which control should be enabled to mitigate this issue?

A.DNSSEC, because it validates DNS records and would stop local address-to-MAC spoofing.

B.Port forwarding, because it can direct traffic to the correct internal host more reliably.

C.Load balancing, because it would distribute traffic and reduce the impact of connectivity issues.

D.Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.

AnswerD

Dynamic ARP inspection is designed to block forged ARP messages by checking them against trusted information, usually built from DHCP snooping bindings. Since the switch logs show both DHCP snooping and ARP inspection disabled, enabling these controls is the most appropriate mitigation for the poisoning behavior described.

Why this answer

Dynamic ARP inspection (DAI) with DHCP snooping validates ARP packets against a trusted binding database, preventing man-in-the-middle attacks where an attacker spoofs the MAC address of a legitimate host (e.g., the default gateway) to intercept traffic. The exhibit likely shows a scenario of ARP spoofing or cache poisoning, which DAI directly mitigates by dropping invalid ARP replies. DHCP snooping builds the trusted binding table by recording which IP address is assigned to which MAC address on which port.

Exam trap

The trap here is that candidates confuse DNSSEC (which secures DNS) with ARP security mechanisms, or they assume port forwarding or load balancing can mitigate Layer 2 spoofing attacks, when in fact only DAI with DHCP snooping directly validates ARP integrity.

How to eliminate wrong answers

Option A is wrong because DNSSEC validates DNS records (using digital signatures) to prevent DNS spoofing/cache poisoning, not local address-to-MAC spoofing (ARP attacks). Option B is wrong because port forwarding is a NAT technique to map external ports to internal hosts, and it does not inspect or validate Layer 2 ARP traffic. Option C is wrong because load balancing distributes network or application traffic across multiple servers to improve performance and availability, but it does not enforce ARP security or prevent spoofing at the data link layer.

Full explanation →

181

MCQeasy

A vulnerability scan finds an administrative SSH service listening on 0.0.0.0 on a server that should be managed only from the internal network. What is the main security issue?

A.Exposed management service

B.Default credentials

C.Outdated component

D.Weak permissions

AnswerA

This is the correct answer because the admin SSH service is reachable on all interfaces instead of being limited to the internal management network. That increases attack surface and allows unauthorized internet exposure if firewall rules are weak or missing. The problem is the service placement and exposure, not the SSH protocol itself.

Why this answer

The SSH service binding to 0.0.0.0 means it is listening on all network interfaces, including external-facing ones. This exposes the administrative management interface to potentially untrusted networks, violating the principle of least privilege and increasing the attack surface. The main security issue is that a service intended for internal management only is accessible from outside the trusted internal network.

Exam trap

The trap here is that candidates may focus on the SSH service itself (e.g., thinking of weak passwords or outdated versions) rather than recognizing that the binding to 0.0.0.0 is a network exposure misconfiguration.

How to eliminate wrong answers

Option B is wrong because the question does not mention any use of default usernames or passwords; the core issue is network exposure, not authentication weakness. Option C is wrong because there is no indication that the SSH version or component is outdated; the vulnerability is about misconfiguration, not patch level. Option D is wrong because weak permissions refer to file system or registry access controls, not network-level binding; the SSH service itself may have correct file permissions but still be exposed on the network.

Full explanation →

182

Multi-Selecteasy

A manager asks how to decide whether a new security issue is worth spending money on. Which two factors should be reviewed first? Select two.

Select 2 answers

A.Likelihood that the issue will be exploited

B.Business impact if the issue is successful

C.The color used on the vulnerability report

D.The number of users in the IT department

E.The age of the server name in inventory

AnswersA, B

Likelihood of exploitation is a core factor in risk calculation: it reflects the probability that an attacker will successfully leverage the vulnerability in the current threat environment. Analysts evaluate real-world exploit availability, ease of exploitation, and the exposure of the affected asset to potential threat actors. A high likelihood means the organization faces a realistic and imminent threat, which directly drives prioritization.

Why this answer

The likelihood of exploitation is a fundamental factor in risk assessment. Without understanding how probable it is that a threat actor will exploit a vulnerability, an organization cannot prioritize remediation efforts effectively. This is a core component of risk calculation (Risk = Likelihood × Impact).

Exam trap

The trap here is that candidates may confuse severity indicators (like color-coded CVSS scores) with the primary decision factors, or they may incorrectly assume that administrative metrics (like user count or asset age) are relevant to risk-based spending decisions.

Full explanation →

183

MCQmedium

Based on the exhibit, which malware type is most likely involved?

A.Trojan, because the malware was likely disguised as a legitimate file.

B.Spyware, because the attacker is trying to monitor user activity quietly.

C.Ransomware, because files were encrypted and recovery options were intentionally removed.

D.Rootkit, because the attacker is hiding from the operating system.

AnswerC

This is ransomware. The file extensions changed, a ransom note was dropped into folders, and Volume Shadow Copy data was deleted to hinder recovery. Those are classic signs that the attacker intends to deny access to data and pressure the victim into payment. The visible symptom is loss of file availability, not stealthy monitoring or simple corruption.

Why this answer

The exhibit shows that files have been encrypted with a '.locked' extension and that recovery options like System Restore and Volume Shadow Copy have been removed or disabled. This is a classic indicator of ransomware, which encrypts user data and then demands payment for decryption, often deleting backup files to prevent recovery without the attacker's key.

Exam trap

The trap here is that candidates may confuse the removal of recovery options with a rootkit's stealth techniques, but ransomware's goal is to deny access to data (not hide), and the overt encryption and backup deletion are the key differentiators.

How to eliminate wrong answers

Option A is wrong because a trojan is malware disguised as legitimate software, but the exhibit shows file encryption and removal of recovery options, not just deception. Option B is wrong because spyware focuses on stealthy monitoring of user activity (e.g., keylogging or screen capture), not on encrypting files and deleting backups. Option D is wrong because a rootkit hides its presence from the operating system (e.g., by hooking system calls), whereas the exhibit shows overt file encryption and system recovery tampering, not stealth.

Full explanation →

184

MCQmedium

A monthly scan finds a critical remote-code-execution vulnerability on an internet-facing VPN appliance. The vendor has not released a patch for six weeks, but the service must stay online. Which short-term action is the best risk treatment?

A.Accept the risk and wait for the next scheduled scan cycle.

B.Apply compensating controls such as strict access filtering, MFA, enhanced logging, and alerting.

C.Disable all logging so the appliance performs better under load.

D.Ignore the issue until the vendor confirms the vulnerability is being actively exploited.

AnswerB

When a patch is unavailable, the best short-term treatment is to reduce exposure and add monitoring. Tight access control, MFA, and logging do not remove the vulnerability, but they can meaningfully lower the likelihood of exploitation and improve detection. This is the correct operational response when the service must remain online and a permanent fix is not yet available.

Why this answer

When a patch is unavailable for a critical vulnerability, compensating controls reduce risk without taking the service offline. For an internet-facing VPN appliance, strict access filtering (e.g., limiting source IPs via ACLs), enforcing MFA, and enabling enhanced logging/alerting can mitigate exploitation attempts while maintaining availability. This aligns with the risk treatment strategy of risk reduction through controls rather than acceptance, avoidance, or transfer.

Exam trap

The trap here is that candidates may think accepting risk (Option A) is acceptable for a critical vulnerability, but CompTIA expects you to recognize that compensating controls are the appropriate short-term treatment when a patch is unavailable and the service must remain online.

How to eliminate wrong answers

Option A is wrong because accepting the risk and waiting for the next scan cycle leaves the organization exposed to active exploitation of a critical RCE vulnerability, which is unacceptable for an internet-facing service. Option C is wrong because disabling logging removes visibility into potential attacks, hindering incident detection and response, and does not address the vulnerability itself. Option D is wrong because ignoring the issue until active exploitation is confirmed violates the principle of proactive security; waiting for proof of exploitation increases the likelihood of a breach and potential damage.

Full explanation →

185

MCQmedium

A help desk technician receives a phone call from someone who claims to be the CFO. The caller knows the executive team structure, says they are traveling, and insists the technician reset MFA to 'avoid delaying a wire transfer.' Which social engineering technique is the caller primarily using?

A.Pretexting, because the caller builds a believable story to manipulate the employee

B.Baiting, because the caller is offering something valuable in exchange for action

C.Vishing, because the attack happens by voice call

D.Smishing, because the attacker is using a mobile device

AnswerA

Pretexting is the best fit because the attacker invents a convincing scenario, uses insider details, and pressures the technician to bypass normal verification. The goal is not just to trick someone into clicking a link, but to create a false identity and narrative that makes the request seem legitimate. This is a common tactic in help desk fraud and account takeover attempts.

Why this answer

The caller is using pretexting because they have fabricated a scenario (the CFO traveling and needing an urgent wire transfer) and assumed a false identity to manipulate the help desk technician into resetting MFA. Pretexting relies on a crafted story or pretext to gain trust and bypass security controls, which is exactly what the caller is doing here.

Exam trap

The trap here is that candidates often confuse the delivery method (voice call = vishing) with the underlying social engineering technique (pretexting), but the question specifically asks for the primary technique being used, not the channel.

How to eliminate wrong answers

Option B is wrong because baiting involves offering something enticing (e.g., a free USB drive or download) to trick the victim, not creating a false identity or story. Option C is wrong because vishing is a social engineering technique that uses voice calls, but the question asks for the primary technique being used, not the delivery method; the core technique here is pretexting, not vishing. Option D is wrong because smishing specifically refers to SMS-based phishing attacks, and while the caller may be using a mobile device, the attack is carried out via a phone call, not text messages.

Full explanation →

186

MCQeasy

A security team stores employee passwords in a database. Which method best protects the passwords if the database is stolen?

A.Store the passwords in plain text so users can recover them easily.

B.Hash the passwords with a unique salt for each account.

C.Encrypt the passwords and keep the decryption key in the same database.

D.Compress the passwords before storing them to make them smaller.

AnswerB

Hashing with a unique salt makes password data much harder to reuse or crack at scale. If the database is stolen, the attacker cannot directly read the passwords, and identical passwords will not produce the same stored value when salts differ.

Why this answer

Hashing with a unique salt per account ensures that even if two users have the same password, their hashes will differ, and precomputed rainbow table attacks are rendered ineffective. The salt is stored alongside the hash, but the one-way nature of the hash function means an attacker cannot reverse the hash to recover the original password without performing an expensive brute-force search for each salted hash individually.

Exam trap

The trap here is that candidates may confuse encryption with hashing, thinking that encrypting passwords is sufficient, but they overlook that reversible encryption with the key stored alongside the data provides no real protection in a database theft scenario.

How to eliminate wrong answers

Option A is wrong because storing passwords in plain text violates fundamental security principles; if the database is stolen, all passwords are immediately exposed, compromising every user account. Option C is wrong because encryption is a reversible process, and keeping the decryption key in the same database means that if the database is stolen, the attacker also has the key, making the encryption useless. Option D is wrong because compression is not a security measure; it merely reduces storage size and can be easily reversed by an attacker, providing no protection against password disclosure.

Full explanation →

187

MCQmedium

Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes? Exhibit: 2026-04-25 09:14:03 iam:AttachRolePolicy user=alice 2026-04-25 09:15:10 ec2:AuthorizeSecurityGroupIngress user=alice 2026-04-25 09:16:22 s3:PutBucketPolicy user=alice Requirement: Security wants to track management-plane API calls and configuration changes across cloud resources.

A.Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.

B.Install a rootkit detector on each workload and ignore management-plane activity.

C.Capture only DNS traffic, because it reveals all admin changes indirectly.

D.Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.

AnswerA

This is the best choice because the exhibit shows API-level changes to identity, networking, and storage policies. Control-plane audit logging records who made those changes, what action was taken, and when it occurred. That creates the most useful evidence for investigations, change tracking, and compliance in a cloud environment.

Why this answer

Cloud control-plane audit logging (e.g., AWS CloudTrail, Azure Monitor, or GCP Cloud Audit Logs) captures all management-plane API calls—such as IAM role attachments, security group rule changes, and bucket policy modifications—as shown in the exhibit. This directly meets the requirement to track configuration changes across cloud resources, providing a tamper-proof audit trail for security and compliance.

Exam trap

The trap here is that candidates may confuse data-plane logging (e.g., VPC Flow Logs or DNS logs) with management-plane logging, or assume manual processes are sufficient, when the exhibit clearly shows API-level events that only a control-plane audit service can capture.

How to eliminate wrong answers

Option B is wrong because rootkit detectors focus on workload-level threats (e.g., malware in virtual machines) and do not log management-plane API calls or configuration changes; they ignore the control plane entirely. Option C is wrong because DNS traffic only reveals domain resolution queries, not the specific API calls or resource modifications made by administrators; it cannot reconstruct an audit trail of cloud administration changes. Option D is wrong because manual change tickets are error-prone, lack automation, and cannot capture the granular, timestamped API calls that cloud platforms natively log; relying on spreadsheets violates the principle of automated audit trails required for compliance.

Full explanation →

188

MCQeasy

A SOC analyst notices that log timestamps from different servers do not line up during an investigation. What should be implemented to improve event correlation?

A.A more aggressive password policy for all users.

B.Network Time Protocol time synchronization across systems.

C.Longer user account names to make records easier to read.

D.Disabling centralized logging to reduce duplication.

AnswerB

Time synchronization is essential for reliable logging because incident responders need events to appear in the correct order. If servers use different clocks, correlations can become misleading and slow the investigation. NTP keeps system time aligned so SIEM alerts, authentication records, and host logs can be compared accurately across multiple systems.

Why this answer

Network Time Protocol (NTP) synchronizes clocks across systems to a common time source, ensuring log timestamps align for accurate event correlation. Without NTP, timestamps from different servers can drift, making it impossible to reconstruct the sequence of events during an investigation. This is a foundational requirement for effective security monitoring and incident response.

Exam trap

The trap here is that candidates may confuse operational security controls (like password policies or naming conventions) with the technical infrastructure needed for accurate log correlation, overlooking NTP as a fundamental prerequisite for time-based analysis.

How to eliminate wrong answers

Option A is wrong because a more aggressive password policy (e.g., complexity, expiration) addresses authentication security, not time synchronization or log correlation. Option C is wrong because longer user account names improve readability but have no effect on timestamp alignment or event correlation. Option D is wrong because disabling centralized logging would eliminate the single repository where logs are aggregated, making correlation even harder and increasing duplication of analysis effort.

Full explanation →

189

MCQeasy

Based on the exhibit, which change best improves secure administration for the scheduled task?

A.Keep the Administrator account and leave the task running only when a user is logged on.

B.Move the script to the desktop so it is easier for technicians to monitor manually.

C.Use a dedicated service account with only the required permissions and allow the task to run whether or not anyone is logged on.

D.Disable the task and have staff run the script manually whenever they remember to do it.

AnswerC

A dedicated service account with least privilege reduces the risk of credential misuse and limits what the task can access if it is abused. Allowing the task to run whether a user is logged on or not makes the automation reliable for scheduled maintenance. This is a common secure-administration improvement for repeatable scripts.

Why this answer

Using a dedicated service account with minimal required permissions follows the principle of least privilege, reducing the attack surface. Allowing the task to run whether or not anyone is logged on ensures the scheduled task executes reliably without depending on a user session, which is essential for automated administrative tasks. This approach also avoids the security risks of using the built-in Administrator account, which has excessive privileges and is a common target for attackers.

Exam trap

The trap here is that candidates may think making the script easier to access (Option B) or using the built-in Administrator account (Option A) are acceptable, but CompTIA tests the principle of least privilege and the importance of dedicated service accounts for automated tasks to avoid credential theft and ensure reliable execution.

How to eliminate wrong answers

Option A is wrong because keeping the Administrator account violates least privilege and leaving the task to run only when a user is logged on introduces a dependency on an interactive session, which can cause the task to fail if no user is logged in at the scheduled time. Option B is wrong because moving the script to the desktop does not improve security; it actually increases risk by placing the script in a user-accessible location where it could be modified or executed by unauthorized users, and it does not address the need for secure, automated execution. Option D is wrong because disabling the task and relying on manual execution defeats the purpose of automation, introduces human error, and increases the likelihood of missed or delayed administrative actions, which is not a secure or reliable administration practice.

Full explanation →

190

MCQeasy

Based on the exhibit, what should management implement next?

A.Role-based security awareness training with recurring phishing simulations and reporting practice.

B.Disable all email attachments for every user in the company.

C.Replace all passwords with longer usernames.

D.Move all users to a single shared mailbox for easier monitoring.

AnswerA

This is the best choice because the exhibit shows both low reporting and ongoing click rates across several groups. Role-based training helps target the people most affected, and repeated simulations measure whether behavior improves over time. Training should reinforce how to spot suspicious messages and how to report them correctly, which directly supports the management goal.

Why this answer

The exhibit shows a user who clicked a phishing link and entered credentials, indicating a need for improved security awareness. Role-based training with phishing simulations directly addresses this human risk by teaching users to recognize and report such attacks, which is the most effective next step. This aligns with the Security Program Management domain's focus on continuous improvement through user education and testing.

Exam trap

CompTIA often tests the misconception that technical controls alone (like disabling attachments or changing passwords) can solve human-centric security issues, when in fact user training and awareness are the primary mitigations for phishing risks.

How to eliminate wrong answers

Option B is wrong because disabling all email attachments is an extreme, impractical measure that would severely disrupt business operations and is not a standard security control; instead, organizations use attachment filtering and sandboxing. Option C is wrong because replacing passwords with longer usernames does not improve authentication security—usernames are not secrets, and this would not prevent phishing or credential theft. Option D is wrong because moving all users to a single shared mailbox eliminates accountability, violates the principle of least privilege, and makes monitoring and auditing impossible, increasing security risk rather than reducing it.

Full explanation →

191

Multi-Selecthard

A cloud support team is replacing separate logins for several internal apps. The new design must support one sign-in, reduce the chance that a stolen session remains valid too long, and let the identity team revoke access centrally after termination. Which three controls best fit? Select three.

Select 3 answers

A.Implement SSO through federation with the identity provider as the source of truth.

B.Configure short idle and absolute session timeouts with reauthentication for sensitive actions.

C.Use MFA so the initial authentication requires something the user has or is.

D.Keep app-specific local accounts so each application can manage sessions independently.

E.Disable centralized logout so active sessions are never interrupted during maintenance.

AnswersA, B, C

Federation and SSO let one identity provider authenticate the user and then assert that identity to connected applications. This eliminates repeated logins while keeping authentication centralized. It also makes termination and access changes easier because the identity team controls the authoritative account.

Why this answer

Implementing SSO through federation with the identity provider (IdP) as the source of truth allows users to sign in once and access multiple internal apps without separate logins. This design centralizes authentication, so when the identity team revokes access after termination, the IdP denies all subsequent token requests, effectively invalidating sessions across all apps. Federation typically uses SAML 2.0 or OIDC, where the IdP issues signed assertions or ID tokens that apps trust, eliminating the need for app-specific credentials.

Exam trap

The trap here is that candidates may think MFA alone (Option C) satisfies the requirement to reduce stolen session validity, but MFA only strengthens initial authentication and does not control session duration or enable centralized revocation after termination.

Full explanation →

192

MCQmedium

A firewall ACL must be modified in production to allow a vendor update server. The team wants to minimize the chance of accidentally blocking payroll traffic. Which change-management step is best before applying the rule?

A.Apply the rule immediately and monitor the help desk for complaints.

B.Test the proposed rule in a staged policy set and keep a rollback plan ready.

C.Remove all deny rules temporarily so the vendor traffic can pass cleanly.

D.Disable logging during the change to avoid slowing down the firewall.

AnswerB

Testing the rule in a staged or cloned policy set helps confirm that the ACL logic, rule order, and source and destination matching behave as intended before production exposure. A rollback plan provides a fast recovery path if the change still causes an unexpected impact. Together, these practices reduce the likelihood of disrupting payroll traffic and align with safe, controlled change management in operational environments.

Why this answer

Testing the proposed rule in a staged policy set allows the team to verify that the new ACL entry does not inadvertently match and drop payroll traffic before it is applied to the production firewall. Keeping a rollback plan ready ensures that if the rule causes unexpected blocking, the previous ACL can be restored immediately, minimizing downtime. This aligns with the change-management principle of validating changes in a controlled environment to prevent service disruption.

Exam trap

The SY0-701 exam often tests the misconception that immediate application with monitoring is sufficient, but the trap is that this reactive approach ignores the risk of silently blocking critical traffic until complaints arise, which is unacceptable in a production environment.

How to eliminate wrong answers

Option A is wrong because applying the rule immediately without prior testing or rollback planning violates change-management best practices and risks accidentally blocking payroll traffic if the ACL logic is flawed; monitoring the help desk is reactive, not proactive. Option C is wrong because removing all deny rules temporarily would expose the network to unauthorized traffic, defeating the purpose of the firewall and violating the principle of least privilege; it does not address the specific need to allow vendor traffic while protecting payroll.

Full explanation →

193

MCQmedium

A billing application has an RTO of 2 hours and an RPO of 30 minutes. The current recovery method requires rebuilding the VM from scratch and then restoring last night's backup, which takes over six hours. Which solution best meets the stated recovery objectives?

A.Keep the current backup schedule and shorten the documentation for the restore procedure.

B.Switch to weekly full backups and manually verify them after business hours.

C.Store backups on the same production host so restores are faster.

D.Use a warm standby replica with frequent log shipping or near-continuous replication.

AnswerD

A warm standby with frequent log shipping is the best fit because it reduces both data loss and restoration time. The standby already has the operating system and application environment in place, so failover is much faster than rebuilding from scratch. Frequent log shipping narrows the recovery point to within the required 30 minutes, making the design aligned with both business objectives.

Why this answer

A warm standby replica with frequent log shipping or near-continuous replication can achieve an RPO of 30 minutes or less by minimizing data loss, and an RTO of 2 hours by allowing rapid failover to the replica. This directly addresses the current recovery method's failure to meet the RTO (6+ hours vs. 2 hours) and RPO (last night's backup vs. 30 minutes). Technologies like SQL Server log shipping or VMware vSphere replication provide near-continuous data synchronization, enabling recovery within the stated objectives.

Exam trap

The trap here is that candidates may think faster backups or better documentation (Option A or C) can solve the RTO/RPO gap, but they fail to recognize that the core issue is the recovery method itself—rebuilding from scratch—which cannot be fixed by incremental improvements to backup speed or storage location.

How to eliminate wrong answers

Option A is wrong because shortening documentation does not reduce the actual time to rebuild the VM and restore the backup, so it cannot meet the 2-hour RTO. Option B is wrong because weekly full backups increase the RPO to up to 7 days, far exceeding the required 30 minutes, and manual verification after hours does not improve recovery speed. Option C is wrong because storing backups on the same production host creates a single point of failure and does not address the fundamental issue of slow rebuild and restore times; it also violates the 3-2-1 backup rule.

Full explanation →

194

MCQmedium

A security auditor is reviewing the access controls for a payroll application. The auditor discovers that a single user, the payroll manager, has permissions to both create new employee records and then approve and process salary payments for those records. The company's security policy requires that no single individual should be able to execute both the creation and the approval of a payment for the same employee. Which of the following security principles is the company's policy attempting to enforce?

A.Least privilege

B.Separation of duties

C.Defense in depth

D.Mandatory access control

AnswerB

Separation of duties (SoD) is a preventive administrative control that fragments critical transaction phases—such as authorization, custody, and recordkeeping—across different individuals. In this scenario, the policy ensures that no single person can both initiate and approve a high-risk change, because combining those capabilities would allow an insider to create and conceal fraudulent activity. SoD directly addresses the requirement by forcing collusion or at least independent oversight for sensitive operations.

Why this answer

The company's policy prohibits a single user from both creating employee records and approving payments for them, which is a classic application of separation of duties. This principle ensures that no single individual has the authority to execute two conflicting or sensitive tasks that could lead to fraud or error, such as creating a fictitious employee and then approving a salary payment to that employee. In the context of a payroll application, separation of duties requires distinct roles or users for record creation and payment approval to enforce checks and balances.

Exam trap

The trap here is that candidates often confuse separation of duties with least privilege, but the key distinction is that separation of duties focuses on dividing conflicting tasks among multiple users to prevent fraud, while least privilege focuses on limiting permissions to the minimum needed for a single user's role.

Why the other options are wrong

The policy specifically targets preventing a single user from performing both creation and approval of payments, which is the core of separation of duties, not least privilege. Least privilege would limit permissions to only what is necessary for a role, but here the issue is conflicting duties.

Defense in depth is a layered security strategy using multiple controls, not a principle preventing a single user from performing conflicting duties. The scenario describes a conflict of interest, not a lack of multiple security layers.

Mandatory access control (MAC) is a model where access decisions are based on system-enforced labels (e.g., security clearance), not on preventing a single user from performing conflicting tasks. The policy described is about separating duties, not about label-based access.

When would these options actually be correct?

A question where a user has more permissions than needed for their job role, such as a help desk technician having administrative rights to modify system files. The correct answer would be least privilege because the policy aims to restrict permissions to only those required.

A company implements firewalls, intrusion detection, antivirus, and access controls to protect a network. An auditor asks which security principle this layered approach represents. The correct answer would be defense in depth.

A question where a system uses security labels (e.g., Top Secret, Secret) to enforce access based on user clearance and data classification, and the policy requires that users cannot change labels or override system-enforced rules. For example: 'A military system requires that only users with a Top Secret clearance can read Top Secret documents, and the system enforces this automatically.'

Why candidates pick the wrong answer

Candidates may confuse 'least privilege' with 'separation of duties' because both involve limiting user permissions, but they address different risks: least privilege reduces overall access, while separation of duties prevents fraud by splitting conflicting tasks.

Candidates may confuse 'separation of duties' with 'defense in depth' because both involve multiple layers or checks, but defense in depth focuses on overlapping controls rather than dividing responsibilities among individuals.

Candidates may confuse 'separation of duties' with 'mandatory access control' because both involve restrictions, but MAC is about label-based enforcement, not about splitting conflicting tasks among multiple users.

Full explanation →

195

MCQmedium

Based on the exhibit, which change would best reduce the attack surface of the public web server while preserving remote administration from the internal network?

A.Assign WEB01 a public IP address directly and remove the firewall rules.

B.Move WEB01 into a DMZ and allow only the reverse proxy or load balancer to reach it on HTTPS, with admin access limited to the jump host.

C.Place WEB01 on the same VLAN as user workstations so the firewall can inspect traffic more easily.

D.Keep the server where it is and add outbound web filtering to stop exploitation attempts.

AnswerB

A DMZ creates a separate trust boundary for the internet-facing service, limiting blast radius if the web server is compromised. Restricting inbound access to a proxy or load balancer reduces direct exposure, and allowing administration only from a jump host preserves controlled remote management. This is the strongest architectural improvement in the scenario.

Why this answer

Moving WEB01 into a DMZ and restricting inbound HTTPS traffic to only the reverse proxy or load balancer minimizes the server's exposure to the internet while still allowing external users to access the web application. Admin access from the internal network is preserved by limiting it to a jump host, which provides a controlled, audited entry point. This architecture follows the principle of least privilege and network segmentation, reducing the attack surface without sacrificing necessary functionality.

Exam trap

The trap here is that candidates often think placing a server on a separate VLAN or adding filtering is sufficient, but the key is using a DMZ with a reverse proxy to eliminate direct inbound connections and a jump host to control administrative access.

How to eliminate wrong answers

Option A is wrong because assigning a public IP directly to WEB01 and removing firewall rules would expose the server directly to the internet, vastly increasing the attack surface and eliminating all network-layer protection. Option C is wrong because placing WEB01 on the same VLAN as user workstations would bypass the firewall's ability to segment traffic, exposing the server to lateral movement from compromised workstations and violating the principle of network segregation. Option D is wrong because keeping the server in its current location and adding outbound web filtering does not reduce the inbound attack surface; it only attempts to mitigate exploitation after traffic reaches the server, leaving it directly accessible from the internet.

Full explanation →

196

MCQhard

A scan of a web server hosting an internal help-desk portal reports these findings: `/var/www/uploads` is world-writable by the application account, PHP files in that directory are executed by Apache, and the app allows users to upload images without content-type validation. Which issue should be remediated first to most reduce the chance of remote code execution?

A.Outdated browser plug-in on an admin workstation, because it may expose users to drive-by attacks.

B.Default SNMP community string on a printer in a separate VLAN, because it weakens network monitoring.

C.World-writable executable upload path, because an attacker could upload or modify server-executable code in a web-accessible directory.

D.Missing disk encryption on a help-desk laptop, because stolen devices are a common breach source.

AnswerC

The world-writable, web-executable upload path is the most urgent issue because it creates a direct path to remote code execution. If an attacker can place or alter files in a directory that Apache executes, they may be able to run arbitrary server-side code. The lack of content-type validation increases the chance that a malicious payload will be accepted as a harmless file upload.

Why this answer

The combination of a world-writable upload directory, PHP execution in that directory, and no content-type validation allows an attacker to upload a malicious PHP file (e.g., a web shell) and execute it via the web server, achieving remote code execution. This directly exploits the server's trust in user-supplied files and the execution context of Apache, making it the most immediate and severe risk.

Exam trap

The trap here is that candidates may focus on the 'world-writable' aspect alone, but the critical chain is the combination of writable upload path, PHP execution, and lack of content-type validation, which together enable direct remote code execution; other options are valid security concerns but do not address the immediate RCE risk.

How to eliminate wrong answers

Option A is wrong because an outdated browser plug-in on an admin workstation is a client-side vulnerability that requires user interaction (e.g., visiting a malicious site) and does not directly enable remote code execution on the web server itself. Option B is wrong because a default SNMP community string on a printer in a separate VLAN primarily exposes network configuration data and could allow information disclosure or denial of service, but it does not provide a path to execute arbitrary code on the help-desk portal server. Option D is wrong because missing disk encryption on a help-desk laptop addresses data-at-rest protection against physical theft, which is a different threat vector (confidentiality breach) and does not mitigate remote code execution on the live web server.

Full explanation →

197

Matchingmedium

Match each vendor-risk concern to the contractual control that best addresses it. 1. The company wants the right to review the vendor's controls and supporting records after the contract is signed. 2. The company wants to know when the vendor will use subcontractors that may touch its data. 3. The company wants written notice within 24 hours if the vendor suffers an incident affecting company data. 4. The company wants assurance that the vendor's controls are independently assessed each year.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Right-to-audit clause

Subprocessor disclosure requirement

Breach-notification clause

SOC 2 Type II report

Why these pairings

Right to audit allows reviewing controls; subcontractor clause requires notification; incident clause mandates timely breach notification; independent assessment ensures annual audits; DPA covers data protection; SLA defines service levels.

Full explanation →

198

MCQmedium

A security architect is redesigning the network for a payment card processing environment. The goal is to create a cardholder data environment (CDE) that is isolated from the rest of the corporate network to reduce PCI DSS scope. The CDE will contain only the payment application servers and the database storing credit card numbers. The architect must allow authorized administrators in the corporate network to perform updates and monitoring on the CDE servers. Which of the following network architecture designs provides the strongest isolation while still meeting the requirement for authorized administrative access?

A.Place the CDE servers on a separate subnet within the same VLAN as the corporate network, and rely on host-based firewalls on each server to deny all traffic except from specific administrative IP addresses.

B.Deploy a dedicated firewall that connects the corporate network to an isolated CDE segment. Configure firewall rules to allow only SSH and RDP from a specific jump box in the corporate network to the CDE servers, and deny all other inbound traffic from the corporate network.

C.Place the CDE servers on a separate VLAN with a Layer 3 switch that uses ACLs to allow only ICMP traffic from the corporate network to the CDE for monitoring, and require administrators to physically connect to the CDE network via a dedicated console server.

D.Connect the CDE servers directly to the internet through a web application firewall (WAF), and require all management access to occur through a cloud-based VPN with two-factor authentication.

AnswerB

A dedicated firewall provides strong network-level segmentation between the corporate network and the CDE. Using a jump box (bastion host) as the sole admin entry point limits exposure and allows for centralized logging and auditing. This design meets both isolation and authorized access requirements.

Why this answer

It uses a dedicated firewall to create a true network isolation boundary between the corporate network and the CDE, which is a core PCI DSS requirement for reducing scope. By allowing only SSH and RDP from a specific jump box, it enforces strict least-privilege administrative access while preventing any direct or uncontrolled traffic from the corporate network. This design ensures that the CDE is a separate, protected segment with a single controlled entry point, meeting both isolation and authorized access needs.

Exam trap

The trap here is that candidates often think VLANs with ACLs (Option C) provide sufficient isolation, but PCI DSS requires a clear network segmentation boundary enforced by a firewall, not just Layer 3 ACLs or host-based controls.

Why the other options are wrong

Placing CDE servers on a separate subnet within the same VLAN as the corporate network does not provide true isolation, as VLANs share the same broadcast domain and Layer 2 boundaries. Host-based firewalls are less secure than a dedicated network firewall and can be more easily misconfigured or bypassed, failing to meet PCI DSS requirements for strong segmentation.

Option C is wrong because allowing ICMP traffic from the corporate network to the CDE creates a potential attack vector (e.g., ICMP tunneling) and does not provide the required administrative access for updates and monitoring via SSH/RDP. Additionally, requiring physical connection via a console server is impractical for routine remote administration.

Connecting CDE servers directly to the internet, even with a WAF, exposes them to external threats and violates PCI DSS requirements for network segmentation and isolation of the CDE from untrusted networks.

When would these options actually be correct?

This option would be correct in a scenario where the organization has a flat network with limited budget, and the requirement is to quickly segregate a low-risk system (e.g., a test environment) using existing infrastructure, with host-based firewalls as a compensating control. The question would emphasize cost-effectiveness and minimal hardware changes.

This option would be correct in a scenario where the requirement is to allow only passive monitoring (e.g., ping checks) from the corporate network, and all administrative access must be performed via out-of-band management (e.g., dedicated console server) for high-security environments where no remote network access to the CDE is permitted.

This design could be correct for a public-facing web application that does not handle cardholder data, where the goal is to protect against web application attacks while allowing external access and management via a secure VPN.

Why candidates pick the wrong answer

Candidates may think that a separate subnet and host-based firewalls provide sufficient isolation, underestimating the importance of network-level segmentation and dedicated firewalls in PCI DSS. They might also overestimate the security of VLANs and host-based controls.

Candidates may find this option tempting because it uses VLAN segmentation and ACLs, which are common security controls, and the idea of physical console access seems highly secure. However, they overlook the need for remote administrative access and the risks of allowing ICMP traffic.

Candidates may be attracted to the use of a WAF and two-factor VPN as strong security controls, overlooking the fundamental requirement to isolate the CDE from the internet to reduce PCI DSS scope.

Full explanation →

199

MCQhard

Based on the exhibit, which indicator should the security team prioritize for endpoint detection and hunting? The attacker rotates infrastructure frequently, but one artifact has remained consistent across recent investigations.

A.The current source IP addresses hosting the payloads

B.The unique mutex name created by the malware on infected endpoints

C.The exact wording of the latest phishing email lure

D.The filename of the attachment used in the most recent incident

AnswerB

A mutex (mutual exclusion object) is a named synchronization primitive that malware creates to prevent multiple instances of itself from running simultaneously. The name is frequently hardcoded or derived from a fixed algorithm in the binary, so it remains consistent across downloads and executions on infected endpoints. Unlike network addresses or file names, this host-based artifact can be queried via EDR tools or Sysinternals and provides a durable detection point that persists even after domains, IPs, and hashes rotate.

Why this answer

A mutex (mutual exclusion object) is a unique artifact created by malware to prevent multiple instances of itself from running on the same endpoint. Since the attacker rotates infrastructure frequently (IPs, domains, filenames), the consistent mutex name provides a stable indicator of compromise (IoC) that can be used for endpoint detection and hunting across different incidents. This makes it a reliable signature for identifying the same malware family or variant even when other indicators change.

Exam trap

The trap here is that candidates focus on easily changed artifacts (IPs, filenames, email content) rather than recognizing that mutexes are often hardcoded in malware binaries and persist across infrastructure changes, making them a more stable indicator for detection.

How to eliminate wrong answers

Option A is wrong because source IP addresses hosting payloads are frequently rotated by attackers (e.g., using fast-flux DNS or cloud instances), making them unreliable for persistent detection. Option C is wrong because the exact wording of phishing email lures can be easily altered by attackers in subsequent campaigns, and email content is often filtered or modified by security gateways, reducing its forensic value. Option D is wrong because filenames of attachments are trivial to change (e.g., using random or polymorphic naming), and attackers often use different filenames in each wave to evade signature-based detection.

Full explanation →

200

MCQeasy

A user downloads a company software update and wants to verify it really came from the vendor and was not changed in transit. Which cryptographic feature should they check?

A.A digital signature from the vendor

B.A longer filename with the vendor name in it

C.A larger file size than the previous update

D.A password protected ZIP file

AnswerA

A digital signature lets the user verify both the source and the integrity of the update. If the signature is valid, the file was signed by the expected private key holder and has not been altered since signing.

Why this answer

A digital signature from the vendor provides cryptographic proof of both authenticity (the file originated from the claimed vendor) and integrity (the file has not been altered in transit). The vendor signs the file with their private key, and the user verifies the signature using the vendor's public key; if the signature is valid, the file is genuine and unchanged.

Exam trap

The trap here is that candidates confuse file properties (name, size) or simple access controls (password protection) with cryptographic verification, overlooking that only a digital signature provides non-repudiation and tamper evidence.

How to eliminate wrong answers

Option B is wrong because a longer filename containing the vendor name is trivial to forge and provides no cryptographic assurance of origin or integrity. Option C is wrong because a larger file size does not prove authenticity; an attacker can easily modify the update and increase its size. Option D is wrong because a password-protected ZIP file only restricts access via the password; it does not cryptographically bind the file to a specific vendor or protect against tampering in transit.

Full explanation →

201

MCQmedium

A SOC analyst reviews an alert on a workstation where PowerShell launched from a scheduled task, downloaded an encoded command from a remote server, and then spawned rundll32.exe. Traditional antivirus did not flag any files on disk, and the activity stops after rebooting the host. Which type of malware behavior best fits this event?

A.Worm behavior that is spreading through SMB shares

B.Fileless attack using trusted system tools to run malicious code in memory

C.Rootkit that is hiding itself by modifying kernel drivers

D.Trojan that can only run after a user manually opens a malicious attachment

AnswerB

This matches a fileless attack because the malicious activity relies on built-in tools like PowerShell and rundll32 rather than an obvious executable on disk. The alert shows code being fetched and executed from memory, which often evades traditional file-based antivirus detection. The fact that the behavior disappears after reboot further supports a memory-resident, fileless technique.

Why this answer

The attack uses PowerShell to download and execute an encoded command directly in memory, then spawns rundll32.exe—both are trusted Microsoft binaries. No files are written to disk, and the activity ceases after reboot, which are hallmarks of a fileless malware attack that operates entirely in volatile memory.

Exam trap

The trap here is that candidates may associate any scheduled task or PowerShell activity with a worm or Trojan, but the key differentiator is the absence of disk writes and the use of memory-only execution, which is the defining characteristic of a fileless attack.

How to eliminate wrong answers

Option A is wrong because worm behavior spreading through SMB shares typically involves file-based replication and network scanning (e.g., EternalBlue), not a scheduled task launching PowerShell to download an encoded command and spawn rundll32.exe. Option C is wrong because a rootkit that modifies kernel drivers would persist across reboots and often evade detection by hiding processes or files, but here the activity stops after reboot and no kernel-level modification is indicated. Option D is wrong because a Trojan requiring manual user attachment opening does not match the automated scheduled task trigger and the use of encoded remote commands; the attack is initiated by a scheduled task, not user interaction.

Full explanation →

202

MCQhard

To reduce fraud, a finance system requires one user to create a payment batch, a different user to approve it, and a third role to release it to the bank. An audit recommends adding a "super-user" who can perform all three steps to speed month-end close. Which principle would that recommendation most directly weaken?

A.Least privilege

B.Separation of duties

C.Need-to-know

D.Defense in depth

AnswerB

Keeping creation, approval, and release in different roles reduces the chance that one compromised account or one dishonest employee can move money without oversight. The recommended super-user would concentrate those powers into one role and remove the control that forces independent review. That is a direct violation of separation of duties, which is designed to reduce fraud and abuse.

Why this answer

The recommendation to create a super-user who can create, approve, and release payment batches directly violates the separation of duties principle. This principle requires that critical tasks be divided among multiple individuals to prevent any single person from having the ability to commit fraud without collusion. By allowing one user to perform all three steps, the system loses the fraud-prevention control that requires independent actors for each stage of the payment lifecycle.

Exam trap

The trap here is that candidates may confuse least privilege with separation of duties, because both involve limiting access, but separation of duties specifically addresses the division of conflicting tasks to prevent fraud, while least privilege focuses on minimizing permissions for a single role.

How to eliminate wrong answers

Option A is wrong because least privilege is about granting only the minimum permissions necessary to perform a job function, not about dividing tasks among multiple users; the super-user would actually violate least privilege by having excessive permissions, but the question asks which principle is most directly weakened by the recommendation. Option C is wrong because need-to-know controls access to specific data based on job requirements, not the sequence of operational steps; the super-user would still need to know payment details to perform the steps, so this principle is not directly impacted. Option D is wrong because defense in depth is a layered security strategy using multiple controls, and while adding a super-user reduces one layer, the core principle being undermined is the division of critical functions, not the layering of defenses.

Full explanation →

203

MCQmedium

A user receives a phone call from someone who claims to be a member of the company's IT support team. The caller states that the user's account has been compromised and requests the user's username, password, and the current multi-factor authentication (MFA) code to 'verify identity and secure the account.' Which type of social engineering attack is being attempted?

A.Spear phishing

B.Vishing

C.Pretexting

D.Tailgating

AnswerB

Vishing (voice phishing) is a social engineering attack executed over phone calls or Voice over IP (VoIP), where the attacker impersonates a trusted authority—such as IT support, a bank, or a government agency—to manipulate the victim into revealing sensitive data like passwords, PINs, or one-time MFA codes. This scenario explicitly involves a phone call, which directly aligns with the definition of vishing. The attacker leverages the voice channel to establish urgency and bypass email-based security defenses, making vishing the precise classification under CompTIA Security+.

Why this answer

B is correct because vishing (voice phishing) is a social engineering attack conducted over the phone, where the attacker impersonates a trusted entity (IT support) to trick the victim into revealing sensitive information such as credentials and MFA codes. The request for the current MFA code is a key indicator, as it would allow the attacker to bypass multi-factor authentication in real time.

Exam trap

The trap here is confusing vishing with pretexting, as both involve deception, but vishing specifically uses voice (phone) as the attack vector, while pretexting is a broader category that can occur through any communication channel.

Why the other options are wrong

Spear phishing is a targeted email attack, not a phone call. The question describes a voice-based attack (phone call), which is vishing, not spear phishing.

Pretexting involves fabricating a scenario to obtain information, but the specific attack vector here is voice-based (phone call), making 'vishing' the more precise term. The question explicitly describes a phone call, which is the defining characteristic of vishing.

Tailgating involves an unauthorized person physically following an authorized individual into a restricted area without proper authentication, not a phone call requesting credentials.

When would these options actually be correct?

Spear phishing would be correct if the question described a targeted email that appears to come from a trusted source (e.g., IT support) and asks the recipient to click a link or provide credentials via a fake login page.

Pretexting would be correct if the question described an attacker using a fabricated identity or story (e.g., posing as a vendor or auditor) to obtain information via email, in person, or other means, without specifying the communication channel as voice.

A question describes an attacker physically following an employee through a secured door without using their own badge, exploiting the employee's courtesy to gain access to a building.

Why candidates pick the wrong answer

Candidates may confuse spear phishing with vishing because both are targeted attacks that impersonate a trusted entity, but they forget that spear phishing is specifically email-based, not voice-based.

Candidates may confuse pretexting with vishing because both involve deception and identity fabrication. They might focus on the 'false identity' aspect (IT support) and overlook that the phone call makes it specifically vishing.

Candidates may confuse tailgating with any attack that bypasses security controls, but tailgating specifically refers to physical access, not social engineering over the phone.

Full explanation →

204

MCQmedium

A team moved a Linux VM to IaaS. They need OS login events, process activity, and network flow metadata sent to one central platform for alerting. What is the best first step?

A.Enable only perimeter security groups and assume the cloud provider will collect all host telemetry.

B.Deploy an endpoint logging agent and enable cloud-native flow logs to a centralized logging service.

C.Store the VM snapshots in object storage and review them manually during incidents.

D.Rely on the hypervisor console and disable guest-level logging to reduce overhead.

AnswerB

Deploying an endpoint logging agent on the VM captures systemd journal entries, /var/log/auth.log, and auditd records, yielding timestamps, usernames, source IPs, and session details for every login. Enabling cloud-native flow logs (e.g., VPC Flow Logs, Azure NSG flow logs) adds connection-level metadata, revealing failed auth traffic patterns and lateral movement. Sending both to a centralized logging service (CloudWatch Logs, Log Analytics, or a SIEM) supports real-time alerting, long-term retention, and efficient incident investigation.

Why this answer

Deploying an endpoint logging agent (e.g., auditd, osquery, or a SIEM agent) on the Linux VM captures OS login events and process activity at the guest level, while enabling cloud-native flow logs (e.g., AWS VPC Flow Logs, Azure NSG flow logs) provides network flow metadata. Sending both to a centralized logging service (e.g., AWS CloudWatch Logs, Azure Log Analytics, or a third-party SIEM) ensures all required telemetry is aggregated for alerting. This approach directly addresses the need for host-level and network-level visibility without relying on the cloud provider to collect guest OS internals.

Exam trap

The trap here is that candidates may assume cloud providers automatically collect guest OS telemetry (like login events and process activity) when they only provide infrastructure-level logs (e.g., hypervisor or network flow logs), leading them to choose Option A or D incorrectly.

How to eliminate wrong answers

Option A is wrong because perimeter security groups only filter network traffic at the cloud boundary and do not collect OS login events, process activity, or network flow metadata; the cloud provider does not automatically collect host-level telemetry from guest VMs. Option C is wrong because storing VM snapshots in object storage is a backup/recovery method, not a real-time logging solution, and manual review during incidents is too slow and impractical for continuous alerting. Option D is wrong because relying solely on the hypervisor console provides only hypervisor-level logs (e.g., VM start/stop), not guest OS login events or process activity, and disabling guest-level logging removes the very data needed for security monitoring.

Full explanation →

205

MCQhard

A company runs payroll and HR application servers on the same VLAN because a redesign is not possible this quarter. Security wants to reduce lateral movement if one workload is compromised, but the team cannot renumber the environment or add new physical firewalls. Which control best fits the requirement?

A.Move the servers into a single larger subnet so internal routing is simplified

B.Implement microsegmentation with host-based or distributed firewall rules between workloads

C.Place the servers behind a network address translation device to hide their IP addresses

D.Rely on password rotation and MFA for administrative logins only

AnswerB

Microsegmentation is the best fit when the organization cannot redesign the network but still needs to isolate workloads more tightly. Host-based or distributed firewall rules can restrict east-west traffic between individual servers, even when they share the same VLAN. That reduces lateral movement far better than coarse VLAN-only separation and does not require renumbering the environment.

Why this answer

Microsegmentation using host-based or distributed firewall rules (e.g., via a hypervisor firewall or host firewall policies) allows the security team to enforce zero-trust east-west traffic controls between the payroll and HR servers without changing the VLAN, subnet, or adding physical firewalls. This directly reduces lateral movement by restricting communication to only what is necessary, even though both workloads share the same Layer 2 broadcast domain.

Exam trap

The trap here is that candidates often assume VLAN segmentation is the only way to isolate workloads, but the question explicitly prevents renumbering or adding firewalls, so the correct answer leverages host-based or distributed firewall rules to achieve microsegmentation without changing the network topology.

How to eliminate wrong answers

Option A is wrong because moving servers into a single larger subnet simplifies routing but does nothing to restrict lateral movement between workloads; in fact, it may increase the attack surface by placing more hosts in the same broadcast domain. Option C is wrong because placing servers behind a NAT device hides their IP addresses from external networks but does not restrict traffic between the two servers on the same VLAN; NAT operates at Layer 3/4 and does not enforce host-to-host segmentation within the same subnet. Option D is wrong because password rotation and MFA protect administrative logins but do not prevent a compromised workload from moving laterally to another server; they address authentication, not network-level or host-level traffic filtering.

Full explanation →

206

MCQmedium

A SIEM correlates VPN authentication logs and sees 14 different user accounts receive one failed login attempt each from the same source IP during a 5-minute window. A few minutes later, one of those accounts successfully authenticates from that same IP. Which attack is most likely?

A.Brute-force attack against a single account using many passwords.

B.Password spraying using a common password against many accounts.

C.Replay attack using previously captured authentication traffic.

D.ARP poisoning used to intercept local network traffic.

AnswerB

Password spraying is a low-and-slow technique that tests one common password (for example, 'Autumn2024!') against a broad list of usernames, keeping attempts per account below threshold to trigger no lockout. The correlation of 14 distinct VPN authentication failures followed by one success is exactly the signature of a spray, where the attacker cycles through accounts with a single guess each round. This method evades per-account brute-force detection and relies on weak password reuse across the environment.

Why this answer

The SIEM observed 14 different user accounts each receiving a single failed login attempt from the same source IP within a 5-minute window, followed by one account successfully authenticating. This pattern is characteristic of password spraying, where an attacker tries a common password (e.g., 'Password123') against many accounts to avoid triggering account lockouts, then leverages a successful guess. The single failure per account avoids the threshold for brute-force detection, and the eventual success confirms a guessed credential.

Exam trap

The trap here is that candidates confuse password spraying with brute-force attacks, failing to recognize that the key differentiator is the number of accounts targeted versus the number of passwords attempted per account.

How to eliminate wrong answers

Option A is wrong because a brute-force attack targets a single account with many password attempts, not multiple accounts with one attempt each. Option C is wrong because a replay attack requires capturing and retransmitting valid authentication traffic (e.g., a Kerberos TGT or NTLM hash), which would not produce failed login attempts from the same IP. Option D is wrong because ARP poisoning is a Layer 2 attack used to intercept local traffic on a switched network, not to generate VPN authentication logs with failed and successful logins from a single source IP.

Full explanation →

207

Multi-Selectmedium

A Windows server is still running after suspected compromise. Before it is powered down, which two volatile data sources should be collected first? Select two.

Select 2 answers

A.A memory capture or RAM image from the live system.

B.A snapshot of active network connections and listening ports.

C.A full disk image from the powered-off server.

D.A hardware inventory report from the asset management database.

E.A screenshot of the server’s desktop wallpaper for reference.

AnswersA, B

A memory capture is one of the most important volatile data sources because it can reveal running malware, injected code, encryption keys, live network sessions, and command history not stored on disk. Once the system is powered off, this information is lost. Capturing RAM early gives investigators the best chance to reconstruct the attacker’s activity.

Why this answer

A memory capture (RAM image) preserves volatile data that is lost on power-down, including running processes, open network connections, encryption keys, and malware that exists only in memory. This is critical for forensic analysis of a live system suspected of compromise, as it captures the system state at the time of collection.

Exam trap

The trap here is that candidates often confuse the order of volatility and select a disk image (Option C) as a first step, not realizing that volatile data like RAM and network connections must be collected before powering down the system.

Full explanation →

208

MCQeasy

A small company has two security issues and can fix only one this week. Which should be prioritized first? One issue is an internal lab server with a medium-severity flaw. The other is an internet-facing login portal using default administrator credentials.

A.Fix the internal lab server first because every vulnerability should be treated equally.

B.Fix the internet-facing login portal first because default administrator credentials create a much higher risk.

C.Wait until the monthly maintenance window so both issues can be fixed at the same time.

D.Ignore both issues until users report symptoms, then respond if something happens.

AnswerB

This is the best choice because a public-facing system with default credentials is far more likely to be attacked and can lead to immediate compromise. Risk prioritization considers both likelihood and impact, not just severity labels. Exposed administrative access can quickly become a business-wide incident, so it should be addressed first.

Why this answer

The internet-facing login portal using default administrator credentials represents an immediate, high-impact risk because it allows unauthorized remote access with administrative privileges. Default credentials are well-known and actively targeted by automated scanners and attackers, making exploitation trivial. In contrast, the internal lab server with a medium-severity flaw is behind network segmentation and requires additional access, so its risk is lower and can be deferred.

Exam trap

The SY0-701 exam often tests the principle of prioritizing vulnerabilities based on risk (likelihood and impact) rather than treating all vulnerabilities equally, and the trap here is assuming that severity alone (medium vs. high) determines priority without considering exposure and exploitability.

How to eliminate wrong answers

Option A is wrong because it incorrectly assumes all vulnerabilities should be treated equally, ignoring the critical factor of exploitability and exposure; a medium-severity flaw on an internal server is far less urgent than default admin credentials on an internet-facing portal. Option C is wrong because delaying both fixes until a monthly maintenance window leaves a critical authentication bypass vulnerability exposed for an extended period, which is unacceptable when immediate remediation is possible.

Full explanation →

209

Multi-Selectmedium

An organization wants to reduce the risk of malware infections from removable media. Which three of the following controls should be implemented? (Choose three.)

Select 3 answers

.Disabling AutoRun and AutoPlay features

.Enforcing a policy of full disk encryption on all removable drives

.Using group policy to block execution from removable media

.Scanning all removable media with antivirus software upon insertion

.Requiring all removable media to be formatted as NTFS

.Installing a host-based intrusion detection system on every workstation

Why this answer

Disabling AutoRun and AutoPlay features prevents malicious code from executing automatically when removable media is inserted, which is a common infection vector. Using group policy to block execution from removable media stops any executable files from running, even if manually launched. Scanning all removable media with antivirus software upon insertion detects and quarantines known malware before it can interact with the system.

Exam trap

The trap here is that candidates often confuse data protection controls (like encryption) with execution prevention controls, or they assume that file system formatting (NTFS) provides security against malware execution.

Full explanation →

210

MCQmedium

A security analyst receives multiple alerts indicating that several users in the finance department clicked a malicious link in an email. The analyst has confirmed the email subject line and sender address. Which of the following is the BEST first step to contain the incident?

A.Block the sender's email address at the email gateway.

B.Disable the users' accounts.

C.Perform a forensic analysis of the emails.

D.Delete the emails from the users' mailboxes.

AnswerA

Implementing a sender block at the email gateway (MTA) immediately suppresses messages from the malicious address before they reach the internal mail servers, unlike client-side rules. This leverages gateway filtering policies and can be combined with sender reputation scoring to proactively stop related spoofed or lookalike domains. This containment step halts the attack vector at the ingress point, preventing additional users from receiving the phishing payload while the investigation continues.

Why this answer

Blocking the sender's email address at the email gateway is the best first step because it immediately prevents further malicious emails from that sender from reaching any users, containing the incident at the perimeter. This action stops the spread of the attack without disrupting user productivity or requiring time-consuming analysis, aligning with the priority of containment in incident response.

Exam trap

The trap here is that candidates confuse containment with eradication or investigation, choosing to delete emails (Option D) or analyze them (Option C) first, when the immediate priority is to stop the attack vector at the gateway to prevent further compromise.

Why the other options are wrong

Disabling users' accounts is a more disruptive step that should be taken after containing the email threat at the gateway. The immediate priority is to block the malicious email source to prevent further users from clicking the link, not to disable accounts of users who already clicked.

Deleting emails from mailboxes does not prevent users from clicking similar future emails from the same sender, nor does it block the sender's ability to send more malicious emails. Containment requires blocking at the gateway to stop all emails from that sender.

When would these options actually be correct?

This would be correct if the question stated that the malicious link led to credential harvesting and the users' accounts are actively compromised, requiring immediate account lockdown to prevent unauthorized access.

This would be correct if the question asked for the best step to prevent users from accessing the malicious link after the email has already been delivered, and blocking at the gateway is not an option (e.g., email gateway is down).

Why candidates pick the wrong answer

Candidates may think that disabling accounts is the fastest way to stop further damage, but they overlook that the email gateway block is less disruptive and addresses the root cause (the email itself) rather than just the symptoms.

Candidates may think removing the malicious email from the inbox directly eliminates the threat, overlooking that the sender can still send more emails and that blocking at the gateway is more effective for containment.

Full explanation →

211

MCQeasy

Several employees receive a text message that says their payroll deposit failed and they must tap a link to verify account details. The link opens a fake login page. What type of attack is this?

A.Phishing

B.Smishing

C.Pretexting

D.Baiting

AnswerB

Smishing is a form of phishing that specifically arrives through SMS/text messaging, exploiting a channel where users are less suspicious and messages are not as heavily filtered as email. In this case, the text about payroll is an attempt to lure employees into clicking a malicious link or providing credentials, which matches smishing's signature of leveraging urgent, work-related topics to prompt immediate action. Because the delivery method is text message, smishing is the exact and correct classification.

Why this answer

Smishing is a form of phishing that uses SMS (Short Message Service) text messages as the attack vector. In this scenario, the attacker sends a fraudulent text message claiming a payroll deposit failure and includes a link to a fake login page, which is the classic mechanism of smishing. The attack relies on social engineering via SMS to trick the recipient into revealing sensitive credentials.

Exam trap

The trap here is that candidates often confuse 'smishing' with general 'phishing' because they do not differentiate the delivery vector (SMS vs. email), but the SY0-701 exam expects you to identify the specific attack type based on the communication channel used.

How to eliminate wrong answers

Option A is wrong because phishing is a broad category of social engineering attacks typically carried out via email, not specifically via SMS text messages; while smishing is a subset of phishing, the question explicitly describes an SMS-based attack, making 'smishing' the more precise term. Option C is wrong because pretexting involves fabricating a scenario (pretext) to obtain information, often through impersonation or a false backstory, but it does not necessarily involve a direct link to a fake login page or the use of SMS as the delivery mechanism. Option D is wrong because baiting relies on offering something enticing (e.g., a free download or USB drive) to lure the victim into a trap, whereas this attack uses a false sense of urgency (payroll failure) and a link to a fake login page, which is characteristic of smishing, not baiting.

Full explanation →

212

MCQmedium

An HR manager wants to share employee data with a benefits analytics vendor. The dataset includes names, employee IDs, home addresses, and medical leave codes. Security wants to reduce privacy exposure while still allowing the vendor to complete the analysis. What is the best first step?

A.Send the full file as-is if the vendor agrees not to disclose it

B.Provide only the minimum necessary fields and replace direct identifiers with project IDs

C.Keep the names but mark the spreadsheet confidential before sending it

D.Upload the file to a public cloud folder and restrict the link to the vendor

AnswerB

Providing only the minimum necessary fields and replacing direct identifiers with project IDs is a data minimization and pseudonymization technique. It reduces the amount of personal data exposed and lowers re-identification risk, while the vendor can still fulfill the benefits processing purpose. This aligns with privacy frameworks like GDPR's data minimization principle and HIPAA's minimum necessary standard, and is far stronger than relying on promises or labeling.

Why this answer

It implements data minimization, a core privacy principle, by providing only the minimum necessary fields and replacing direct identifiers (names, employee IDs) with project-specific pseudonyms. This reduces exposure of personally identifiable information (PII) while preserving the vendor's ability to perform analytics on the medical leave codes and other non-identifying data. It aligns with the CompTIA SY0-701 objective of applying privacy-enhancing techniques like anonymization and data masking.

Exam trap

The trap here is that candidates often assume a legal agreement (Option A) or confidentiality marking (Option C) is sufficient for data protection, but CompTIA emphasizes that technical controls like data minimization and pseudonymization are the first and most effective steps to reduce privacy exposure.

How to eliminate wrong answers

Option A is wrong because sending the full file as-is, even with a non-disclosure agreement, still exposes all PII (names, addresses, medical codes) to the vendor, violating the principle of least privilege and increasing breach risk. Option C is wrong because marking a spreadsheet as confidential does not technically protect the data; it relies on trust rather than technical controls like access restrictions or data masking, and the file remains fully readable. Option D is wrong because uploading to a public cloud folder with a restricted link still exposes the full dataset to anyone who obtains the link, and cloud storage does not inherently apply data minimization or pseudonymization.

Full explanation →

213

Matchingmedium

Match each procurement need to the vendor due diligence artifact or control that best fits. 1. Procurement wants independent evidence that a SaaS provider's controls operated effectively during the last year. 2. The team wants to know what files, libraries, and modules were included in a supplier's software build. 3. The business needs a signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs. 4. The procurement team wants answers about MFA, logging, and incident response before onboarding a cloud supplier.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

SOC 2 Type II report

Software bill of materials (SBOM)

Data processing agreement (DPA)

Security questionnaire

Why these pairings

Each artifact or control directly addresses the procurement need: SOC 2 Type II provides independent audit evidence; SBOM lists software components; DPA is the legal agreement for data handling; security questionnaires gather specific security practices; pen test reports validate controls; BCP ensures continuity.

Full explanation →

214

MCQmedium

Based on the exhibit, which change best reduces the risk of lateral movement if a user workstation is compromised?

A.Add more workstations to VLAN 10 so authentication requests are faster.

B.Require administrative access through a hardened bastion host and restrict direct management from user devices.

C.Disable logging on the servers so attackers leave fewer traces if they connect.

D.Move all servers into the same VLAN as the workstations for easier access control.

AnswerB

A bastion host creates a controlled management path instead of allowing every workstation to talk directly to servers. Restricting direct SSH and RDP from the user VLAN reduces attack surface and supports a zero-trust-style approach to administration.

Why this answer

Requiring administrative access through a hardened bastion host enforces a jump-box architecture, which eliminates direct RDP, SSH, or WinRM from user workstations to servers. This segmentation prevents an attacker who compromises a user workstation from using stolen credentials or tools to laterally move to sensitive servers, as all management traffic must pass through a controlled, monitored, and often multi-factor-authenticated bastion host.

Exam trap

CompTIA often tests the misconception that adding more resources to a VLAN or disabling logging improves security, when in fact these actions weaken segmentation and reduce visibility, respectively.

How to eliminate wrong answers

Option A is wrong because adding more workstations to VLAN 10 does not reduce lateral movement risk; it increases the attack surface and does not address the need for network segmentation or access control between user devices and servers. Option C is wrong because disabling logging on servers removes the audit trail that is critical for detecting and investigating lateral movement, directly violating security best practices and compliance requirements. Option D is wrong because moving all servers into the same VLAN as workstations collapses the security boundary, allowing any compromised workstation to directly reach servers without any network-level controls, thereby increasing lateral movement risk.

Full explanation →

215

MCQeasy

A finance manager gets a phone call from someone claiming to be the CEO's assistant, urgently requesting a wire transfer before a board meeting. What type of attack is this?

A.Smishing

B.Vishing

C.Spear phishing

D.Watering-hole attack

AnswerB

Vishing, or voice phishing, is a social engineering technique that uses phone calls to impersonate a trusted entity while manufacturing urgency or fear to manipulate the victim into revealing sensitive information or performing a financial action. The finance manager's situation directly matches this pattern because the attacker uses real-time voice interaction and a claimed identity to exploit trust.

Why this answer

B is correct because vishing (voice phishing) uses a phone call to socially engineer the victim into performing a sensitive action, such as a wire transfer. The attacker impersonates a trusted authority (the CEO's assistant) and exploits urgency to bypass normal verification procedures. This is distinct from text-based phishing (smishing) or targeted email attacks (spear phishing).

Exam trap

The trap here is that candidates confuse the delivery method (phone call) with the attack type, often choosing 'spear phishing' because the target is a specific individual, but the defining characteristic is the voice channel, not the targeting precision.

How to eliminate wrong answers

Option A is wrong because smishing relies on SMS/text messages, not voice calls, to deliver the phishing lure. Option C is wrong because spear phishing is a targeted email attack that uses personalized content, not a real-time phone conversation. Option D is wrong because a watering-hole attack compromises a legitimate website frequented by the target group to deliver malware, not a direct social engineering call.

Full explanation →

216

MCQmedium

A vulnerability scan produces these results: - Finding 1: High severity, internet-facing VPN appliance, known exploit available, no compensating controls - Finding 2: Critical severity, internal development workstation, requires authenticated local access - Finding 3: Medium severity, test server, no public exploit and not reachable from outside Which finding should be remediated first?

A.Finding 1

B.Finding 2

C.Finding 3

D.All findings are equal because the severity rating alone determines priority

AnswerA

Finding 1 carries the highest realistic risk: it is internet-facing, has a known exploit available, and lacks compensating controls, so an attacker can reach and exploit it remotely without credentials. Finding 2 needs authenticated local access, and Finding 3 has no public exploit and no external reachability, lowering urgency.

Why this answer

Finding 1 should be remediated first because it combines high severity with an internet-facing attack surface and a known exploit, meaning an attacker can remotely compromise the VPN appliance without authentication or compensating controls. This creates an immediate and direct risk of network breach, unlike the other findings which require local access or are isolated from external threats.

Exam trap

The trap here is that candidates prioritize by severity alone (Critical > High) without considering the attack vector, exploitability, and network exposure, which are key to risk-based prioritization in the SY0-701 exam.

How to eliminate wrong answers

Option B is wrong because although the severity is critical, the vulnerability requires authenticated local access, meaning an attacker must already have a foothold inside the network, making it less urgent than an internet-facing exploit. Option C is wrong because medium severity on a test server with no public exploit and no external reachability poses minimal immediate risk, as exploitation requires both access and a custom attack. Option D is wrong because severity rating alone does not determine priority; factors like exposure, exploit availability, and compensating controls must be considered in risk-based remediation.

Full explanation →

217

MCQmedium

During a restore test, a technician brings back a file server successfully, but the application team discovers that the database is missing the last 12 hours of transactions. Management says the business can tolerate only one hour of data loss. What should be changed first?

A.Reduce the restore point objective by storing more copies of the same backup.

B.Implement application-consistent backups or transaction log backups more frequently.

C.Extend the retention period so the full backup is kept for 90 days.

D.Shorten the recovery time objective by using faster storage for the server.

AnswerB

Implementing application-consistent backups or transaction log backups more frequently directly reduces the recovery point objective (RPO) by shortening the interval between captured changes. Application-consistent backups ensure the database is in a valid state, while transaction log backups record every committed transaction, enabling point-in-time recovery to a precise moment. If the maximum tolerated data loss is one hour, capturing transaction logs every 15 minutes satisfies that target, whereas nightly full backups alone could lose up to 24 hours of data.

Why this answer

The core issue is that the database is missing 12 hours of transactions, which exceeds the business's tolerance of one hour of data loss. This indicates that the Recovery Point Objective (RPO) is not being met. Implementing application-consistent backups or more frequent transaction log backups ensures that the database state can be recovered to a point within the acceptable loss window, directly addressing the RPO gap.

Exam trap

The trap here is confusing Recovery Point Objective (RPO) with Recovery Time Objective (RTO), leading candidates to select options that improve restore speed (RTO) or backup retention rather than addressing the frequency of backups needed to limit data loss.

How to eliminate wrong answers

Option A is wrong because reducing the Restore Point Objective (RPO) by storing more copies of the same backup does not change the frequency of backups; it only increases redundancy, which does not reduce data loss. Option C is wrong because extending the retention period (e.g., keeping full backups for 90 days) addresses how long backups are kept, not how recent the recoverable data is, so it does not solve the RPO issue. Option D is wrong because shortening the Recovery Time Objective (RTO) by using faster storage focuses on how quickly the server can be restored, not on minimizing data loss, which is an RPO concern.

Full explanation →

218

MCQmedium

A threat report says an attacker changes domains daily and rehosts infrastructure in cloud VPS environments, but the phishing email wording, login-page flow, and PowerShell download behavior remain the same. What type of information is most useful for a durable detection rule?

A.Only the current malware hash from the latest sample

B.The attacker’s behavioral pattern and technique sequence

C.The names of the victim company’s departments

D.A screenshot of the phishing email subject line only

AnswerB

Technique-based indicators are more durable because the attacker can rotate infrastructure without changing core behavior.

Why this answer

The attacker's behavioral pattern and technique sequence remain consistent even as infrastructure changes. A durable detection rule should focus on the invariant TTPs (Tactics, Techniques, and Procedures) such as the phishing email wording, login-page flow, and PowerShell download behavior, which are stable indicators of compromise (IOCs) that persist across domain and IP changes. This aligns with the MITRE ATT&CK framework's emphasis on detecting adversary behaviors rather than ephemeral artifacts like hashes or IP addresses.

Exam trap

CompTIA often tests the misconception that static IOCs like hashes or subject lines are reliable for detection, when in fact behavioral patterns and technique sequences provide durable detection against rapidly changing infrastructure.

How to eliminate wrong answers

Option A is wrong because malware hashes change with each new sample, making them ephemeral IOCs that cannot provide durable detection when the attacker rehosts infrastructure daily. Option C is wrong because victim company department names are irrelevant to the attacker's technical behavior and do not help detect the phishing or download sequence. Option D is wrong because a screenshot of the phishing email subject line is a static, easily changed artifact that does not capture the invariant login-page flow or PowerShell download behavior.

Full explanation →

219

MCQmedium

A help desk ticket confirms that a user entered corporate credentials into a fake sign-in page. Minutes later, the security team finds a new mailbox forwarding rule and evidence that the attacker added backup MFA codes. After disabling the account, what should the team do next to support containment and recovery?

A.Wait for the user to confirm the behavior before taking any further steps.

B.Reimage the user's laptop before reviewing the account activity.

C.Revoke active sessions and reset the compromised credentials.

D.Close the ticket because MFA was enabled and should have prevented access.

AnswerC

After disabling the account, the next step is to cut off any valid sessions and reset the credential set so the attacker cannot continue using stolen access. Because the compromise includes mailbox changes and MFA backup code manipulation, session revocation and credential reset are essential containment and recovery tasks.

Why this answer

After disabling a compromised account, the immediate next step is to revoke all active sessions and reset the credentials. This ensures the attacker cannot maintain access via existing tokens or session cookies, and the new password invalidates any cached or stolen credentials. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes cutting off active attacker access before further investigation.

Exam trap

The trap here is that candidates assume MFA is a silver bullet and overlook that attackers can register their own MFA devices or use session hijacking, making credential reset alone insufficient without session revocation.

How to eliminate wrong answers

Option A is wrong because waiting for user confirmation delays containment and allows the attacker to continue using the account, potentially exfiltrating data or moving laterally. Option B is wrong because reimaging the user's laptop is premature and unnecessary; the compromise is credential-based, not a local system infection, and reviewing account activity first is critical to understand the scope. Option D is wrong because MFA does not prevent credential theft or session hijacking; the attacker added backup MFA codes, bypassing the protection, and closing the ticket ignores the active threat.

Full explanation →

220

MCQmedium

A workstation opens an attachment labeled as an invoice and then begins creating scheduled tasks, disabling security services, and contacting a known malicious IP address. What is the best first containment action?

A.Run a full antivirus scan while leaving the system connected

B.Isolate the workstation from the network using the EDR containment feature

C.Reboot the workstation to clear any active malicious processes

D.Uninstall the email client that delivered the attachment

AnswerB

Isolating the workstation via EDR containment immediately terminates the attacker's ability to issue commands by applying a strict host firewall rule that blocks inbound and outbound traffic, except for the management plane needed to preserve remote visibility. This severs command-and-control channels and halts lateral movement while keeping the system powered on, allowing investigators to acquire volatile memory and collect forensic artifacts. EDR containment is the preferred first response because it balances swift containment with forensic preservation, unlike more disruptive measures.

Why this answer

The workstation is actively communicating with a known malicious IP address and disabling security services, indicating an active compromise. Isolating the workstation via EDR containment immediately stops the outbound command-and-control traffic and prevents lateral movement, which is the priority first step in incident response before any remediation or analysis.

Exam trap

The trap here is that candidates often choose to run an antivirus scan or reboot first, thinking they can clean the infection, but the exam emphasizes that containment (stopping the spread and C2) is the immediate priority over remediation or removal.

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan while the system is still connected to the network does not stop ongoing malicious activity, such as C2 communication or scheduled task creation, and may allow the malware to spread. Option C is wrong because rebooting the workstation may clear active processes but does not remove persistence mechanisms like scheduled tasks, and the malware could re-establish contact with the C2 server upon reboot, while also losing volatile forensic data. Option D is wrong because uninstalling the email client does not address the active compromise already in progress; the malware is already executing and communicating, so removing the delivery vector is irrelevant to immediate containment.

Full explanation →

221

Multi-Selectmedium

A company-owned laptop is being transferred from the incident site to the evidence locker for a theft investigation. Which two actions best support chain of custody during transport? Select two.

Select 2 answers

A.Place the device in a tamper-evident evidence bag or seal

B.Document the device serial number, date, time, collector, and each handoff

C.Leave the device unsealed so legal staff can inspect it quickly

D.Boot the laptop to confirm the user’s files are still present

E.Use a personal note app instead of formal transfer documentation

AnswersA, B

Place the device in a tamper-evident evidence bag or seal. A tamper-evident seal or bag provides a physical barrier that visibly records any unauthorized opening, and the seal's unique serial number allows the package to be tracked. Sealing the laptop prevents accidental changes to data and preserves the device's state for forensic examination, which is essential for maintaining the evidence's integrity from the scene to the lab. Without such a seal, there is an unbroken opportunity for undetected tampering, undermining the legal admissibility of the evidence.

Why this answer

Placing the device in a tamper-evident evidence bag or seal provides a physical barrier that immediately reveals any unauthorized access during transport. This is a foundational chain-of-custody control that preserves the integrity of the evidence by making tampering detectable, which is critical for admissibility in legal proceedings.

Exam trap

The trap here is that candidates may think booting the laptop is necessary to verify data presence, but this action actually violates forensic preservation principles by altering the system state and potentially destroying evidence.

Full explanation →

222

MCQeasy

A caller says they are from the help desk and need the employee's MFA code to "complete a password reset". Which social engineering technique is being used?

A.Phishing

B.Pretexting

C.DDoS

D.SQL injection

AnswerB

Pretexting is a social engineering technique in which the attacker creates an invented, believable scenario and impersonates an authority figure to lower the victim's defenses. Here, the caller's fabricated 'help desk' identity is the pretext that creates urgency and legitimacy, tricking the employee into disclosing a secret code that should never be shared over an unsolicited call.

Why this answer

Pretexting is a social engineering technique where an attacker fabricates a scenario (the pretext) to trick a victim into divulging sensitive information. In this case, the attacker pretends to be from the help desk and invokes a false password reset procedure to obtain the employee's MFA code, which should never be shared. The MFA code is a time-based one-time password (TOTP) or push notification response that authenticates the user, not a tool for password resets.

Exam trap

The trap here is that candidates may confuse pretexting with phishing because both involve deception, but pretexting relies on a fabricated identity and scenario (often via phone or in-person) rather than a malicious electronic message.

How to eliminate wrong answers

Option A is wrong because phishing typically involves sending fraudulent emails or messages that contain malicious links or attachments to steal credentials or install malware, not a direct phone call requesting an MFA code under a false pretext. Option C is wrong because a DDoS (Distributed Denial of Service) attack is a network-level attack that overwhelms a target server with traffic to disrupt services, and it has no relation to social engineering or obtaining an MFA code via impersonation.

Full explanation →

223

MCQmedium

Users on the internal Wi-Fi report that the finance portal suddenly resolves to a different IP address, and the browser shows a fake login page that closely matches the real site. The DNS resolver cache on the network also contains unexpected entries for that host name. What attack is most likely?

A.ARP spoofing, because the attacker is changing the MAC address used on the local network.

B.DNS poisoning, because the attacker has corrupted name resolution so users are sent to a malicious destination.

C.Port scanning, because the attacker is probing internal services for open ports.

D.Denial-of-service, because the attacker is overwhelming the portal with traffic.

AnswerB

DNS poisoning fits the evidence because the resolver cache contains bad entries and users are being directed to a fake site through altered name resolution. That lets the attacker redirect traffic without changing the user’s bookmarks or typing habits.

Why this answer

B is correct because DNS poisoning (also known as DNS cache poisoning) directly corrupts the name resolution process, causing the finance portal's hostname to resolve to a malicious IP address. The presence of unexpected DNS resolver cache entries for that hostname confirms that the attack targeted the DNS infrastructure, not the ARP table or network availability.

Exam trap

The trap here is that candidates confuse ARP spoofing with DNS poisoning because both can redirect traffic, but ARP spoofing operates at Layer 2 and does not affect DNS resolver cache entries, whereas DNS poisoning directly corrupts the name resolution database.

How to eliminate wrong answers

Option A is wrong because ARP spoofing manipulates MAC-to-IP mappings at Layer 2, not DNS cache entries; it would cause traffic interception on the local subnet but would not explain unexpected DNS resolver cache entries. Option C is wrong because port scanning is a reconnaissance technique used to discover open ports and services, not a method to redirect users to a fake login page or corrupt DNS records. Option D is wrong because a denial-of-service attack aims to overwhelm a service with traffic to make it unavailable, not to alter DNS resolution or present a fake login page.

Full explanation →

224

Multi-Selectmedium

Which three of the following are core principles of the CIA triad in information security? (Choose three.)

Select 3 answers

.Confidentiality

.Integrity

.Availability

.Authentication

.Non-repudiation

.Authorization

Why this answer

The CIA triad is the foundational model for information security, consisting of Confidentiality, Integrity, and Availability. Confidentiality ensures data is accessible only to authorized users, often enforced through encryption (e.g., AES-256) and access controls. Integrity guarantees data has not been tampered with, using mechanisms like hashing (SHA-256) or digital signatures.

Availability ensures systems and data are accessible when needed, supported by redundancy (RAID, failover clusters) and DDoS mitigation.

Exam trap

The SY0-701 exam often tests the distinction between the CIA triad and other security objectives like AAA (Authentication, Authorization, Accounting), leading candidates to mistakenly include Authentication or Authorization as core CIA principles.

Full explanation →

225

MCQhard

A multinational corporation is implementing a secure remote access solution for its employees. The security team requires that all remote sessions be encrypted, that users authenticate with multifactor authentication (MFA), and that the solution supports granular access control based on user identity and device posture. Which of the following technologies best meets these requirements?

A.Remote Desktop Protocol (RDP) gateway with Network Level Authentication (NLA).

B.Software-defined perimeter (SDP) with zero trust network access (ZTNA).

C.SSL VPN with split tunneling and a captive portal.

D.IPsec VPN with pre-shared keys and static routing.

AnswerB

SDP with ZTNA encrypts all sessions, enforces MFA, and provides granular, identity- and context-aware access control. It creates a logical perimeter around applications, granting access only after verifying user identity and device posture. This directly meets the requirements for encryption, MFA, and dynamic access control based on user and device attributes, making it the best fit.

Why this answer

The correct answer is SDP with ZTNA. It uniquely combines encryption, MFA, and granular, context-aware access control based on user identity and device posture. Other options may provide encryption and authentication but lack the dynamic, identity-centric access control that the scenario demands.

SDP with ZTNA is designed for zero trust environments, making it the most suitable choice.

Exam trap

The trap here is assuming that any VPN with MFA provides granular access control based on device posture, when in fact traditional VPNs often grant broad network access.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 151–225