Security+ SY0-701 SY0-701 Questions 226–300 | Page 4/14

226

MCQmedium

A data analyst needs a copy of a customer file for product testing. The file includes names, email addresses, purchase history, and government ID numbers, but the test team only needs the names and purchase history. What is the BEST handling action?

A.Provide the full file because the test team is internal and already trusted.

B.Remove or mask the government ID numbers before sharing the minimum necessary fields.

C.Encrypt the file and send it by email to the entire test group.

D.Keep the file unchanged and rely on the team not to open the sensitive columns.

AnswerB

This is the best action because it follows data minimization and privacy principles. The test team does not need government ID numbers, so those fields should be removed or masked before the data is shared. Limiting the dataset to the minimum necessary information reduces privacy risk, lowers the chance of unauthorized disclosure, and aligns with common handling requirements for sensitive customer data.

Why this answer

It applies the principle of least privilege and data minimization. The test team only needs names and purchase history, so removing or masking the government ID numbers before sharing the minimum necessary fields protects sensitive personally identifiable information (PII) and complies with data protection regulations like GDPR or CCPA. This action reduces the risk of unauthorized exposure of high-risk data while still enabling the test team to perform their work.

Exam trap

The trap here is that candidates may assume internal teams are automatically trusted and fail to apply data minimization, overlooking that even trusted users should only receive the minimum data necessary for their role.

How to eliminate wrong answers

Option A is wrong because internal trust does not justify exposing sensitive government ID numbers to a team that does not need them; this violates the principle of least privilege and could lead to a data breach. Option C is wrong because encrypting the file does not address the core issue of sharing unnecessary sensitive data; the government ID numbers would still be accessible to the entire test group once decrypted, and emailing the file to the entire group increases the risk of interception or accidental forwarding. Option D is wrong because relying on the team not to open sensitive columns is a weak security control; it depends on human behavior and does not prevent accidental or malicious access to the government ID numbers, which should be removed or masked as a technical control.

Full explanation →

227

Matchingmedium

A company is redesigning how systems are separated in its office and data center network. Match each network design element to the scenario it best supports. Use each term once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

A subnet that hosts public-facing web servers while keeping them separated from the internal LAN.

Separating finance and engineering workstations on the same switches into different broadcast domains.

A rule set that allows only TCP 8443 from the web tier to the application tier and denies everything else.

Restricting east-west traffic between individual workloads inside the same data center or cloud cluster.

Grouping systems that share similar security requirements and access assumptions for policy design.

Why these pairings

VLANs separate broadcast domains, subnets divide IP networks, ACLs filter traffic, DMZs isolate public servers, VPNs provide secure remote access, and NAT translates private to public IPs.

Full explanation →

228

MCQmedium

Based on the exhibit, which awareness action should the security manager prioritize next?

A.Send the same annual awareness slide deck to everyone again without changing the content.

B.Launch role-based phishing training and reporting reinforcement for the highest-risk groups.

C.Block all external email so users cannot click suspicious messages.

D.Take no action because IT already reports suspicious messages well.

AnswerB

The results show that executives and customer support need the most help, especially because reporting is near zero for executives. Targeted training and practice campaigns are more effective than one-size-fits-all messaging because they address the actual behavior patterns shown in the exhibit.

Why this answer

The exhibit shows that the highest-risk groups (e.g., finance, executives) have the highest phishing click rates. Option B is correct because role-based phishing training targets these specific users with simulated phishing campaigns and reporting reinforcement, which directly reduces the likelihood of successful social engineering attacks. This aligns with the principle of prioritizing remediation based on risk assessment data rather than blanket training.

Exam trap

The trap here is that candidates may choose Option A (annual slide deck) because they assume any awareness training is sufficient, but the exam emphasizes that targeted, risk-based training is more effective than generic, one-size-fits-all approaches.

How to eliminate wrong answers

Option A is wrong because sending the same annual awareness slide deck without changes fails to address the specific high-risk groups identified in the exhibit, and it does not provide the hands-on, simulated phishing experience needed to change user behavior. Option C is wrong because blocking all external email is an overly restrictive technical control that would break legitimate business communication, and it does not address the root cause of user susceptibility to phishing. Option D is wrong because taking no action ignores the clear risk indicated by the high click rates in certain groups, and relying solely on IT reporting does not reduce the probability of a successful attack from users who click malicious links.

Full explanation →

229

MCQmedium

A SOC analyst sees repeated encoded PowerShell launched by mshta.exe. No new executable is written to disk, but the host makes periodic outbound connections to the same IP. Which malware characteristic is most likely?

A.Fileless attack, because the malicious activity lives in memory and uses built-in tools.

B.Worm, because the host is making outbound connections to a remote system.

C.Spyware, because the host is communicating with an external IP address.

D.Rootkit, because the system tools are being hidden from the user.

AnswerA

The malicious activity is executed entirely in memory via encoded PowerShell and mshta.exe, both of which are legitimate Windows binaries. This is the hallmark of a fileless attack: the payload never writes a separate executable to disk, so it evades traditional file-based antivirus scanning. By abusing built-in tools, the attacker achieves execution without leaving a persistent artifact, which is exactly what the evidence shows.

Why this answer

The scenario describes encoded PowerShell commands executed by mshta.exe without writing a new executable to disk, which is a classic fileless attack technique. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and mshta) to evade traditional antivirus detection, and the outbound connections are for command-and-control (C2) communication, not for self-propagation or data theft.

Exam trap

The trap here is that candidates see 'outbound connections' and immediately think of a worm or spyware, but the key differentiator is the lack of a written executable and the use of built-in tools in memory, which defines a fileless attack.

How to eliminate wrong answers

Option B is wrong because a worm self-propagates across networks without user interaction, but the description only shows outbound connections to a single IP, not scanning or spreading to other hosts. Option C is wrong because spyware specifically steals user data (e.g., keystrokes, files) and typically exfiltrates to a C2 server, but the question focuses on the execution method (memory-resident) and does not indicate data collection. Option D is wrong because a rootkit hides system objects (files, processes, registry keys) from the OS, but the scenario does not mention any concealment of tools or persistence mechanisms; it simply shows a process (mshta.exe) running PowerShell in memory.

Full explanation →

230

Multi-Selecthard

A report generator accepts a user-supplied report name and then passes it into a shell command to convert a file. During testing, a malicious value causes the server to run an unexpected system command. Which two changes best mitigate this issue while keeping the feature usable? Select two.

Select 2 answers

A.Replace shell command concatenation with a parameterized API or safe library call.

B.Apply strict server-side allowlist validation to the report name before processing.

C.HTML-encode the report name before inserting it into the shell command.

D.Switch the feature from POST to GET so the values are easier to inspect.

E.Hide the server error messages so attackers cannot see the failure details.

AnswersA, B

Avoiding direct shell invocation removes the attacker-controlled command injection path. A safe API or library call passes data as data instead of executable syntax. This is the most effective fix because it eliminates the dangerous pattern rather than trying to filter every possible payload.

Why this answer

Replacing shell command concatenation with a parameterized API or safe library call prevents command injection by ensuring user input is treated as data, not executable code. This is the most effective mitigation because it eliminates the injection vector entirely, rather than trying to sanitize or validate input that may still be passed to a shell interpreter.

Exam trap

The trap here is that candidates often choose HTML encoding (Option C) thinking it sanitizes all injection types, but HTML encoding only prevents XSS, not command injection, which requires shell-specific escaping or, better, avoiding shell invocation altogether.

Full explanation →

231

MCQmedium

A network engineer needs to change an ACL on a production firewall so a new SaaS integration works. The business cannot tolerate an extended outage, and the change must be reversible if testing fails. Which practice best fits?

A.Make the change directly during business hours without documentation

B.Follow formal change management with approval, testing, and rollback planning

C.Disable logging temporarily so the firewall change applies faster

D.Ask the vendor to modify the firewall remotely without internal review

AnswerB

Formal change management ensures that the ACL modification is vetted against security policy, tested in a non-production environment or with a peer review to catch ordering errors or unintended broad access. It provides a documented change window, an escape plan to revert the firewall to a known-good configuration, and post-implementation validation that the SaaS integration works without weakening the firewall posture. This aligns with ITIL and NIST change management practices, ensuring auditability and accountability for a production network change.

Why this answer

Formal change management ensures the ACL modification is documented, tested in a staging environment, and includes a rollback plan (e.g., reverting to a saved configuration or applying a 'no' command for the specific ACL entry). This minimizes downtime by allowing controlled implementation and immediate reversal if the SaaS integration fails, aligning with the business's zero-tolerance for extended outages.

Exam trap

The trap here is that candidates may think making changes quickly (Option A) or disabling logging (Option C) is acceptable for a 'simple' ACL change, but the SY0-701 exam emphasizes that any production change must follow formal change management to ensure reversibility and minimize risk.

How to eliminate wrong answers

Option A is wrong because making changes directly during business hours without documentation violates change management principles, risks unplanned outages, and provides no rollback path, which is unacceptable for a production firewall. Option C is wrong because disabling logging does not speed up ACL application—firewall ACLs are processed in hardware or software regardless of logging state; it only hides audit trails, making troubleshooting and rollback harder. Option D is wrong because asking the vendor to modify the firewall remotely without internal review bypasses security controls, violates the principle of least privilege, and could introduce unauthorized changes or misconfigurations that are not reversible by the network engineer.

Full explanation →

232

MCQmedium

Based on the exhibit, which identity architecture change best addresses the repeated password resets and delayed offboarding across the company's SaaS applications? Exhibit: - SaaS A uses local user accounts - SaaS B uses local user accounts - SaaS C supports SAML and automated provisioning - Help desk reports 120 password reset tickets per month - Former employees can remain active in two apps for up to 24 hours after termination Management wants one sign-in and faster deprovisioning.

A.Implement federated SSO with the enterprise identity provider and automated provisioning for SaaS users.

B.Create one shared account for each application and store the passwords in a vault.

C.Keep local accounts in every SaaS app and reset passwords whenever staff change roles.

D.Put the SaaS apps behind a network firewall and use source IP filtering instead of identity.

AnswerA

This is the best answer because federation centralizes authentication, and automated provisioning improves lifecycle management. Users sign in once through the identity provider, reducing password fatigue and help desk resets. When accounts are created, modified, or removed centrally, access changes can reach supported applications much faster, which helps with offboarding and reduces orphaned access.

Why this answer

Implementing federated SSO with the enterprise identity provider (IdP) centralizes authentication, allowing users to sign in once. Combined with automated provisioning (SCIM), it enables near-instant deprovisioning when an employee is terminated, eliminating the 24-hour delay and reducing password reset tickets by removing the need for local account management.

Exam trap

The trap here is that candidates confuse network-layer controls (firewall, IP filtering) with identity-layer solutions, failing to recognize that only federated SSO with automated provisioning addresses both single sign-in and rapid deprovisioning across SaaS apps.

How to eliminate wrong answers

Option B is wrong because shared accounts violate the principle of least privilege and non-repudiation; password vaults do not solve delayed offboarding or reduce password resets, as shared credentials still require manual rotation and do not integrate with identity lifecycle management. Option C is wrong because keeping local accounts and resetting passwords on role changes does not address the 120 monthly password reset tickets (it perpetuates them) and fails to provide faster deprovisioning, as local accounts remain active until manually disabled. Option D is wrong because network firewall and source IP filtering control access at the network layer, not the identity layer; they cannot enforce per-user authentication, single sign-on, or automated deprovisioning, and former employees could still access apps from allowed IPs.

Full explanation →

233

MCQmedium

A security analyst is investigating a series of alerts from the web application firewall. Users are reporting that when they view a product review page on the company's e-commerce site, their browser automatically redirects to a malicious website. The analyst examines the database and finds that a product review submitted by a user contains a <script> tag that loads a JavaScript file from an external domain. Which type of attack has occurred?

A.Cross-site request forgery (CSRF)

B.Stored cross-site scripting (XSS)

C.SQL injection

D.Reflected cross-site scripting (XSS)

AnswerB

Stored (persistent) XSS occurs when untrusted input, such as a product review, is saved by the server and later rendered as executable JavaScript in the browsers of all visitors to that page. Because the payload is embedded directly in the stored HTML and retrieved from the database on each page load, it executes in the victim's session context without requiring a crafted URL. This enables attackers to steal cookies, impersonate users, or modify page content, making it significantly more damaging than reflected XSS, which relies on a one-time request and isn't persistent.

Why this answer

The attack is stored cross-site scripting (XSS) because the malicious <script> tag was permanently stored in the product review database. When any user views the product review page, the browser loads and executes the external JavaScript file from the attacker's domain, causing an automatic redirect to a malicious website. This matches the classic stored XSS pattern where payload persists in server-side storage and executes in the victim's browser context.

Exam trap

The trap here is confusing stored XSS with CSRF because both involve user interaction and redirects, but stored XSS is about injecting persistent client-side code, while CSRF forges requests without injecting scripts.

Why the other options are wrong

The attack involves malicious script stored in the database and executed when users view the product review page, which is stored XSS, not CSRF. CSRF tricks a user into performing unwanted actions on a trusted site, not injecting scripts.

The attack involves malicious script stored in the database and executed when users view the page, not SQL code injection into queries.

The attack involves a <script> tag stored in the database and executed when users view the product review page, which is characteristic of stored XSS, not reflected XSS. Reflected XSS would require the malicious script to be part of the request (e.g., in a URL parameter) and reflected back immediately, not stored persistently.

When would these options actually be correct?

A user is logged into their banking site and clicks a link that submits a fund transfer request without their knowledge. The question would describe the user being authenticated and the attack leveraging that session to perform actions on their behalf.

A question where an attacker inputs SQL commands into a web form (e.g., login field) to manipulate the database, such as bypassing authentication or extracting data, and the application does not sanitize inputs.

Reflected XSS would be correct if the malicious script is embedded in a URL (e.g., in a search query or error message) and the server reflects it back without proper sanitization, causing the browser to execute it. For example, a user clicks a crafted link like https://example.com/search?q=<script>alert('XSS')</script> and the script executes in the response.

Why candidates pick the wrong answer

Candidates may confuse the automatic redirection with a forged request, not realizing that the root cause is injected script execution rather than a cross-origin request forgery.

Candidates may confuse any database-related attack with SQL injection, especially when the attack vector involves submitting data that ends up in the database.

Candidates may confuse stored and reflected XSS, focusing on the presence of a <script> tag and redirection without considering whether the payload is stored in the database or reflected from the request.

Full explanation →

234

MCQmedium

After restoring a virtual file server from backup, users can browse folders, but an accounting application reports missing recent transactions. What should the administrator do next?

A.Mark the restore complete because the file server is reachable

B.Verify the restore in an isolated test environment and compare application data consistency

C.Immediately run a new full backup over the restored server

D.Disable the accounting application permanently to prevent further inconsistency

AnswerB

Restoring into an isolated lab environment allows you to boot the recovered virtual machine without affecting production traffic, then run application-level integrity checks on the accounting data. Compare database row counts, checksums, or last transaction timestamps against a known-good baseline, and validate that transaction logs are consistent with the application's journal. This confirms the backup is not just restorable, but that the application can operate on the recovered data, making it the only definitive validation of a successful restore.

Why this answer

The correct next step is to verify the restore in an isolated test environment and compare application data consistency. Although the file server is reachable and folders appear intact, the accounting application's missing recent transactions indicate that the restored data may be stale or incomplete. Testing in isolation ensures the application's database or transaction logs are consistent with the backup point before returning the server to production, preventing data corruption or loss.

Exam trap

The trap here is that candidates assume file server accessibility equals a successful restore, overlooking the critical distinction between file-level availability and application-level data consistency, which is a common focus in CompTIA SY0-701 Security Operations questions.

How to eliminate wrong answers

Option A is wrong because marking the restore complete based solely on file server reachability ignores application-level data integrity; the accounting application's missing transactions prove the restore is incomplete or inconsistent. Option C is wrong because immediately running a new full backup over the restored server would overwrite the current state without validating data consistency, potentially preserving corruption or missing data in the backup chain. Option D is wrong because disabling the accounting application permanently is an extreme, unnecessary action that does not address the root cause of data inconsistency and disrupts business operations.

Full explanation →

235

MCQeasy

Which document should define mandatory settings such as full-disk encryption, a 10-minute screen-lock timeout, and removal of local administrator rights on company laptops?

A.Policy, because it explains the general direction but not the exact settings.

B.Standard, because it defines specific required configurations that must be followed.

C.Procedure, because it lists the steps an end user should take every day.

D.Guideline, because it offers flexible recommendations rather than mandatory rules.

AnswerB

This is correct because a standard turns policy into measurable, mandatory requirements. Exact settings such as encryption, screen-lock timing, and administrative restrictions belong in a standard since they must be applied consistently across similar systems. Standards help administrators implement security in a uniform, auditable way.

Why this answer

A standard defines mandatory, specific technical configurations that must be uniformly applied across all company laptops. The question lists concrete settings (full-disk encryption, 10-minute screen-lock timeout, removal of local admin rights) that are not open to interpretation, which aligns precisely with the role of a security standard in enforcing baseline compliance.

Exam trap

The trap here is that candidates confuse 'policy' (high-level direction) with 'standard' (specific mandatory configuration), leading them to pick A when the question explicitly lists concrete, enforceable settings rather than general principles.

How to eliminate wrong answers

Option A is wrong because a policy states high-level intentions and management direction (e.g., 'laptops must be secured'), but does not include the exact technical settings like '10-minute screen-lock timeout' or 'full-disk encryption'. Option C is wrong because a procedure describes step-by-step actions an end user or administrator must perform (e.g., 'how to enable BitLocker'), not the mandatory configuration values themselves. Option D is wrong because a guideline offers flexible, non-mandatory recommendations (e.g., 'consider using full-disk encryption'), whereas the question explicitly requires mandatory settings that must be followed.

Full explanation →

236

MCQmedium

A customer portal runs on a single application server behind a database cluster. Leadership wants the portal to keep working if that application server fails, but the budget is tight and the team wants the simplest design that can automatically fail over. What should they add?

A.A second application server configured as an active-passive failover pair with health checks.

B.A cold backup server that is started manually after the outage is detected.

C.A multi-region active-active deployment with global traffic steering.

D.Additional RAID storage in the application server to prevent service interruption.

AnswerA

An active-passive pair provides automatic failover for a single server failure without the cost and complexity of a larger multi-node design. Health checks let the standby take over when the primary becomes unavailable, which matches the stated availability goal and budget constraint.

Why this answer

An active-passive failover pair with health checks provides automatic failover at the lowest complexity and cost. The passive server remains on standby, and health checks (e.g., ICMP, TCP port checks, or HTTP GET requests) detect application server failure, triggering automatic IP or service takeover. This meets the requirement for automatic failover without the expense and complexity of active-active or multi-region designs.

Exam trap

The trap here is that candidates often confuse high availability with disaster recovery, assuming that a cold backup or RAID storage provides automatic failover, when in fact only a hot standby with health checks meets the automatic requirement without over-engineering the solution.

How to eliminate wrong answers

Option B is wrong because a cold backup server that is started manually does not provide automatic failover; it requires human intervention, which violates the requirement for automatic failover. Option C is wrong because a multi-region active-active deployment with global traffic steering is far more complex and expensive than needed for a single application server failure; it introduces DNS-level steering, cross-region replication, and higher operational overhead. Option D is wrong because additional RAID storage only protects against disk failure within the server, not against the entire application server failing; it does not provide any server-level redundancy or failover capability.

Full explanation →

237

MCQmedium

Based on the exhibit, which cloud service model best fits the application's operational and security requirements?

A.Infrastructure as a Service (IaaS), because it gives full control over the guest operating system.

B.Platform as a Service (PaaS), because it offloads OS and runtime maintenance while preserving application control.

C.Software as a Service (SaaS), because the organization would not need to maintain anything.

D.Colocation, because the team can place its own servers in a provider facility and manage everything directly.

AnswerB

PaaS fits the requirements because the provider manages the underlying platform, including OS patching, runtime maintenance, and scaling features. The development team can still deploy code and manage the application layer and data model, which matches the scenario. This is a strong secure-service-selection choice when the goal is to reduce patching burden without giving up application control.

Why this answer

The exhibit shows an application that requires the organization to manage the application code and data while offloading the underlying OS, runtime, and middleware maintenance. Platform as a Service (PaaS) provides this exact split: the cloud provider handles the OS patches, runtime updates, and infrastructure scaling, while the organization retains full control over the application deployment and configuration. This matches the requirement of preserving application control without the overhead of managing the guest OS.

Exam trap

The trap here is that candidates see 'full control' in option A and assume it is always better for security, but the question's requirement to offload OS maintenance makes PaaS the correct choice—IaaS would actually increase the security burden by requiring the organization to manage guest OS hardening and patching.

How to eliminate wrong answers

Option A is wrong because IaaS gives full control over the guest OS, but the requirement specifically states the organization does not want to manage the OS or runtime—IaaS would force them to handle patching, hardening, and maintenance of the OS, which contradicts the operational need. Option C is wrong because SaaS would offload everything, including application control, but the requirement explicitly says the organization must preserve control over the application code and data—SaaS removes that control entirely. Option D is wrong because colocation requires the organization to manage all hardware, OS, and software layers themselves, which is the opposite of offloading OS and runtime maintenance; it also introduces physical security and hardware lifecycle burdens not aligned with the stated requirements.

Full explanation →

238

Multi-Selecteasy

A company is building a public web app with three tiers. Internet users should reach only the web tier, and the app tier should never be reachable from the internet. Which two network design choices support this goal? Select two.

Select 2 answers

A.Place the web server in a DMZ or public-facing zone.

B.Allow inbound traffic from the internet directly to the application servers.

C.Restrict the application tier so only the web tier can initiate connections to it.

D.Put the database on the guest Wi-Fi VLAN.

E.Use the same flat network for all three tiers.

AnswersA, C

A DMZ is the standard perimeter network for internet-facing services because it provides a controlled buffer between untrusted public traffic and the internal corporate network. By placing the web server in the DMZ, you can open inbound TCP/80 and TCP/443 from the internet while using firewall rules to limit what the web server can access inside the boundary. This ensures that even if the web tier is compromised, the attack is contained to the DMZ and does not grant direct reach into the application or database layers. The DMZ design is a foundational defense-in-depth control for three-tier architectures.

Why this answer

Placing the web server in a DMZ (demilitarized zone) or public-facing zone allows internet traffic to reach only the web tier while isolating the internal network. This is a standard security architecture where the DMZ acts as a buffer, and firewall rules permit inbound HTTP/HTTPS (ports 80/443) only to the web servers, not to the application or database tiers.

Exam trap

The trap here is that candidates may think placing the app tier behind a firewall alone is sufficient, but they must also explicitly restrict inbound connections to only the web tier, not just block the internet—otherwise internal lateral movement or misconfigured rules could still expose the app tier.

Full explanation →

239

MCQhard

Based on the exhibit, which temporary control best reduces risk until the patch is released?

A.Increase scan frequency to daily and leave the service exposed.

B.Place the service behind a reverse proxy or WAF and restrict access with source IP allow lists.

C.Disable TLS so the traffic can be inspected more easily.

D.Move administrative access to the same 443 listener as user traffic.

AnswerB

The service must stay online, but the patch is unavailable, so the best temporary measure is to reduce exposure. A reverse proxy or WAF can filter malicious requests, and source IP allow lists shrink the reachable attack surface. Together, those controls act as an effective compensating measure until the vendor fix is released and can be applied.

Why this answer

Placing the service behind a reverse proxy or Web Application Firewall (WAF) with source IP allow lists provides a temporary compensating control that reduces the attack surface until the vendor releases a patch. The reverse proxy or WAF can inspect and filter malicious traffic, while IP allow lists restrict access to trusted sources only, mitigating the risk of exploitation without removing the service entirely.

Exam trap

CompTIA often tests the misconception that increasing monitoring (scan frequency) is a sufficient compensating control, when in fact it does not prevent exploitation—only detection is improved.

How to eliminate wrong answers

Option A is wrong because increasing scan frequency does not reduce risk; it only detects potential issues sooner, leaving the vulnerable service exposed to active exploitation. Option C is wrong because disabling TLS removes encryption, exposing all traffic to interception and tampering, which violates confidentiality and integrity, and does not address the underlying vulnerability. Option D is wrong because moving administrative access to the same 443 listener as user traffic increases the attack surface by merging management and user channels, making it easier for an attacker to target administrative functions.

Full explanation →

240

MCQmedium

An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically sound image while protecting the original media?

A.Mount the drive read-write so the investigator can browse it quickly.

B.Use a hardware write blocker and create a bit-by-bit forensic image with hashes.

C.Copy only the user profile folders with a file manager to save time.

D.Boot the laptop normally and use backup software to duplicate the disk.

AnswerB

This is the best practice because a hardware write blocker prevents any accidental writes to the source drive, and a bit-by-bit image captures the exact data structure for analysis. Hashing the source or image before and after acquisition provides integrity verification, which is essential when evidence may be challenged later. Together, these steps protect the original media and support chain of custody and courtroom admissibility.

Why this answer

Forensic best practice requires preserving the original media in an unaltered state. A hardware write blocker physically prevents any write commands from reaching the drive, ensuring the original evidence is not modified. Creating a bit-by-bit forensic image (e.g., with `dd` or FTK Imager) captures the entire drive, including slack space and unallocated sectors, and generating cryptographic hashes (SHA-256 or MD5) before and after imaging verifies the image's integrity for court admissibility.

Exam trap

The trap here is that candidates may think booting the laptop or using a file manager is acceptable for a quick preview, but any write access—even seemingly harmless metadata updates—renders the evidence inadmissible under Daubert or Frye standards.

How to eliminate wrong answers

Option A is wrong because mounting the drive read-write allows the operating system to write metadata (e.g., timestamps, directory entries) to the drive, altering the original evidence and breaking the chain of custody. Option C is wrong because copying only user profile folders with a file manager omits critical data such as deleted files, file system metadata, and unallocated space, which may contain evidence; it also modifies file access times. Option D is wrong because booting the laptop normally writes temporary files, logs, and registry changes to the drive, and backup software typically does not create a bit-for-bit copy, altering the original media and compromising forensic soundness.

Full explanation →

241

Multi-Selecteasy

A network analyst reviews packet captures from a subnet where users intermittently lose access to the gateway. Which two findings would most strongly indicate ARP spoofing? Select two.

Select 2 answers

A.Repeated unsolicited ARP replies map the gateway IP to a different MAC address.

B.Several hosts suddenly send gateway traffic to the same unexpected MAC address.

C.Extra DNS traffic appears during the lunch hour.

D.A switch port negotiates a slower speed than usual.

E.The wireless network name appears in a site survey.

AnswersA, B

Repeated unsolicited ARP replies are a classic sign of spoofing on a LAN. In normal operation, hosts send ARP replies only in response to requests; a gratuitous ARP reply announcing the gateway IP with an attacker's MAC address forces all hosts to update their ARP cache to that malicious mapping. This lets the attacker intercept or modify traffic intended for the gateway, enabling man-in-the-middle attacks.

Why this answer

ARP spoofing involves an attacker sending forged ARP replies to associate the gateway's IP address with the attacker's MAC address. Repeated unsolicited ARP replies mapping the gateway IP to a different MAC address is a classic indicator, as legitimate ARP replies are normally solicited by requests. This causes traffic intended for the gateway to be redirected to the attacker, enabling interception or disruption.

Exam trap

CompTIA often tests the distinction between ARP spoofing (unsolicited ARP replies) and ARP cache poisoning (where the attacker responds faster than the legitimate host), and candidates may confuse extra DNS traffic or physical issues with ARP-based attacks.

Full explanation →

242

MCQhard

Based on the exhibit, what is the BEST fix for the vulnerability being exploited? A user with a standard account can retrieve documents by changing the `docId` value in the request. The application returns another employee's file without any authorization error.

A.Add client-side JavaScript to hide document IDs from the user interface.

B.Enforce server-side object-level authorization checks before returning any document.

C.Require users to change passwords more frequently to prevent unauthorized document access.

D.Place the document server behind a load balancer to prevent direct access to the application.

AnswerB

The application must validate, on the server, that the authenticated user is explicitly authorized to access each requested document before returning any data. This means enforcing object-level authorization checks such as ownership, role, or relation-based access control for every individual record, not just at the endpoint level. Called Broken Object Level Authorization (BOLA), this fix directly resolves the insecure direct object reference and prevents tampering with resource identifiers.

Why this answer

The vulnerability is an Insecure Direct Object Reference (IDOR), where the application trusts user-supplied input (the `docId` parameter) without verifying that the authenticated user is authorized to access the requested document. The best fix is to enforce server-side object-level authorization checks before returning any document, ensuring that the server validates the user's permissions against the specific resource ID before processing the request.

Exam trap

The trap here is that candidates may confuse client-side hiding (option A) with a valid security control, but the SY0-701 exam emphasizes that all access control must be enforced server-side, as client-side controls are trivially bypassed.

How to eliminate wrong answers

Option A is wrong because client-side JavaScript hiding of document IDs is security by obscurity and can be easily bypassed by inspecting network traffic or modifying requests with tools like Burp Suite; it does not prevent direct manipulation of the `docId` parameter. Option C is wrong because requiring more frequent password changes addresses credential management, not authorization flaws; it does not prevent an authenticated user from accessing unauthorized documents via IDOR. Option D is wrong because placing the document server behind a load balancer only distributes traffic and does not enforce any authorization checks; it does not mitigate the underlying issue of missing access controls on individual objects.

Full explanation →

243

Matchingeasy

Match each cloud security concept to the best description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines which security tasks belong to the cloud provider and which remain with the customer

Separates one customer's cloud resources from another customer's resources

Uses the provider's logging service to record workload and control-plane activity

Places workload resources where they are not directly exposed to the internet

Why these pairings

Each cloud security concept is matched to its primary function: encryption protects data at rest or in transit, IAM manages access, SIEM provides event analysis, IDS detects intrusions, and DLP prevents data loss.

Full explanation →

244

MCQmedium

A security analyst at a financial firm notices a significant increase in DNS queries from an internal server to a rarely visited external domain. The queries are for unusual subdomain names that contain encoded data. The server is not a DNS server and does not typically generate outbound traffic. Which of the following is the MOST appropriate immediate action for the analyst to take?

A.Block all outbound DNS traffic from the server immediately.

B.Isolate the server from the network to prevent further data loss.

C.Create a firewall rule to log all further DNS queries from the server.

D.Run an antivirus scan on the server.

AnswerB

Isolation effectively stops the ongoing DNS tunneling by severing the server’s network connectivity. This contains the incident, prevents additional data exfiltration, and provides a controlled environment for further forensic analysis. It aligns with standard incident response procedures.

Why this answer

The server is exhibiting signs of a DNS data exfiltration attack, where encoded data is being tunneled through DNS queries to an external domain. Isolating the server immediately stops the data loss and prevents further compromise, which is the most critical first step in incident response. Blocking traffic or scanning alone would not halt the active exfiltration, and logging without action allows continued data theft.

Exam trap

The trap here is that candidates choose to log or scan first, mistaking detection for containment, but the SY0-701 emphasizes immediate isolation to stop data loss in active exfiltration scenarios.

Why the other options are wrong

Blocking all outbound DNS traffic immediately could disrupt legitimate services and does not address the potential data exfiltration already occurring; isolation is preferred to stop the threat without impacting other systems.

Creating a firewall rule to log further DNS queries is a passive monitoring step that does not immediately stop the potential data exfiltration or compromise. Given the evidence of encoded data in DNS queries, the priority is to contain the threat by isolating the server, not just logging additional activity.

Running an antivirus scan is a reactive, slower step that does not immediately stop potential data exfiltration via DNS tunneling. The server is already compromised and actively sending data, so isolation is needed first.

When would these options actually be correct?

If the question stated that the server is critical and cannot be isolated, and the analyst has confirmed that blocking DNS will not affect business operations, then blocking DNS queries would be appropriate to stop ongoing data exfiltration.

This option would be correct in a scenario where the analyst needs to gather forensic evidence of suspicious activity without disrupting operations, such as when investigating a low-priority anomaly that does not indicate an active breach, and the server is not critical to immediate security.

An antivirus scan would be the most appropriate immediate action if the question described a user reporting a slow computer with pop-ups and unknown processes, and the goal is to identify and remove malware without network disruption.

Why candidates pick the wrong answer

Candidates may think blocking the suspicious traffic is a quick fix, but they overlook the need to contain the threat first and avoid collateral damage to other services.

Candidates may choose this because logging seems like a safe, non-disruptive step that preserves evidence, but they overlook the urgency of stopping potential data exfiltration indicated by encoded DNS queries.

Candidates often default to antivirus as a standard response to any security incident, overlooking the urgency of stopping active data exfiltration in this specific scenario.

Full explanation →

245

Multi-Selecteasy

Before approving a new payroll SaaS provider, the security team wants independent evidence that the vendor's controls operated effectively during the last year and wants the contract to clearly define security responsibilities. Which two items should they request or review? Select two.

Select 2 answers

A.A SOC 2 Type II report

B.A sales presentation from the vendor account team

C.The vendor's public blog posts

D.Contract clauses covering security responsibilities and incident notification

E.A screenshot of the login page

AnswersA, D

A SOC 2 Type II report is the strongest evidence because an independent auditor tests and verifies that the vendor's security controls were not only designed properly but also operated effectively over a defined period, typically 6–12 months. This report directly addresses the trust services criteria of security, availability, processing integrity, confidentiality, and privacy, making it a reliable, third-party attestation for a payroll SaaS provider. It provides concrete assurance that control mechanisms such as access management, encryption, and incident response are actually functioning, which is exactly what a security team needs before approving a vendor.

Why this answer

A SOC 2 Type II report provides independent, audited evidence that a vendor's controls (e.g., security, availability, confidentiality) were operating effectively over a specified period (typically 6–12 months). This directly meets the requirement for independent evidence of control effectiveness over the last year, unlike a point-in-time assessment.

Exam trap

The trap here is that candidates often confuse a SOC 2 Type I report (point-in-time design review) with a Type II report (operational effectiveness over time), or they mistakenly believe that marketing materials or user interface screenshots can substitute for independent audit evidence.

Full explanation →

246

Multi-Selecthard

A Linux operations team must run a nightly maintenance script on 70 servers to rotate logs and restart one service. Security will not allow interactive SSH logins, and the script should only have the permissions required for those two commands. Which two configuration choices best meet the requirement? Select two.

Select 2 answers

A.Create a dedicated automation account and restrict it in sudoers to the exact commands needed.

B.Place the automation account in the root group so it can restart services everywhere.

C.Use SSH key authentication with a restricted shell or forced command for the automation account.

D.Copy the administrator's personal password into the script so the job can log in unattended.

E.Approve the job through email one time, then allow the script to run with no restrictions forever.

AnswersA, C

A dedicated account makes auditing clear, and sudoers restrictions enforce least privilege for only the approved commands.

Why this answer

Creating a dedicated automation account and restricting it in sudoers to the exact commands needed (e.g., `/usr/sbin/logrotate` and `/usr/bin/systemctl restart <service>`) enforces the principle of least privilege. This ensures the account can only execute the specific maintenance tasks without granting interactive SSH access or unnecessary permissions.

Exam trap

The trap here is that candidates often assume placing an account in a privileged group (like root) is acceptable for automation, but CompTIA tests the principle of least privilege, requiring exact command restriction rather than broad group membership.

Full explanation →

247

Matchingeasy

Match each network segment to the best use in a small enterprise.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Network segment for internet-facing services such as a public web proxy or reverse proxy

Segment for internal systems such as databases that should not be directly reachable from the internet

Restricted network used for switch, firewall, and server administration traffic

Internet-only network for visitors and unmanaged devices

Why these pairings

Each segment serves a specific purpose: guest Wi-Fi for external users, DMZ for public services, internal LAN for daily operations, management for device control, data center for core infrastructure, VPN for secure remote access.

Full explanation →

248

MCQmedium

A system administrator must run a weekly maintenance script that stops and restarts two services on 50 Linux servers. Security says the job must not use an interactive login and should have only the permissions needed for that task. What is the best approach?

A.Use the root account for the scheduled job so it always succeeds.

B.Create a dedicated account with sudo rights limited to the required service commands.

C.Ask an administrator to log in manually each week and run the script.

D.Store the administrator password in the script so the task can authenticate automatically.

AnswerB

Creating a dedicated, non-interactive service account and granting it only the sudo commands the script requires (for example, `/usr/bin/systemctl restart myservice` with `NOPASSWD`) allows the scheduled job to run unattended while strictly limiting its blast radius. In the `/etc/sudoers` file, you can specify the exact command path and permitted arguments, so even a compromised script cannot pivot to a root shell or modify system files outside those commands. This design follows least privilege and provides a clear audit trail because `sudo` logs which user executed which command. It is a standard, secure pattern for automated operational tasks.

Why this answer

It follows the principle of least privilege by creating a dedicated service account with sudo rights restricted to only the specific service management commands (e.g., systemctl restart serviceA.service && systemctl restart serviceB.service). This avoids using the root account (which has unrestricted access) and eliminates the need for interactive logins or embedded credentials, while still allowing the scheduled job (e.g., via cron) to run non-interactively.

Exam trap

The trap here is that candidates may assume root is necessary for service management on Linux, but sudo with carefully scoped commands provides the same functionality without granting full root privileges.

How to eliminate wrong answers

Option A is wrong because using the root account for a scheduled job violates the principle of least privilege and unnecessarily exposes the entire system to potential compromise if the script is tampered with. Option C is wrong because requiring manual interactive login each week defeats automation, introduces human error risk, and does not scale to 50 servers. Option D is wrong because storing the administrator password in the script is a severe security risk (credential exposure) and violates the requirement to avoid interactive login, as the password would be visible in plaintext or easily reversible.

Full explanation →

249

MCQmedium

An administrator pushed a firewall rule change to allow a new vendor IP range during business hours. Minutes later, payroll users lost access to an internal service. Which change management practice would have best reduced the impact?

A.Apply changes directly in production so they take effect as quickly as possible.

B.Test the change in a staging environment and include a rollback plan in the request.

C.Avoid documenting the change until after the maintenance window ends.

D.Use verbal approval from the payroll manager instead of the normal ticket process.

AnswerB

This is the best practice because staging validation can reveal unintended access impacts before production is touched. A rollback plan gives operators a fast, documented way to restore service if the change breaks something critical. Together, testing and rollback planning reduce outage duration and support safer operational hardening by making the change controlled, reviewable, and reversible.

Why this answer

Testing the change in a staging environment first would have revealed any unintended side effects, such as ACL conflicts that blocked payroll traffic. Including a rollback plan ensures that if the change causes issues in production, the administrator can quickly revert the firewall rule to restore service. This aligns with the change management process of minimizing impact through controlled testing and contingency planning.

Exam trap

The trap here is that candidates may think speed of implementation (Option A) is more important than safety, but CompTIA emphasizes that change management processes, including testing and rollback, are critical to prevent production outages.

How to eliminate wrong answers

Option A is wrong because applying changes directly in production without prior testing increases the risk of disrupting services, as seen when the new vendor IP range inadvertently blocked payroll users. Option C is wrong because avoiding documentation until after the maintenance window violates change management best practices and makes it difficult to identify or revert the change when an incident occurs. Option D is wrong because using verbal approval bypasses the formal change control process, leaving no audit trail and increasing the chance of unauthorized or uncoordinated changes that can cause outages.

Full explanation →

250

MCQmedium

A public web application is seeing bursts of requests that contain SQL metacharacters, encoded script tags, and attempts to POST to administrative endpoints. The team wants a control that can inspect HTTP traffic and block the malicious requests before they reach the app. What should be deployed?

A.A web application firewall in front of the application

B.An endpoint detection and response agent on the web server only

C.A data loss prevention rule on the email gateway

D.A network access control system for user authentication

AnswerA

A web application firewall (WAF) inspects inbound HTTP/S traffic at Layer 7, parsing request bodies, headers, and query strings for attack signatures such as SQL injection or cross-site scripting payloads. Deployed inline in front of the application, it can filter and block malicious bursts before the web server processes them, and many WAFs also provide rate limiting and bot mitigation to handle traffic spikes. This is precisely the control designed to stop application-layer injection attempts.

Why this answer

A web application firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), analyzing request payloads for SQL metacharacters, encoded script tags (XSS), and unauthorized POST attempts to administrative endpoints. By deploying a WAF in front of the web application, malicious traffic is filtered and blocked before it reaches the application server, providing a proactive security control against common web attacks such as SQL injection and cross-site scripting.

Exam trap

The trap here is that candidates may confuse a WAF with a network firewall or an IDS/IPS, but the question specifically mentions HTTP traffic inspection and blocking of application-layer attacks (SQLi, XSS), which is the precise domain of a WAF, not a general network firewall or host-based EDR.

How to eliminate wrong answers

Option B is wrong because an endpoint detection and response (EDR) agent on the web server only monitors and responds to threats at the host level (e.g., file changes, process anomalies) after traffic has already reached the server; it does not inspect or block incoming HTTP requests at the network perimeter. Option C is wrong because a data loss prevention (DLP) rule on the email gateway is designed to monitor and prevent the unauthorized transmission of sensitive data via email, not to inspect or block HTTP traffic targeting a web application.

Full explanation →

251

MCQmedium

A help desk ticket reports that a user's Microsoft 365 mailbox sent hundreds of messages to external contacts, and the user says they are still receiving MFA prompts they did not start. The attacker may still have an active web session. What is the best first containment action?

A.Delete the suspicious sent messages and close the ticket.

B.Revoke the account's active sessions and reset the password immediately.

C.Wait until the end of the workday to avoid interrupting the user.

D.Reimage the user's laptop before touching the email account.

AnswerB

Ending active sessions cuts off any stolen cookies or tokens that may still be valid, and resetting the password prevents immediate reentry. In an email compromise, the attacker often keeps access through browser sessions even after credentials change. Fast containment should focus on terminating current access paths first, then investigating forwarding rules, OAuth grants, and sign-in history.

Why this answer

The user is still receiving unsolicited MFA prompts, indicating an attacker likely has an active web session with a valid token. Revoking all active sessions immediately invalidates any existing tokens or cookies, while resetting the password ensures the attacker cannot re-authenticate. This is the fastest way to cut off the attacker's access and stop further abuse of the mailbox.

Exam trap

The trap here is that candidates may think deleting the sent messages is sufficient containment, failing to recognize that the attacker's active session must be terminated to stop ongoing compromise.

How to eliminate wrong answers

Option A is wrong because deleting the suspicious messages does not remove the attacker's access; they can continue sending more emails, and the root cause (compromised session) remains unaddressed. Option C is wrong because waiting until the end of the workday gives the attacker more time to exfiltrate data, send additional malicious emails, or escalate privileges, violating the principle of immediate containment.

Full explanation →

252

Multi-Selecteasy

A branch office has users, finance workstations, and printers on the same LAN. Management wants finance devices isolated from general users while still allowing approved printing and internet access. Which two changes best meet this goal? Select two.

Select 2 answers

A.Put finance systems in a separate VLAN.

B.Use firewall or ACL rules between the VLANs.

C.Remove the default gateway from all finance devices.

D.Place all systems in one flat subnet.

E.Use hubs instead of switches to simplify traffic flow.

AnswersA, B

Creating a separate VLAN for finance systems establishes a Layer 2 logical boundary that isolates broadcast domains and restricts ARP-based reconnaissance. Any inter-VLAN traffic must be routed through a Layer 3 device, which inherently reduces lateral movement and allows the finance segment to be governed by distinct security policies, such as stricter access controls and monitoring. This is the foundational step for network segmentation and directly supports compliance requirements like PCI DSS.

Why this answer

Placing finance systems in a separate VLAN (Option A) segments the LAN into isolated broadcast domains, preventing general users from directly accessing finance workstations at Layer 2. This is a foundational step for network segmentation, as VLANs logically separate traffic without requiring physical re-cabling.

Exam trap

The trap here is that candidates often think VLANs alone provide security, forgetting that inter-VLAN routing is enabled by default on most switches, so ACLs or firewall rules are mandatory to actually restrict traffic between VLANs.

Full explanation →

253

MCQhard

Based on the exhibit, which change best moves the ERP recovery design toward meeting both recovery targets?

A.Increase the full backup frequency to every night and keep the same recovery process.

B.Add a warm standby database with 15-minute log shipping and scheduled failover tests.

C.Move backup media to the same server to reduce transfer time.

D.Eliminate differential backups and rely only on weekly full backups.

AnswerB

A warm standby reduces recovery time because the system is already provisioned and closer to operational readiness. Pairing it with 15-minute log shipping also improves the recovery point objective by limiting data loss. Scheduled failover tests validate that the process works in practice, which is critical when tight RTO and RPO targets must both be met.

Why this answer

Adding a warm standby database with 15-minute log shipping significantly reduces the recovery point objective (RPO) to near-zero and, combined with scheduled failover tests, ensures the recovery time objective (RTO) is met. This directly addresses the gap between the current backup-only approach and the required recovery targets, as log shipping provides near-continuous data protection and failover testing validates the recovery process.

Exam trap

The trap here is that candidates may think increasing backup frequency (Option A) is sufficient to meet recovery targets, but they overlook that backups alone do not reduce RTO and that a warm standby with log shipping is required for near-zero RPO and fast failover.

How to eliminate wrong answers

Option A is wrong because increasing full backup frequency to every night still leaves up to 24 hours of potential data loss, failing to meet a low RPO requirement, and does not improve recovery time. Option C is wrong because moving backup media to the same server eliminates off-site redundancy, increasing the risk of total data loss in a disaster, and does not reduce transfer time meaningfully if the network is the bottleneck. Option D is wrong because eliminating differential backups and relying only on weekly full backups increases both RPO (up to 7 days) and RTO (longer restore time), moving further from the recovery targets.

Full explanation →

254

MCQeasy

A help desk technician receives a call from a user who says many of their documents now have strange file extensions and a ransom note appeared on the desktop. The files will not open. What type of malware is the user most likely experiencing?

A.Spyware that silently records user activity over time

B.Ransomware that encrypts files and demands payment for recovery

C.A worm that spreads mainly by scanning for other hosts

D.A rootkit that hides malicious processes from the operating system

AnswerB

Ransomware is purpose-built to deny users access to their own data by encrypting files with a symmetric algorithm, then often using asymmetric encryption to protect the key and display an on-screen ransom demand, typically with a deadline and cryptocurrency payment instruction. The user's report of many files suddenly becoming inaccessible matches the ransomware Playbook: it enumerates local and networked drives, encrypts a wide range of document and media types, and then drops a ransom note. This direct cause-and-effect link between the symptom and the malware's payload makes it the correct diagnosis.

Why this answer

The user's symptoms—unopenable files with strange extensions and a ransom note—are classic indicators of ransomware. Ransomware encrypts files using a symmetric key (e.g., AES-256) and then demands payment, typically in cryptocurrency, to provide the decryption key. This matches the scenario exactly, as the files are rendered inaccessible and a note is left behind.

Exam trap

The trap here is that candidates may confuse ransomware with a worm because both can spread rapidly, but the key differentiator is the encryption of files and the presence of a ransom demand, which is unique to ransomware.

How to eliminate wrong answers

Option A is wrong because spyware focuses on covert data collection (e.g., keystroke logging, screen captures) and does not alter file extensions or display ransom notes; it operates silently to avoid detection. Option C is wrong because a worm self-replicates across networks by exploiting vulnerabilities (e.g., SMB EternalBlue) or scanning for open ports, but it does not specifically target user documents with encryption or leave a ransom note on the desktop.

Full explanation →

255

MCQmedium

Several employees nearly entered credentials into a fake mailbox login page. The security team wants to reduce repeat mistakes quickly without overwhelming the whole company. What is the best communication approach?

A.Send a short targeted notice to the affected users with examples, warning signs, and reporting steps

B.Wait until the annual security training cycle to address the issue

C.Disable all external email until the next awareness campaign is completed

D.Send a company-wide message naming the affected employees to discourage mistakes

AnswerA

Targeted, timely communication is the best way to improve behavior quickly. A concise alert with screenshots or warning signs helps users recognize the specific threat they encountered, and clear reporting steps make it easier to respond correctly next time. This approach is practical, low disruption, and focused on the people most likely to benefit from immediate coaching.

Why this answer

A short targeted notice to the affected users is the best approach because it directly addresses the immediate threat without overwhelming the entire company. This method allows the security team to quickly reinforce specific warning signs (e.g., mismatched URLs, lack of HTTPS/TLS certificates) and reporting procedures, reducing the likelihood of repeat mistakes while maintaining operational efficiency.

Exam trap

The trap here is that candidates may choose a company-wide message (Option D) thinking it will deter others, but the SY0-701 exam emphasizes privacy and targeted remediation over public shaming or broad disruption.

How to eliminate wrong answers

Option B is wrong because waiting until the annual security training cycle would leave the vulnerability unaddressed for too long, allowing the same phishing attack to succeed repeatedly. Option C is wrong because disabling all external email is an overly drastic measure that would disrupt business operations and is not a targeted communication strategy. Option D is wrong because sending a company-wide message naming the affected employees would violate privacy and potentially cause embarrassment or retaliation, which is counterproductive to security culture and could discourage future reporting.

Full explanation →

256

MCQeasy

A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?

A.Ignore the alert because the login eventually succeeded.

B.Temporarily disable the account and open an incident for investigation.

C.Reset the password only and close the alert.

D.Reboot the user's laptop to clear any malicious activity.

AnswerB

Disabling the account immediately limits further unauthorized access while the team investigates. Because the user denies the login and the activity is unusual, the account should be contained quickly and the event escalated for incident handling.

Why this answer

The alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.

Exam trap

The trap here is that candidates may focus on the 'successful login' as a resolution rather than recognizing it as the point of compromise, leading them to incorrectly choose A or C instead of prioritizing containment.

How to eliminate wrong answers

Option A is wrong because ignoring the alert ignores the clear evidence of a successful brute-force or credential-stuffing attack; the successful login from a new city indicates the attacker gained access, so the alert must be acted upon. Option C is wrong because resetting the password alone does not address the possibility that the attacker established persistence (e.g., a backdoor or session token) or that other accounts are compromised; closing the alert without investigation violates standard incident response procedures. Option D is wrong because rebooting the user's laptop does not remediate a server-side or cloud-based account compromise; the attacker likely authenticated from a remote system, not the local device, and rebooting would not remove any malicious activity on the server or directory service.

Full explanation →

257

MCQmedium

A help desk team needs sample customer tickets in a lower environment for testing. The records contain names, phone numbers, and case details. Which approach best reduces privacy risk while still allowing useful testing?

A.Copy the production database exactly into the test system

B.Mask or tokenize the personal data before loading it into test

C.Email the records to developers so they can import them manually

D.Store the records in an unencrypted spreadsheet on a shared drive

AnswerB

Masking or tokenization transforms identifying values—such as names, email addresses, and account numbers—into realistic substitutes while preserving the format and relationships needed for functional testing. Tokenization can be reversible with a secure token vault, while masking is typically irreversible, but both reduce the blast radius if test data is compromised. This approach supports privacy regulations like GDPR and PCI DSS by ensuring real personal data is not used in non-production systems.

Why this answer

Data masking or tokenization replaces sensitive personal information (names, phone numbers) with realistic but fictitious values, preserving the dataset's utility for testing while minimizing exposure of real PII. This approach aligns with privacy best practices and regulatory requirements like GDPR or HIPAA, as the test environment never contains actual customer data.

Exam trap

The trap here is that candidates may choose Option A (exact copy) thinking it is the most efficient for testing, overlooking that privacy risk in a lower environment is a critical security concern that must be mitigated even at the cost of convenience.

How to eliminate wrong answers

Option A is wrong because copying the production database exactly into the test system exposes real PII (names, phone numbers, case details) in a lower environment that may lack production-level access controls, increasing the risk of data breach or non-compliance. Option C is wrong because emailing records containing PII to developers violates data protection principles (e.g., transmitting sensitive data over unencrypted channels) and introduces unnecessary distribution of personal data. Option D is wrong because storing records in an unencrypted spreadsheet on a shared drive provides no access control or encryption, leaving PII vulnerable to unauthorized access, theft, or accidental exposure.

Full explanation →

258

MCQmedium

A security analyst receives an alert about a user account that has been attempting to authenticate from an unusual geographic location outside of business hours. The analyst reviews the event logs and sees that the authentication attempt was successful, but the user has not reported any suspicious activity. Which of the following actions should the analyst take NEXT?

A.Disable the user account immediately to prevent further access

B.Contact the user to verify whether the authentication was legitimate

C.Continuously monitor the account for additional suspicious activity

D.Revoke all active sessions for the user account

AnswerB

Contacting the user is the appropriate next step in the incident response process. The analyst needs to confirm if the user performed the action. If the user denies it, the account is likely compromised, and the incident should be escalated. This step helps avoid false positives and ensures accurate incident handling.

Why this answer

The correct next step is to contact the user to verify whether the authentication was legitimate. Since the authentication was successful and the user has not reported suspicious activity, the analyst must first gather context from the user before taking any disruptive action. This aligns with the incident response process of validation and scoping before containment.

Exam trap

The trap here is that candidates often jump to containment (disabling the account) without first validating the alert, confusing the 'detection and analysis' phase with the 'containment, eradication, and recovery' phase of the incident response process.

Why the other options are wrong

Disabling the account immediately is premature without first verifying if the authentication was legitimate, as it could be the user themselves accessing from a remote location.

Revoking all active sessions is premature without first verifying if the authentication was legitimate; the user may have been traveling or using a VPN, and immediate revocation could disrupt legitimate work.

When would these options actually be correct?

If the question stated that the account was confirmed compromised (e.g., multiple failed attempts from unknown IPs, or the user reported suspicious activity), then disabling the account would be the correct next step to prevent further unauthorized access.

In a scenario where a user account is confirmed compromised (e.g., the user reports suspicious activity or multiple failed logins precede a successful login), the analyst should revoke all active sessions to contain the breach before further investigation.

Why candidates pick the wrong answer

Candidates may think any unusual authentication warrants immediate account disablement to stop potential threats, overlooking the need for verification first.

Candidates may think that any unusual authentication warrants immediate session termination to prevent potential damage, overlooking the need for verification first.

Full explanation →

259

MCQhard

Based on the exhibit, which additional control is the best fit to prevent employees from copying sensitive reports to removable media?

A.Block all internet access on finance laptops except for the accounting website.

B.Implement endpoint device control or DLP rules to restrict removable media use.

C.Increase the password complexity requirements for finance users.

D.Add more antivirus signatures to the endpoint protection platform.

AnswerB

This is the best control because the incident involves data being copied to USB devices. Awareness and encryption do not stop a user from transferring files to removable media. Endpoint device control or DLP can block, log, or limit USB storage use, directly reducing the exfiltration path while preserving normal internet and email access.

Why this answer

Endpoint device control or DLP (Data Loss Prevention) rules are specifically designed to monitor, block, or restrict the use of removable media such as USB drives. By implementing such controls, an organization can enforce policies that prevent sensitive data from being copied to unauthorized external storage devices, directly addressing the threat of data exfiltration via removable media.

Exam trap

The trap here is that candidates often confuse network-based controls (like web filtering) with physical data exfiltration controls, or they mistakenly believe that stronger authentication or antivirus updates can prevent intentional data copying to removable media.

How to eliminate wrong answers

Option A is wrong because blocking all internet access except for the accounting website does not prevent copying data to removable media; it only restricts network-based data exfiltration, leaving the physical USB vector unaddressed. Option C is wrong because increasing password complexity requirements only strengthens authentication, but does not control what users do with data after they are authenticated, so it has no effect on copying files to removable media. Option D is wrong because adding more antivirus signatures improves detection of known malware but does not enforce policies on data transfer to removable media; it is a reactive security measure, not a preventive control for data loss.

Full explanation →

260

Matchingeasy

Match each security principle to the best workplace example.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

A help desk technician can reset passwords but cannot open payroll records.

A customer portal uses MFA, endpoint protection, and network filtering together.

The system rechecks trust before each sensitive action, even from a managed device.

One employee creates a payment batch and a different employee approves it.

An analyst sees only the case files assigned to that investigation.

Why these pairings

Each workplace example illustrates a security principle: least privilege grants minimal access, separation of duties divides tasks, defense in depth uses multiple controls, fail safe defaults to safe state, need to know restricts data access, and accountability tracks user actions.

Full explanation →

261

MCQmedium

A cloud-hosted image-processing API accepts a URL parameter so it can download a picture and generate a thumbnail. Logs show a user submitting `http://169.254.169.254/latest/meta-data/` and receiving instance credentials in the response. Which attack is being used?

A.Cross-site scripting (XSS)

B.Server-side request forgery (SSRF)

C.Cross-site request forgery (CSRF)

D.SQL injection

AnswerB

Server-side request forgery (SSRF) lets an attacker manipulate server-side HTTP requests by supplying a crafted URL to access internal resources that are not directly reachable from the internet. In this cloud-hosted image processor, an attacker could set the URL to the cloud metadata service (e.g., 169.254.169.254) or internal admin panels, and the server's response or side effects can expose sensitive information. This is a direct match because the server inherently fetches the user-supplied URL, making it the core vulnerability.

Why this answer

The attack is Server-Side Request Forgery (SSRF) because the cloud-hosted API is tricked into making a request to the internal metadata service at the link-local address 169.254.169.254. This endpoint is only accessible from within the cloud provider's network and exposes instance credentials, which the attacker then receives in the response. SSRF exploits the server's ability to make outbound requests to internal or restricted resources.

Exam trap

The trap here is that candidates may confuse SSRF with CSRF because both involve 'forgery' and server requests, but SSRF originates from the server itself, while CSRF originates from a user's browser under the attacker's control.

How to eliminate wrong answers

Option A is wrong because Cross-Site Scripting (XSS) involves injecting malicious scripts into web pages viewed by other users, not manipulating server-side requests to internal IPs. Option C is wrong because Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser into performing unintended actions on a trusted site, not exploiting a server to fetch internal resources. Option D is wrong because SQL injection targets database queries through input fields, not HTTP requests to cloud metadata endpoints.

Full explanation →

262

MCQmedium

An investigator has just created a bit-for-bit image of a suspect's SSD using a write blocker. Before the drive is returned to evidence storage, what action most directly validates the integrity of both the original media and the image?

A.Defragment the original SSD to make later analysis faster.

B.Calculate cryptographic hashes of the source and the image and record them.

C.Compress the image file to reduce storage usage before documentation.

D.Wipe free space on the original SSD to remove deleted remnants.

AnswerB

Calculating and recording cryptographic hashes of both the source and the acquired image is the cornerstone of forensic integrity. A strong algorithm such as SHA-256 generates a fixed-length fingerprint, and when the hash values match, it proves the image is a bit-for-bit replica with no data altered or lost during acquisition. Recording those hashes in the investigator's notes or a signed report also establishes a verifiable chain of custody, allowing any independent examiner to re-run the same hash and confirm the evidence has not been modified. Without this step, there is no objective way to demonstrate that the image accurately represents the original source.

Why this answer

Cryptographic hashing (e.g., SHA-256 or MD5) generates a unique digital fingerprint of the original SSD and the forensic image. By comparing the hash values, the investigator can verify that the bit-for-bit copy is identical to the source, ensuring data integrity and admissibility in legal proceedings. This step directly validates that no data has been altered or omitted during acquisition.

Exam trap

The trap here is that candidates may confuse integrity validation with storage optimization or cleanup tasks, mistakenly thinking defragmentation or compression helps preserve evidence, when in fact they destroy the forensic integrity that hashing alone guarantees.

How to eliminate wrong answers

Option A is wrong because defragmenting an SSD alters the physical layout of data, which destroys the original evidence and violates forensic best practices; it also does not validate integrity. Option C is wrong because compressing the image file changes its binary representation, breaking the hash match with the original media and potentially corrupting evidence. Option D is wrong because wiping free space modifies the original drive, destroying potential evidence remnants and invalidating any integrity verification.

Full explanation →

263

MCQmedium

An operations manager is worried a single network administrator could quietly push an unauthorized firewall rule. The manager wants every rule change reviewed by a second person and documented before implementation. Which control best addresses this concern?

A.Enable detailed firewall logging so each packet match is written to disk.

B.Require a documented change-management workflow with two approvers before any firewall rule is applied.

C.Move the firewall appliance into a locked equipment rack.

D.Encrypt the firewall configuration backup with a strong key.

AnswerB

Correct. A documented change-management process with dual approval is an administrative control that reduces insider risk and improves accountability. It creates separation of duties, adds review before implementation, and leaves an auditable trail. That combination directly addresses the manager's concern about a single administrator making hidden changes.

Why this answer

A documented change-management workflow with two approvers directly enforces separation of duties, ensuring that no single administrator can implement a firewall rule change without peer review and documented approval. This control addresses the manager's concern about unauthorized changes by requiring a second person to review and approve before the rule is applied, which is a fundamental principle of access control and change management.

Exam trap

The trap here is that candidates may confuse detective controls (like logging) or physical controls (like locked racks) with preventive administrative controls, failing to recognize that only a documented approval workflow with two approvers directly enforces the required separation of duties to prevent unauthorized rule changes.

How to eliminate wrong answers

Option A is wrong because enabling detailed firewall logging records traffic matches after the fact, but it does not prevent a single administrator from pushing an unauthorized rule; it only provides forensic evidence. Option C is wrong because moving the firewall into a locked equipment rack provides physical security against tampering with the hardware, but it does not prevent a network administrator from remotely pushing unauthorized rule changes via the management interface. Option D is wrong because encrypting the firewall configuration backup protects the backup file from unauthorized access, but it does not control or review live rule changes made by an administrator.

Full explanation →

264

MCQmedium

A developer finds a production bug on Friday afternoon. The fix has already passed staging, but the business wants the release to be reversible if the hotfix causes trouble. Which change-management practice best satisfies both speed and control?

A.Bypass change control so the patch reaches production immediately

B.Wait for the next normal change window next week

C.Use an emergency change with a documented rollback plan and approval

D.Freeze all production changes until the next monthly review meeting

AnswerC

An emergency change is the designed mechanism for urgent fixes, allowing expedited approval from an emergency advisory board while still enforcing testing evidence and a clearly defined rollback plan. This process balances the need for speed with risk mitigation, ensuring that if the patch fails, you can reliably restore service to the previous state. Without such a formal process, the organization loses traceability and accountability for the change.

Why this answer

An emergency change with a documented rollback plan and approval provides the fastest path to production while maintaining control. This practice aligns with ITIL's emergency change advisory board (ECAB) process, which allows expedited approval for critical fixes while requiring a tested rollback procedure to ensure reversibility. The business's requirement for speed is met by bypassing the normal change window, and control is preserved through mandatory documentation and approval.

Exam trap

The trap here is that candidates may assume 'speed' means 'no process at all' (Option A), but CompTIA tests the understanding that emergency change procedures are designed to balance speed with control, not eliminate it.

How to eliminate wrong answers

Option A is wrong because bypassing change control entirely violates security governance and could lead to unauthorized changes, configuration drift, and audit failures; it sacrifices all control for speed. Option B is wrong because waiting for the next normal change window (e.g., a weekly maintenance window) fails to meet the business's need for speed, as the bug is in production and causing issues now. Option D is wrong because freezing all production changes until the next monthly review meeting is overly restrictive, preventing even this critical hotfix from being deployed, and does not address the need for a reversible release.

Full explanation →

265

MCQeasy

Based on the exhibit, what type of threat is the security team most likely seeing on the workstation?

A.Trojan

B.Fileless malware

C.Worm

D.Rootkit

AnswerB

The alert shows PowerShell launching with encoded commands, hidden execution, and no suspicious file written to disk. That behavior strongly suggests fileless malware, which relies on built-in tools and memory rather than dropping a traditional executable. The registry change also indicates persistence without a visible file-based payload.

Why this answer

The security team is most likely seeing fileless malware because the exhibit shows a PowerShell command that injects malicious code directly into memory (e.g., using Invoke-Mimikatz or a reflective DLL injection technique) without writing a persistent executable to disk. Fileless malware operates in-memory, leveraging legitimate system tools like PowerShell, WMI, or .NET to evade traditional signature-based antivirus detection, which matches the scenario described.

Exam trap

The trap here is that candidates often confuse fileless malware with a Trojan because both can use PowerShell, but the key distinction is that fileless malware avoids writing to disk, while a Trojan relies on a dropped executable file.

How to eliminate wrong answers

Option A is wrong because a Trojan is a malicious program disguised as legitimate software that typically writes itself to disk and requires user execution, whereas the exhibit shows code running in memory without a persistent file. Option C is wrong because a worm is a self-replicating malware that spreads across networks by exploiting vulnerabilities, not by executing in-memory scripts on a single workstation. Option D is wrong because a rootkit is designed to hide its presence and maintain privileged access by modifying the operating system kernel or boot process, not by running transient in-memory scripts via PowerShell.

Full explanation →

266

MCQmedium

A web application needs to be internet-facing. The web tier must accept public traffic, the application tier should be reachable only from the web tier, and the database must be reachable only from the application tier. Which design best supports this?

A.Put all three tiers on one private subnet and rely on host firewalls.

B.Use a three-tier layout with a DMZ, an application zone, and a database zone separated by firewalls.

C.Place the database in the DMZ so the web tier has lower latency.

D.Use NAT for the database server and allow inbound access from the internet.

AnswerB

This is the standard security architecture for internet-facing web applications. The DMZ exposes only the web tier to the internet, the application tier is isolated in a private zone, and the database is in a further restricted zone. Firewalls enforce strict allow-lists between zones, so even if the web server is compromised, the attacker cannot directly access the database—they must go through the application tier, which provides an additional layer of defense and monitoring. This aligns with the principle of defense in depth.

Why this answer

It implements a classic three-tier architecture with separate security zones (DMZ, application zone, database zone) each protected by firewalls. This ensures that only the web tier in the DMZ accepts public traffic, the application tier is isolated and reachable only from the web tier via firewall rules, and the database tier is further isolated and reachable only from the application tier. This layered defense aligns with the principle of defense in depth and minimizes the attack surface by enforcing strict east-west traffic segmentation.

Exam trap

The trap here is that candidates may assume a single subnet with host firewalls is sufficient for segmentation, but CompTIA tests the understanding that network-level firewalls are required to enforce strict traffic flow between tiers and prevent lateral movement in a multi-tier architecture.

How to eliminate wrong answers

Option A is wrong because placing all three tiers on a single private subnet with only host firewalls fails to provide network-level segmentation; a compromise of the web server would allow direct lateral movement to the application and database servers, bypassing the intended access controls. Option C is wrong because placing the database in the DMZ exposes it directly to public traffic, violating the requirement that the database be reachable only from the application tier and increasing the risk of data exfiltration. Option D is wrong because using NAT for the database server and allowing inbound access from the internet directly contradicts the requirement that the database be reachable only from the application tier; this would expose the database to external threats.

Full explanation →

267

Multi-Selecthard

In the finance workflow, one employee can create a payment batch but cannot approve it, and the same person also cannot view employee records that are unrelated to the task. Which two principles are being enforced? Select two.

Select 2 answers

A.Separation of duties, because creation and approval are split between different roles.

B.Need-to-know, because the employee sees only records relevant to the assigned finance task.

C.Least privilege, because every user should have no more than one permission overall.

D.Defense in depth, because multiple security technologies are layered around the finance system.

E.Zero trust, because the employee must always be treated as untrusted by the network.

AnswersA, B

Splitting initiation and approval reduces the chance that one person can commit fraud alone.

Why this answer

Separation of duties is enforced by splitting the payment creation and approval functions between different roles, preventing a single employee from committing fraud by creating and approving a payment without oversight. This principle reduces the risk of unauthorized or malicious actions by requiring collusion for abuse.

Exam trap

The trap here is confusing 'need-to-know' with 'least privilege' — need-to-know limits access to specific data based on job necessity, while least privilege limits the overall permissions (e.g., read vs. write) a user has, and candidates often pick least privilege when the scenario describes data restriction rather than permission minimization.

Full explanation →

268

Multi-Selecteasy

During business impact analysis interviews, the team needs two inputs that help determine which business services must recover first after an outage. Which two inputs are the most useful? Select two.

Select 2 answers

A.Recovery Time Objective (RTO)

B.Annualized Loss Expectancy (ALE)

C.Mean Time Between Failures (MTBF)

D.Recovery Point Objective (RPO)

E.Control self-assessment score

AnswersA, D

Recovery Time Objective (RTO) is the maximum acceptable delay between an interruption and service restoration, as determined by the business impact analysis (BIA). It directly quantifies the urgency of recovery, setting the target time within which critical functions must resume to avoid unacceptable consequences. In outage scenarios, RTO is used to prioritize which systems are brought back first.

Why this answer

Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business service, directly indicating the urgency of recovery. Recovery Point Objective (RPO) defines the maximum acceptable data loss, which influences the recovery strategy and priority. Together, they provide the two critical inputs needed to sequence recovery efforts after an outage.

Exam trap

CompTIA often tests the confusion between RTO/RPO as recovery metrics versus ALE/MTBF as risk or reliability metrics, leading candidates to select ALE because it involves financial loss, when the question specifically asks for inputs to determine recovery priority.

Full explanation →

269

MCQmedium

A support agent notices that changing `invoiceId=8842` to `invoiceId=8843` in a portal URL returns another customer's invoice PDF without any additional login prompt. The user is already authenticated to the application. Which vulnerability is most likely present?

A.Cross-site scripting

B.Broken access control

C.SQL injection

D.Cross-site request forgery

AnswerB

Broken access control occurs when the application fails to properly verify whether an authenticated user is allowed to access a specific object or resource. Changing the invoice ID reveals that authorization is missing or weak.

Why this answer

The vulnerability is broken access control (B) because the application fails to verify that the authenticated user is authorized to access the resource identified by `invoiceId=8843`. By simply changing a numeric parameter in the URL, the user can view another customer's invoice PDF without any additional authentication or authorization check. This is a classic insecure direct object reference (IDOR) flaw, which falls under the broader category of broken access control.

Exam trap

The trap here is that candidates often confuse IDOR with SQL injection because both involve manipulating input parameters, but IDOR is about missing authorization checks, not database query injection.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting malicious scripts into web pages viewed by other users, not manipulating URL parameters to access unauthorized resources. Option C is wrong because SQL injection requires the attacker to inject SQL commands into input fields to manipulate the database, whereas here the parameter change directly accesses a different resource without any database manipulation. Option D is wrong because cross-site request forgery (CSRF) tricks an authenticated user into performing unintended actions on a web application, but the scenario describes the user directly changing a URL parameter, not being tricked into submitting a forged request.

Full explanation →

270

MCQmedium

Based on the exhibit, what should the security team recommend for the finance workstation pilot?

A.Approve the pilot because the workstations are limited to read-only data and the application is signed.

B.Require the vendor to provide the missing supply-chain documentation or an approved compensating-control plan before approval.

C.Disable segmentation so the pilot can access more systems if troubleshooting is needed.

D.Let the finance director sign an informal email and skip the security review.

AnswerB

The exhibit shows a supply-chain transparency gap, so the organization should not approve based only on convenience. Requiring the missing documentation or a documented compensating-control plan supports informed risk management and reduces the chance of approving software that cannot be adequately assessed.

Why this answer

The exhibit indicates missing supply-chain documentation for the finance workstation pilot. Without this documentation, the security team cannot verify the integrity and provenance of the hardware and software, which is critical for a pilot involving sensitive financial data. Requiring the vendor to provide the missing documentation or an approved compensating-control plan ensures compliance with supply-chain risk management policies before approval.

Exam trap

The trap here is that candidates may focus on the application being signed or read-only data access (Option A) as sufficient security, overlooking that supply-chain documentation is a foundational requirement for verifying the trustworthiness of the entire workstation, not just the application.

How to eliminate wrong answers

Option A is wrong because read-only data access and signed applications do not eliminate supply-chain risks; missing documentation means the hardware/software origin and integrity are unverified, which could introduce backdoors or tampered components. Option C is wrong because disabling segmentation would violate the principle of least privilege and expose the pilot to unnecessary lateral movement risks, increasing the attack surface for potential threats. Option D is wrong because bypassing the security review via an informal email undermines the entire security program and violates policy, leaving the organization exposed to unvetted risks.

Full explanation →

271

MCQmedium

A security manager at a financial services company is proposing a new policy that would require annual background checks for all employees with access to sensitive customer payment data. The proposed policy, if implemented, would increase the organization's operational costs by approximately $200,000 per year. The manager needs to obtain formal approval to implement this policy. Which of the following groups is MOST likely to have the authority to approve this policy and allocate the necessary budget?

A.Board of directors

B.Chief Information Security Officer (CISO)

C.IT steering committee

D.Security operations team

AnswerA

The board of directors has the fiduciary responsibility and ultimate authority to approve significant policy changes that require a substantial budget allocation, such as a $200,000 annual expense for background checks. This is correct because the policy crosses functional areas (security, HR, finance) and requires formal governance approval.

Why this answer

The board of directors holds the ultimate fiduciary responsibility and authority over significant financial commitments and strategic policy changes. A $200,000 annual cost increase requires approval at the highest governance level, as it impacts the organization's budget and risk posture. The board is the only group with the formal power to allocate such a substantial operational expense and approve a new policy affecting all employees with access to sensitive payment data.

Exam trap

The trap here is that candidates often confuse operational authority (CISO) with financial governance authority (board), assuming the CISO can approve any security-related budget without recognizing that large, recurring costs require board-level approval.

Why the other options are wrong

The CISO typically manages security strategy and operations but lacks authority to approve a $200,000 budget increase for a new policy; such financial decisions require higher-level approval like the board of directors.

The IT steering committee typically oversees IT project prioritization and resource allocation, but it lacks the authority to approve a new policy requiring a $200,000 annual budget increase; such financial decisions are reserved for the board of directors.

The security operations team is an operational group responsible for day-to-day security tasks, not for approving policies or allocating budgets of this magnitude. They lack the authority to approve a $200,000 annual expense.

When would these options actually be correct?

A question asks who is responsible for approving a new security policy that does not require additional budget or significant organizational change, such as updating an existing access control procedure within the security department's authority.

An IT steering committee would be the correct approving body for a policy that involves changes to IT project priorities or resource allocation within an existing approved budget, such as approving a new security tool implementation that fits within the current fiscal year's IT budget.

In a scenario where a security operations team is asked to approve a minor procedural change that does not require additional budget, such as updating a standard operating procedure for incident response, the team would have the authority to approve it.

Why candidates pick the wrong answer

Candidates may assume the CISO has full authority over security policies and budgets, overlooking that significant financial commitments require approval from higher governance bodies like the board.

Candidates may think the IT steering committee has broad authority over IT-related policies and budgets, overlooking that significant financial commitments require higher-level approval from the board of directors.

Candidates may mistakenly believe that the security operations team, being directly involved with security, has the authority to approve security-related policies, overlooking the financial and strategic implications that require higher-level approval.

Full explanation →

272

MCQmedium

A company is publishing an internet-facing customer portal that must also query an internal database containing order history. Security wants to reduce the chance that a compromise of the portal exposes the database directly. Which design is the best choice?

A.Place the database in the same subnet as the web server and rely on host-based antivirus.

B.Place the portal in a DMZ and keep the database on an internal network with firewall rules allowing only required traffic.

C.Use NAT so the internal database does not have a public IP address.

D.Move both systems behind a VPN and require users to authenticate before visiting the portal.

AnswerB

This is the correct architecture because it establishes a clear trust boundary: the web portal sits in a DMZ with limited access, while the database remains on an internal network with granular firewall rules permitting only the specific SQL service ports and source IPs from the portal. Even if the portal is compromised, the attacker faces an additional firewall layer that restricts traffic to the internal database, preventing direct internet exposure and minimizing the blast radius by requiring legitimate application flow only. This aligns with a defense-in-depth strategy that separates public-facing services from sensitive data stores.

Why this answer

Placing the portal in a DMZ and keeping the database on an internal network with firewall rules that permit only required traffic (e.g., specific ports like 1433/TCP for SQL Server or 3306/TCP for MySQL) creates a defense-in-depth architecture. This design ensures that even if the web server is compromised, the attacker cannot directly access the database from the internet, as the internal network is isolated by the firewall and only allows traffic from the DMZ to the database on necessary ports.

Exam trap

The trap here is that candidates often confuse NAT with a security control, thinking it hides the database from attackers, but NAT alone provides no access control or network segmentation, so a compromised portal can still reach the database if they share a network.

How to eliminate wrong answers

Option A is wrong because placing the database in the same subnet as the web server eliminates network segmentation, meaning a compromise of the portal would give an attacker direct Layer 2 access to the database, and host-based antivirus is insufficient to prevent lateral movement or database exploitation. Option C is wrong because NAT only translates private IP addresses to public ones; it does not provide security isolation or prevent an attacker from reaching the database if the portal is compromised, as the database still resides on the same network segment. Option D is wrong because moving both systems behind a VPN and requiring user authentication does not isolate the database from the portal; once authenticated, users (or an attacker who compromises the portal) would have direct network access to the database, violating the principle of least privilege and network segmentation.

Full explanation →

273

MCQmedium

After a user installs a free PDF converter from an unofficial site, the browser homepage changes, the endpoint protection agent stops launching, and the system begins making periodic outbound connections to the same unfamiliar IP address. No exploit was used during installation, and the installer appeared legitimate. What type of malware best matches this behavior?

A.Worm, because the infection is spreading automatically across the network.

B.Trojan, because it masquerades as useful software while delivering hidden malicious functionality.

C.Rootkit, because the attacker must have hidden files in the kernel.

D.Spyware, because the main symptom is that the browser homepage changed.

AnswerB

A trojan is designed to look legitimate so users willingly install it, which matches the fake PDF converter. The changed homepage, disabled security tool, and recurring outbound connections are classic signs that the program is not behaving like the advertised utility. Trojans often install additional payloads, create persistence, or open remote access without the user realizing the original software was malicious.

Why this answer

B is correct because the software masquerades as a legitimate PDF converter while secretly performing malicious actions—changing the browser homepage, disabling endpoint protection, and making unauthorized outbound connections. This is the classic definition of a Trojan horse: it appears useful but contains hidden, harmful functionality. The lack of an exploit and the user's voluntary installation further confirm it is a Trojan, not a self-replicating worm or a kernel-hiding rootkit.

Exam trap

The trap here is that candidates may confuse a Trojan with a worm because both can cause network activity, but the key differentiator is that a worm spreads autonomously without user action, whereas a Trojan requires the user to intentionally run the malicious file.

How to eliminate wrong answers

Option A is wrong because a worm self-replicates and spreads automatically across a network without user interaction, whereas this infection required the user to manually install the software. Option C is wrong because a rootkit specifically hides its presence by modifying kernel-level structures (e.g., hooking system calls or hiding processes/files), but the described symptoms—homepage change, disabled endpoint protection, and outbound connections—do not indicate kernel-level concealment. Option D is wrong because spyware primarily focuses on covert data collection (e.g., keystrokes, browsing habits), and while a changed homepage can be a side effect, the core behavior here includes disabling security software and establishing persistent C2 connections, which is more characteristic of a Trojan.

Full explanation →

274

MCQmedium

The SOC has contained a mailbox compromise by resetting the password and revoking active sessions. Investigation shows the attacker created an automatic forwarding rule and added an OAuth consent grant. What should happen next to eradicate the threat?

A.Notify all employees to be more careful with email before taking any technical steps.

B.Delete the mailbox and create a new account for the user immediately.

C.Remove the malicious forwarding rule and review or revoke suspicious OAuth app grants.

D.Restore the user's messages from backup and reopen access without further review.

AnswerC

Eradication means removing the adversary's persistence mechanisms and closing the foothold they created. In a mailbox compromise, forwarding rules and unauthorized OAuth consents are common persistence methods. Removing those artifacts, then confirming no other malicious rules or delegated access remain, is the correct next step before returning the account to normal use and monitoring for recurrence.

Why this answer

The immediate next step after containment is to remove the attacker's persistence mechanisms. The malicious forwarding rule (which exfiltrates emails via SMTP) and the OAuth consent grant (which provides persistent API access) must be removed to fully eradicate the threat. Simply resetting the password and revoking sessions does not remove these backdoors, as OAuth grants persist independently of user credentials.

Exam trap

The trap here is that candidates assume a password reset and session revocation fully remediate the compromise, overlooking the fact that OAuth consent grants and mailbox forwarding rules are independent persistence mechanisms that must be explicitly removed.

How to eliminate wrong answers

Option A is wrong because notifying employees to be more careful is a general awareness step, not a technical eradication action, and it delays removing the attacker's active persistence mechanisms. Option B is wrong because deleting the mailbox and creating a new account is an overly destructive step that destroys forensic evidence and disrupts business operations; the correct approach is to surgically remove the malicious rules and grants while preserving the mailbox for investigation. Option D is wrong because restoring from backup and reopening access without reviewing or removing the forwarding rule and OAuth grant would re-introduce the same persistence mechanisms, leaving the compromise active.

Full explanation →

275

MCQhard

Based on the exhibit, which control type best describes the jump host requirement?

A.Preventive control, because the jump host blocks unauthorized access before it reaches the payroll server.

B.Detective control, because session recording helps the team discover misuse after the fact.

C.Compensating control, because the jump host provides an alternate safeguard when the application cannot enforce MFA directly.

D.Directive control, because the administrators are being instructed to use a specific access path.

AnswerC

The jump host is a compensating control because it reduces risk by providing an alternate security measure when the original control cannot be implemented on the legacy payroll application. MFA, logging, and session recording on the jump host help offset the application's limitation without requiring a risky replacement. The goal is risk reduction through a substitute safeguard.

Why this answer

The jump host is implemented as a compensating control because the payroll server's application cannot natively enforce multi-factor authentication (MFA). Instead of leaving the server unprotected, the jump host provides an alternative security layer by requiring MFA at the jump host level, thereby compensating for the application's limitation. This aligns with the NIST definition of compensating controls as alternative safeguards that mitigate risks when primary controls are infeasible.

Exam trap

The trap here is that candidates confuse the jump host's session recording (a detective feature) with the primary reason for its deployment, which is to compensate for the lack of MFA on the payroll server.

How to eliminate wrong answers

Option A is wrong because a jump host does not block unauthorized access directly; it enforces authentication and session control, but it is not a preventive control like a firewall ACL or network segmentation that denies traffic before it reaches the target. Option B is wrong because session recording is a detective control, but the question asks about the jump host requirement itself, not the recording feature; the jump host's primary purpose is to enforce MFA, not to discover misuse after the fact. Option D is wrong because a directive control is a policy or instruction (e.g., a written security policy), not a technical mechanism; the jump host is a technical implementation, not a written directive.

Full explanation →

276

MCQmedium

Based on the exhibit, which change best helps the company meet its recovery objectives after a ransomware event?

A.Increase the retention period on the existing NAS backups to one year.

B.Move backups to an immutable, offline or logically isolated repository and test restores regularly.

C.Store the backup administrator password in a shared team spreadsheet so more staff can restore data quickly.

D.Replace the nightly full backup with a longer full backup window to capture more data each day.

AnswerB

An isolated, immutable backup target reduces the chance that ransomware can encrypt or delete backups. Regular restore testing confirms that the company can actually recover within the stated RTO and RPO. Because the current repository is domain-joined and reachable over SMB, it is too exposed. Isolation and tested recovery provide the strongest practical resilience improvement.

Why this answer

Ransomware often encrypts or deletes accessible backups. An immutable, offline, or logically isolated repository prevents attackers from modifying or deleting backup data, ensuring a clean recovery point. Regularly testing restores validates that the backups are functional and meet recovery objectives (RTO/RPO).

This aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for ransomware recovery.

Exam trap

The trap here is that candidates often assume longer retention or more frequent backups alone improve recovery, but they overlook the need for isolation and immutability to protect against ransomware's ability to target accessible backup data.

How to eliminate wrong answers

Option A is wrong because increasing the retention period on existing NAS backups does not protect them from being encrypted or deleted by ransomware if the NAS is network-accessible; retention alone does not provide immutability or isolation. Option C is wrong because storing the backup administrator password in a shared team spreadsheet violates the principle of least privilege and introduces a security risk; it does not improve recovery speed or integrity and could lead to unauthorized access or credential theft. Option D is wrong because replacing the nightly full backup with a longer full backup window does not inherently improve recovery objectives; it may increase the backup window and data captured but does not address ransomware resilience, and longer backups can increase exposure to corruption or encryption during the backup window.

Full explanation →

277

MCQeasy

A customer portal must continue operating if one application server fails. The business wants a simple, cost-conscious design that improves availability. What is the best approach?

A.Add a second application server behind a load balancer.

B.Schedule nightly backups to a different storage account.

C.Buy a larger server with more CPU and memory.

D.Move the portal to a different subnet without changing the servers.

AnswerA

This is the best answer because it adds redundancy and allows traffic to continue flowing if one application server goes down. A load balancer can route users to the healthy server, which improves availability without requiring a much more expensive architecture. For a simple portal, this is a practical fault-tolerance upgrade that reduces the impact of a single server failure.

Why this answer

Adding a second application server behind a load balancer creates an active-passive or active-active cluster that provides redundancy. If one server fails, the load balancer automatically redirects traffic to the healthy server, ensuring continuous operation. This design is cost-conscious because it uses commodity servers rather than expensive vertical scaling, and it directly improves availability by eliminating the single point of failure.

Exam trap

The trap here is that candidates often confuse data protection (backups) with high availability (redundancy), or they think vertical scaling (bigger server) is a simpler solution, but the exam specifically tests the concept of eliminating a single point of failure through horizontal scaling and load balancing.

How to eliminate wrong answers

Option B is wrong because nightly backups to a different storage account protect against data loss but do not provide real-time failover or maintain service availability during a server failure. Option C is wrong because buying a larger server (vertical scaling) still leaves a single point of failure; if that one server fails, the portal goes down regardless of its size. Option D is wrong because moving the portal to a different subnet changes the network topology but does not add redundancy or failover capability; the same single server remains the sole point of failure.

Full explanation →

278

MCQeasy

A vulnerability scan finds a critical flaw on an internet-facing SFTP gateway with public exploit code, and a high-severity flaw on an internal lab server that is only reachable from a restricted subnet. Which should be remediated first?

A.The internal lab server, because every high-severity finding should be fixed first.

B.The internet-facing SFTP gateway, because it has higher immediate risk.

C.Both systems can wait until the next scheduled maintenance window.

D.Neither system needs urgent action because the lab server is isolated.

AnswerB

The internet-facing SFTP gateway presents the highest immediate risk because it is directly reachable from the internet, placing it on the attack surface with no network boundary protections. If the critical flaw has known exploit code or is actively being leveraged in the wild, the gateway can be compromised without any prior lateral movement. Remediating this asset first directly shrinks the most exposed attack vector, aligning with how security teams prioritize based on exposure and exploitability.

Why this answer

The internet-facing SFTP gateway has a critical vulnerability with public exploit code, meaning it is exposed to the entire internet and can be directly attacked without any network restrictions. This creates an immediate and high-likelihood risk of remote code execution or data breach, whereas the internal lab server is isolated to a restricted subnet, significantly reducing its attack surface and exploitability. Remediation priority should be based on risk severity (likelihood × impact), not just CVSS score, making the SFTP gateway the correct first choice.

Exam trap

The trap here is that candidates fixate on the CVSS severity score (high vs. critical) without factoring in exposure, exploitability, and network segmentation, leading them to incorrectly prioritize the internal server over the internet-facing gateway.

How to eliminate wrong answers

Option A is wrong because it incorrectly assumes that all high-severity findings should be fixed first regardless of exposure; in reality, a critical flaw on an internet-facing system with public exploit code poses far greater immediate risk than a high-severity flaw on an isolated internal server. Option C is wrong because delaying remediation for a critical, internet-exposed vulnerability with known exploit code until the next scheduled maintenance window is unacceptable; such flaws require immediate action to prevent likely compromise.

Full explanation →

279

MCQhard

Based on the exhibit, what is the most likely conclusion after correlating the logs? A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.

A.This is a true brute-force attack because any failed login must be malicious.

B.This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.

C.This indicates DNS poisoning because both servers were contacted from the same source IP.

D.This is proof of ransomware spreading laterally over SMB.

AnswerB

The alert lines up with an approved maintenance window, a known jump host, and a documented configuration-management account that should only be used by automation. The mixed failed-and-successful logins are consistent with scripts negotiating authentication rather than an intruder guessing passwords. The SOC should confirm the change record, document the benign cause, and adjust correlation rules if this pattern recurs.

Why this answer

The logs show repeated login attempts from a jump host, which is a common pattern for configuration-management tools (e.g., Ansible, Puppet) that execute tasks across multiple servers. The SOC should correlate these events with the approved change window to confirm they are part of legitimate automation, not malicious activity. Failed logins alone do not indicate a brute-force attack, as automation scripts may retry connections or use cached credentials that occasionally fail due to network latency or credential rotation.

Exam trap

The trap here is that candidates assume any failed login attempt is malicious, but the SY0-701 exam tests the ability to correlate logs with operational context (e.g., change windows, known source IPs) to identify false positives from legitimate automation.

How to eliminate wrong answers

Option A is wrong because it assumes any failed login is malicious, ignoring that automation tools often generate failed login events due to transient issues (e.g., credential caching, network timeouts) and that a true brute-force attack would show a high volume of rapid, sequential attempts from an external or unexpected source IP. Option C is wrong because DNS poisoning involves manipulating DNS responses to redirect traffic to malicious IPs, which is unrelated to repeated login alerts from a jump host; the same source IP contacting multiple servers is normal for centralized management. Option D is wrong because ransomware spreading laterally over SMB would show evidence of file writes, encryption activity, or SMB session enumeration (e.g., using tools like PsExec or EternalBlue), not simply repeated login alerts from a jump host.

Full explanation →

280

MCQmedium

A help desk technician receives a phone call from someone who claims to be the CFO. The caller says they are traveling, cannot access their MFA app, and needs the technician to reset the account immediately. They also ask the technician to read back the one-time code sent to the executive's phone so they can "verify identity." What type of attack is this most likely?

A.Pretexting

B.Vishing

C.Smishing

D.Baiting

AnswerB

Vishing (voice phishing) is a form of social engineering conducted over the phone, where the attacker uses VoIP, caller ID spoofing, and a rehearsed script to impersonate a trusted entity and create a sense of urgency. In this scenario, a help desk technician receives a call from someone who is applying psychological pressure—a classic vishing tactic designed to bypass rational scrutiny and prompt quick, unverified action. The voice medium directly aligns with the definition of vishing, and because the attacker is leveraging the phone call itself to manipulate the technician, this is the most accurate and technically specific classification.

Why this answer

This is vishing (voice phishing) because the attacker uses a phone call to impersonate a trusted executive (the CFO) and manipulates the technician into bypassing MFA controls. The request to read back the one-time code is a classic social engineering tactic to capture a valid OTP, which the attacker can then use to authenticate as the CFO.

Exam trap

The trap here is that candidates may confuse vishing with pretexting, but vishing is the specific attack vector (voice call) while pretexting is the broader deception technique—the question asks for the type of attack, which is vishing.

How to eliminate wrong answers

Option A is wrong because pretexting is a broader category of fabricating a scenario to obtain information, but vishing is the specific delivery method (voice call) used here. Option C is wrong because smishing uses SMS/text messages, not a phone call. Option D is wrong because baiting involves offering something enticing (like a free USB drive) to trick a victim, not impersonating an authority figure over the phone.

Full explanation →

281

MCQeasy

After a server rebuild, a Windows administrator notices several unneeded services are still enabled, including Remote Registry and Print Spooler on a server that only hosts a database. What should the administrator do to reduce attack surface and keep the build consistent?

A.Install additional endpoint monitoring agents to compensate for the extra services.

B.Apply the approved secure baseline and disable unnecessary services.

C.Increase the disk encryption key size to protect the running services.

D.Move the server to a different subnet and leave the configuration unchanged.

AnswerB

An approved secure baseline (e.g., CIS Benchmarks or Microsoft Security Baseline) specifies the required configuration settings, including which services, roles, and features must be disabled or removed to minimize the attack surface. By comparing the rebuilt server to this baseline and then stopping or removing non-essential services, the administrator directly eliminates unnecessary listening ports, background processes, and potential privilege escalation vectors. This is the proper remediation because it addresses the root cause: the server is running services beyond what its role requires.

Why this answer

Applying an approved secure baseline and disabling unnecessary services (Option B) directly reduces the attack surface by removing potential entry points like Remote Registry (which allows remote modification of the registry) and Print Spooler (which has known privilege escalation vulnerabilities, e.g., CVE-2021-34527). This also ensures build consistency by enforcing a standardized configuration across all servers, which is critical for compliance and manageability in a Windows environment.

Exam trap

The trap here is that candidates may think adding monitoring or moving subnets compensates for insecure configurations, but the SY0-701 exam emphasizes that reducing attack surface requires removing unnecessary services, not just detecting or isolating them.

How to eliminate wrong answers

Option A is wrong because installing additional endpoint monitoring agents does not reduce the attack surface; it only adds detection capability for threats that exploit the unneeded services, leaving the vulnerabilities in place. Option C is wrong because increasing disk encryption key size (e.g., from AES-128 to AES-256 for BitLocker) protects data at rest but does not affect running services or reduce the attack surface from enabled network-facing services. Option D is wrong because moving the server to a different subnet does not disable the unnecessary services; it only changes network segmentation, and the services remain enabled and exploitable if an attacker gains access to that subnet.

Full explanation →

282

MCQmedium

Based on the exhibit, which document type should define the exact encryption algorithm and minimum key length for all company laptops?

A.Policy

B.Standard

C.Procedure

D.Guideline

AnswerB

A standard is the formal document that mandates precise, measurable technical requirements, and for cryptography this means specifying the approved algorithms (e.g., AES for symmetric, RSA/ECDSA for asymmetric) and their minimum key lengths (e.g., 2048-bit RSA). Standards bridge high-level policy to enforceable controls and serve as the compliance benchmark. They are non-optional requirements, not suggestions, making them the appropriate type for defining encryption baselines.

Why this answer

A Standard defines mandatory, specific technical requirements such as the exact encryption algorithm (e.g., AES-256) and minimum key length (e.g., 256 bits) that must be enforced on all company laptops. Policies are high-level statements of intent, while Standards provide the measurable, enforceable criteria to implement that intent. In this context, the encryption algorithm and key length are precise technical specifications, not general guidance or step-by-step instructions.

Exam trap

The trap here is that candidates confuse Policy (the 'what') with Standard (the 'how specific'), thinking a high-level statement is sufficient to define exact technical parameters, when in fact Standards are the only document type that mandates precise, measurable technical specifications.

How to eliminate wrong answers

Option A is wrong because a Policy is a broad, high-level statement of management intent (e.g., 'All laptops must be encrypted') and does not specify exact algorithms or key lengths. Option C is wrong because a Procedure is a detailed step-by-step sequence of actions to perform a task (e.g., 'How to enable BitLocker on a laptop'), not a document that defines technical parameters like encryption algorithms. Option D is wrong because a Guideline offers non-mandatory recommendations or best practices (e.g., 'Consider using AES-256'), whereas the question requires a document that defines exact, enforceable requirements.

Full explanation →

283

MCQmedium

A company uses four cloud applications and wants employees to sign in once with corporate credentials. The applications should trust the company’s identity platform, and disabling a user in the directory should remove access everywhere without separate password resets. Which architecture should the team implement?

A.Create separate local accounts in each cloud application and synchronize passwords manually.

B.Use federation with single sign-on through the corporate identity provider, such as SAML or OpenID Connect.

C.Configure RADIUS authentication directly on each cloud application so users can reuse one password.

D.Store one shared administrator password for all users in a password vault.

AnswerB

Federation with SSO lets the company authenticate users centrally while each cloud application trusts assertions from the identity provider. That supports one login experience, faster deprovisioning, and consistent enforcement of corporate authentication controls across all apps.

Why this answer

Federation with single sign-on (SSO) using the corporate identity provider (IdP) via SAML or OpenID Connect allows users to authenticate once with their corporate credentials. The cloud applications trust the IdP, so disabling a user in the corporate directory immediately revokes access across all applications without requiring separate password resets. This architecture decouples authentication from the applications and centralizes identity management.

Exam trap

The trap here is that candidates confuse RADIUS (a network access protocol) with web SSO protocols like SAML or OpenID Connect, mistakenly thinking RADIUS can provide centralized web authentication and access revocation across cloud applications.

How to eliminate wrong answers

Option A is wrong because creating separate local accounts in each cloud application with manual password synchronization does not provide single sign-on, does not centralize identity management, and disabling a user in the directory would not automatically remove access everywhere—each application would need separate account management. Option C is wrong because RADIUS is a protocol for network access control (e.g., VPN, Wi-Fi) and is not designed for web application authentication; configuring RADIUS directly on each cloud application would not enable SSO with the corporate identity platform and would require separate password management per application.

Full explanation →

284

MCQeasy

Which document tells all employees what they are allowed and not allowed to do when using company systems?

A.Policy

B.Procedure

C.Standard

D.Guideline

AnswerA

A policy states the organization’s high-level rules and expectations for behavior. It tells employees what is permitted, prohibited, or required when using company systems, such as acceptable use, data handling, or password rules. Policies are approved by management and guide the rest of the security program.

Why this answer

A policy is a high-level document that defines mandatory rules and expectations for employee behavior when using company systems. It specifies what is allowed and prohibited, such as acceptable use of email, internet browsing, and data handling, and is enforceable with consequences for non-compliance.

Exam trap

The trap here is that candidates confuse 'policy' with 'procedure' or 'guideline,' thinking that step-by-step instructions or recommendations define allowed versus prohibited actions, but only a policy sets mandatory, enforceable rules for employee conduct.

How to eliminate wrong answers

Option B is wrong because a procedure provides step-by-step instructions for completing a specific task, not a broad set of rules about allowed and disallowed actions. Option C is wrong because a standard defines mandatory technical specifications or configurations (e.g., requiring AES-256 encryption), not behavioral rules for employees. Option D is wrong because a guideline offers recommendations or best practices that are not mandatory, whereas a policy is enforceable and binding.

Full explanation →

285

MCQmedium

Based on the exhibit, which social engineering attack is most likely?

A.Phishing, because the message is a broad email that tries to trick the recipient.

B.Spear phishing, because the email is tailored to a specific employee and business context.

C.Vishing, because the attacker is using a phone call to pressure the victim.

D.Baiting, because the attacker is offering a document that the user wants to open.

AnswerB

This is spear phishing because the message is customized for a particular recipient and business process. It references an internal project, uses an invoice theme, and pressures the target to change payment details quickly. That combination of personalization and urgency is designed to increase trust and bypass normal caution.

Why this answer

Spear phishing involves crafting a message that is personalized to a specific individual or role within an organization, often referencing internal processes or names to increase credibility. In the exhibit, the email is addressed to a specific employee and mentions a legitimate-sounding business context (e.g., an internal document or procedure), which is the hallmark of spear phishing rather than a generic blast.

Exam trap

CompTIA often tests the distinction between generic phishing and spear phishing by including a message that appears personalized but still uses broad language, so candidates must look for specific contextual clues like the recipient's name or internal references to identify the targeted nature.

How to eliminate wrong answers

Option A is wrong because phishing typically refers to a mass, untargeted email sent to many recipients, whereas the exhibit shows a message tailored to a specific employee and business context. Option C is wrong because vishing (voice phishing) uses a phone call, not an email, to pressure the victim; the exhibit shows an email message. Option D is wrong because baiting involves offering an enticing item (e.g., a free USB drive or download) to trick the user, not a personalized email requesting action.

Full explanation →

286

MCQhard

A security analyst is reviewing firewall logs and notices repeated connection attempts from a single external IP address to multiple internal IP addresses on TCP port 22 (SSH). Each attempt uses a different username but the same password: 'Spring2024!'. The attempts occur sporadically over a 12-hour period. Which type of attack is most likely being observed?

A.Brute-force attack

B.Dictionary attack

C.Password spraying attack

D.Man-in-the-middle attack

AnswerC

Correct. Password spraying involves an attacker trying a small number of commonly used passwords against many different accounts to avoid lockout and evade detection. The use of a single password against many usernames exactly matches this technique.

Why this answer

This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against multiple usernames across different internal IP addresses, attempting to avoid account lockout by spreading attempts over time and targets. Unlike brute-force or dictionary attacks that focus many passwords against a single account, password spraying targets many accounts with a few weak passwords, making it harder to detect via failed login thresholds.

Exam trap

The trap here is that candidates confuse 'multiple passwords against one user' (brute-force/dictionary) with 'one password against multiple users' (password spraying), especially when the scenario mentions 'different username' and 'same password' — a classic sign of a spraying attack.

Why the other options are wrong

A brute-force attack typically involves trying many passwords for a single username, but here the same password is used across multiple usernames, which is characteristic of password spraying.

The attack uses the same password for multiple usernames, which is characteristic of password spraying, not dictionary attacks. A dictionary attack would involve trying many passwords against a single username, not a single password against many usernames.

A man-in-the-middle attack involves intercepting and potentially altering communications between two parties, not repeated login attempts from a single external IP to multiple internal IPs. The observed pattern of systematic password guessing across many accounts does not fit MITM.

When would these options actually be correct?

A brute-force attack would be correct if the logs showed repeated attempts with many different passwords against a single username, such as an attacker trying thousands of passwords on one account.

A dictionary attack would be correct if the logs showed multiple connection attempts from a single external IP to a single internal IP on TCP port 22, each attempt using a different password from a predefined list (e.g., common passwords) against the same username.

A security analyst notices that after a user connects to a corporate webmail portal, subsequent traffic from that user's machine is redirected through an attacker's proxy, capturing credentials. This would indicate a man-in-the-middle attack, where the attacker intercepts and relays communications.

Why candidates pick the wrong answer

Candidates may confuse password spraying with brute-force because both involve repeated login attempts, but they fail to notice that the attack uses a single password across many usernames rather than many passwords on one username.

Candidates may confuse password spraying with dictionary attacks because both involve using lists of passwords, but they differ in the target: dictionary attacks focus on one user with many passwords, while password spraying uses one password against many users.

Candidates may think that using the same password across multiple accounts implies credential interception, but the active, repeated attempts from an external IP indicate a direct password guessing attack, not passive interception.

Full explanation →

287

MCQmedium

A project team identifies a new risk with a high likelihood of minor data exposure during a pilot rollout. The impact is low, but the issue would become harder to address after production launch. The business owner wants the project to proceed. What should the risk owner do NEXT?

A.Ignore the issue because the impact is low.

B.Document the risk, assign an owner, and escalate for acceptance or treatment before launch.

C.Wait until after production launch to see whether the issue actually occurs.

D.Transfer the risk by moving the pilot to a different business unit.

AnswerB

This is the best next step because the risk is both identified and still manageable during the pilot. Recording it in the risk register, assigning accountability, and escalating it for acceptance or treatment ensures management makes an informed decision. Since the issue will be harder to fix after production launch, early action is important. This is classic risk governance: identify, document, assign, and decide before exposure expands.

Why this answer

The risk owner must follow the formal risk management process: document the risk, assign an owner, and escalate it to the business owner for a decision on acceptance or treatment before the pilot launch. Even though the impact is low, the high likelihood and the fact that the issue becomes harder to address post-production mean the risk cannot be ignored or deferred; it requires a documented acceptance or a mitigation plan before proceeding.

Exam trap

The trap here is that candidates assume low impact means the risk can be ignored or deferred, but the high likelihood and the worsening condition post-launch force a formal risk response before proceeding, not after.

How to eliminate wrong answers

Option A is wrong because ignoring a risk with high likelihood, even if impact is low, violates the principle of due care and could lead to cumulative data exposure or compliance issues; risk acceptance must be a conscious, documented decision by the business owner, not a unilateral dismissal. Option C is wrong because waiting until after production launch to see if the issue occurs is reactive and contradicts the proactive risk management approach required by frameworks like NIST SP 800-37, especially when the issue becomes harder to address later. Option D is wrong because transferring the risk by moving the pilot to a different business unit does not eliminate the underlying vulnerability; it merely shifts the exposure to another group without proper risk treatment or acceptance, and the original risk owner remains accountable.

Full explanation →

288

MCQmedium

An HR analyst needs to send a payroll reconciliation file to an external auditor. The file contains employee names, SSNs, bank account numbers, and salary details, but the auditor only needs employee IDs, payment totals, and a control total. What should the analyst do first?

A.Encrypt the full spreadsheet and send it without changing the contents.

B.Redact or remove unnecessary sensitive fields before sharing the minimum required data.

C.Compress the file into a password-protected archive and email the password separately.

D.Copy the file to a personal cloud storage account to make sharing easier.

AnswerB

Redacting or removing fields that are not needed for the payroll reconciliation implements data minimization and least privilege, so the recipient only sees information directly relevant to the task. Removing identifiers such as Social Security numbers, home addresses, or birth dates shrinks the potential blast radius if the file is intercepted, misdelivered, or accessed without authorization. This aligns with privacy-by-design principles and regulatory frameworks like GDPR and HIPAA, which require organizations to limit collection and sharing to what is necessary.

Why this answer

The principle of data minimization requires that only the necessary data (employee IDs, payment totals, control total) be shared with the external auditor. Redacting or removing unnecessary sensitive fields (SSNs, bank account numbers, salary details) reduces the risk of exposure and complies with privacy regulations. This step should occur before any encryption or transmission to ensure the auditor never receives data they do not need.

Exam trap

The trap here is that candidates may focus on securing the file (encryption, password protection) rather than on the fundamental security principle of data minimization, leading them to choose options that protect the data in transit but still expose unnecessary sensitive information to the recipient.

How to eliminate wrong answers

Option A is wrong because encrypting the full spreadsheet still exposes all sensitive fields to the auditor, violating the principle of least privilege and potentially breaching data protection policies. Option C is wrong because password-protecting the archive does not remove the unnecessary sensitive data; the auditor would still receive SSNs and bank details, and the password must be transmitted separately, creating additional risk. Option D is wrong because copying the file to a personal cloud storage account bypasses organizational security controls, introduces shadow IT, and does not address the need to limit data shared with the auditor.

Full explanation →

289

MCQmedium

An HR analyst must send a compensation spreadsheet to an external auditor. The auditor only needs employee names, departments, and salary totals; Social Security numbers and bank account fields are not required. What should the analyst do before sharing the file?

A.Encrypt the spreadsheet and send the full file as-is to preserve all records.

B.Remove or redact the fields the auditor does not need, then share only the minimum necessary data.

C.Store the file in a shared cloud folder and grant the auditor read-only access.

D.Convert the file to PDF so the sensitive information is harder to edit.

AnswerB

Data minimization is the best practice here. The analyst should provide only the information required for the audit and redact SSNs and bank details that are not needed. This reduces the amount of sensitive data exposed to an external party and lowers the impact of any accidental disclosure. It is the most privacy-conscious and operationally sound choice.

Why this answer

The principle of data minimization requires sharing only the information necessary for the task. By removing or redacting the Social Security numbers and bank account fields, the analyst reduces the risk of exposing sensitive personally identifiable information (PII) to the external auditor, aligning with least privilege and need-to-know principles.

Exam trap

The trap here is that candidates may focus on security controls like encryption or access restrictions (options A, C, D) without recognizing that the core issue is data minimization—removing unnecessary sensitive data before sharing, not just protecting the file in transit or at rest.

How to eliminate wrong answers

Option A is wrong because encrypting the full file does not address the unnecessary exposure of sensitive fields; the auditor would still receive Social Security numbers and bank account data, violating data minimization. Option C is wrong because storing the file in a shared cloud folder with read-only access still exposes the full dataset, including unnecessary sensitive fields, to the auditor. Option D is wrong because converting to PDF only restricts editing, but the sensitive fields remain visible in the document, failing to remove or redact them.

Full explanation →

290

MCQhard

Based on the exhibit, what is the best immediate action for the SOC or IR team? A finance workstation shows evidence of a macro-launched script, followed by file renaming and lateral SMB traffic to two other hosts. The team has not yet determined the full scope of the incident.

A.Isolate the host from the network and revoke its remote access to stop further spread.

B.Restore the workstation from backup immediately before preserving any evidence.

C.Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

D.Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

AnswerA

Isolate the host from the network and revoke its remote access to stop further spread. This is the immediate containment step in incident response. By severing the network connection, you halt active SMB propagation to neighboring systems, and revoking remote access eliminates the attacker's control channel. Containment takes priority over analysis while the compromise is actively encrypting files and moving laterally.

Why this answer

The exhibit shows a macro-launched script, file renaming, and lateral SMB traffic to two other hosts, indicating active lateral movement. Isolating the host (e.g., via network access control or disabling the switch port) immediately stops the spread of the malware to other systems, preserving the ability to investigate without further compromise. This aligns with the first step in incident response: containment before eradication or recovery.

Exam trap

The trap here is that candidates may choose Option C (vulnerability scan) because they think identifying the root cause is the priority, but in an active incident with lateral movement, containment (isolation) must come first per the NIST SP 800-61 incident response framework.

How to eliminate wrong answers

Option B is wrong because restoring from backup before preserving evidence destroys volatile data and artifacts (e.g., memory, logs, renamed files) that are critical for forensic analysis and understanding the attack vector. Option C is wrong because running a vulnerability scan is a slow, passive step that does not address the immediate active threat of lateral movement; it also risks alerting the attacker or consuming network resources during an active incident. Option D is wrong because the incident is not self-limiting—macro-launched scripts and SMB lateral movement indicate an active, potentially spreading threat that requires immediate action, not deferral to a maintenance window.

Full explanation →

291

MCQmedium

Procurement is reviewing a new payroll SaaS provider. The business wants independent evidence that the vendor's controls were designed and operating effectively over the last six months. Which document should the security team request?

A.A SOC 2 Type II report from an independent auditor.

B.A software patch list showing recent updates installed on the vendor's servers.

C.A penetration test screenshot showing one web application vulnerability was fixed.

D.An internal email from the vendor's security manager stating that controls are mature.

AnswerA

A SOC 2 Type II report is designed to show both the design and operating effectiveness of controls over a period of time. That makes it especially useful for assessing an ongoing SaaS provider relationship. It gives procurement and security an independent assurance artifact that can support vendor due diligence and third-party risk review.

Why this answer

A SOC 2 Type II report provides independent assurance that a service organization's controls are not only designed appropriately (Type I) but also operating effectively over a specified period, typically six to twelve months. This aligns directly with the procurement team's requirement for evidence of control effectiveness over the last six months, making it the correct choice for evaluating a SaaS vendor's security posture.

Exam trap

The trap here is that candidates may confuse a SOC 2 Type I (design only) with Type II (design and operating effectiveness over time), or mistakenly think a patch list or pentest result provides equivalent assurance for ongoing control effectiveness.

How to eliminate wrong answers

Option B is wrong because a software patch list shows only that updates were applied, not that the vendor's overall controls (e.g., access management, data encryption, incident response) were designed and operating effectively over time. Option C is wrong because a penetration test screenshot showing one vulnerability fixed is a point-in-time snapshot, not a comprehensive, independent assessment of control effectiveness over a six-month period. Option D is wrong because an internal email from the vendor's security manager is self-attestation and lacks the independence and rigor of an external audit; it provides no verifiable evidence of control operation.

Full explanation →

292

MCQmedium

A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?

A.Immediately block the IP address at the perimeter firewall.

B.Investigate whether any of the attempted accounts correspond to actual domain users.

C.Run a full antivirus scan on the domain controller.

D.Notify the company's legal department for law enforcement involvement.

AnswerB

This is the correct first step. If any of the random account names match legitimate domain accounts, it indicates a targeted attack and possible credential compromise. Even if no failures are logged, a successful authentication might have been recorded separately. This investigation guides subsequent containment and remediation.

Why this answer

The analyst must first determine if any of the randomly generated account names match existing domain user accounts. If a match is found, it indicates a targeted password-spraying or brute-force attack against valid accounts, requiring immediate account lockdown and credential reset. This investigation step aligns with the incident response process of identification before containment or escalation.

Exam trap

The trap here is that candidates may jump to immediate blocking (Option A) as a reflexive security action, but the SY0-701 emphasizes following the incident response process—identify and analyze before containing.

Why the other options are wrong

Blocking the IP immediately is premature without confirming the threat; the failed logins use random account names, suggesting a password spray or reconnaissance, but legitimate users might be affected if the IP is shared or spoofed.

Notifying legal/law enforcement is premature at this stage; the analyst first needs to determine if the failed logons pose an actual threat (e.g., successful brute force or valid account compromise) before escalating.

When would these options actually be correct?

In a scenario where the SOC analyst has confirmed that the source IP is a known malicious C2 server actively exploiting a critical vulnerability (e.g., EternalBlue) and causing system compromise, immediate blocking at the firewall is the correct containment step.

This would be correct if the question stated that the brute force attack successfully compromised a privileged account and sensitive data was exfiltrated, requiring legal notification for regulatory compliance or criminal investigation.

Why candidates pick the wrong answer

Candidates often default to blocking as a quick fix, but fail to consider that the incident response process requires investigation first to avoid disrupting legitimate traffic and to gather evidence.

Candidates may think that any external attack from a foreign IP warrants immediate legal involvement, overlooking the need for initial investigation and incident triage.

Full explanation →

293

MCQmedium

You are handed a company laptop suspected in an insider theft case. Legal says the evidence may be needed in court. Which action best preserves admissibility?

A.Browse the drive directly on the original laptop to identify the most relevant files.

B.Create a forensic image using a write blocker and record hash values.

C.Email the user asking them to return any copies they may have made.

D.Mount the drive read-write so searching and exporting data will be faster.

AnswerB

A forensic image taken through a write blocker is the best choice because it preserves the original media and reduces the chance of accidental modification. Recording cryptographic hash values before and after acquisition helps prove integrity and supports chain of custody. That combination is standard practice when evidence might be examined in a disciplinary, regulatory, or legal setting.

Why this answer

Creating a forensic image with a write blocker ensures the original evidence remains unaltered, preserving its integrity for court admissibility. Recording hash values (e.g., SHA-256) provides a cryptographic fingerprint that can later verify the image is an exact copy, meeting legal standards for chain of custody and authenticity.

Exam trap

The trap here is that candidates may think direct browsing or read-write mounting is faster and acceptable, but they fail to recognize that any write access—even unintentional—breaks forensic integrity and admissibility in legal proceedings.

How to eliminate wrong answers

Option A is wrong because directly browsing the drive on the original laptop modifies file metadata (e.g., last access time) and risks accidental alteration, which can break the chain of custody and render evidence inadmissible. Option C is wrong because emailing the user does not preserve evidence; it may alert the suspect, leading to data destruction, and provides no forensic integrity or verifiable chain of custody. Option D is wrong because mounting the drive read-write allows write operations that alter the original data, destroying its forensic integrity and making it inadmissible in court.

Full explanation →

294

MCQmedium

A company is implementing network segmentation to isolate the guest wireless network from the internal corporate network. Which of the following technologies is most appropriate to enforce this separation at Layer 2?

A.VLANs

B.ACLs

C.DMZ

D.VPN

AnswerA

VLANs (Virtual Local Area Networks) partition a single physical switch into multiple isolated broadcast domains at Layer 2. By assigning guest wireless traffic to a dedicated VLAN, organizations can enforce logical separation from corporate network resources on the same infrastructure, preventing direct client-to-client communication across segments. This segmentation is fundamental because it operates independently of IP addressing and can be extended across switches using trunk links, with inter-VLAN routing only permitted when explicitly configured through a firewall or router. For guest wireless isolation, VLANs are the appropriate primary technology because they provide native Layer 2 isolation that other options cannot match.

Why this answer

VLANs (Virtual Local Area Networks) are the correct technology because they operate at Layer 2 (Data Link layer) of the OSI model, allowing network administrators to logically segment a physical switch into multiple isolated broadcast domains. By assigning the guest wireless network to a separate VLAN (e.g., VLAN 100) and the internal corporate network to another (e.g., VLAN 10), traffic between them is blocked at Layer 2 unless explicitly routed through a Layer 3 device with appropriate firewall rules. This directly enforces separation without requiring additional hardware, making VLANs the most appropriate and efficient choice for isolating guest traffic at Layer 2.

Exam trap

The trap here is that candidates often confuse ACLs as a Layer 2 solution because they are commonly used for filtering, but ACLs operate at Layer 3/4 and cannot create broadcast domain isolation; VLANs are the only Layer 2 mechanism listed that directly segments traffic at the Data Link layer.

Why the other options are wrong

ACLs operate at Layer 3 (IP) or Layer 4 (TCP/UDP), not Layer 2. They cannot enforce separation based on MAC addresses or VLAN tags, which is required for isolating guest wireless from corporate networks at Layer 2.

A DMZ is a network segment that hosts public-facing services, not a technology for Layer 2 separation between guest and internal networks. It operates at higher layers and does not enforce Layer 2 isolation.

VPNs operate at Layer 3 or above, encrypting traffic between endpoints over an untrusted network, but they do not enforce Layer 2 separation between networks. The question specifically asks for Layer 2 isolation, which VLANs provide by segmenting broadcast domains.

When would these options actually be correct?

ACLs would be correct in a scenario where a company needs to filter traffic between two subnets at Layer 3, such as allowing only HTTP traffic from a guest network to the internet while blocking access to internal IP ranges.

A company needs to host a public web server that is accessible from the internet but isolated from the internal corporate network. Which network architecture should be used?

A VPN would be correct in a scenario where remote users need secure access to the internal corporate network over the internet, and the question asks for a technology to provide encrypted connectivity across an untrusted network.

Why candidates pick the wrong answer

Candidates often confuse ACLs with VLANs because both are used for network segmentation, but ACLs filter traffic based on IP addresses and ports, not at the data link layer.

Candidates may confuse DMZ as a general isolation mechanism, thinking it can separate guest from internal networks, but DMZ is specifically for external-facing services, not for internal segmentation.

Candidates may confuse VPN with network segmentation because VPNs can logically separate traffic, but they operate at higher layers and are not designed for Layer 2 isolation within a local network.

Full explanation →

295

Multi-Selecteasy

A web application must keep running if one application server fails. Management wants the simplest design that automatically switches traffic to a healthy server. Which two choices support that goal? Select two.

Select 2 answers

A.Place the application behind a load balancer with health checks.

B.Run the application on a single server with nightly backups.

C.Deploy at least two application servers in the same service pool.

D.Disable health checks to avoid false failovers.

E.Put the database on the public internet for easier access.

AnswersA, C

A load balancer can send traffic away from a failed server and toward healthy ones. Health checks are important because they let the platform detect when an instance should stop receiving requests.

Why this answer

A load balancer with health checks can automatically detect a failed application server and redirect traffic to healthy servers, ensuring continuous availability. This is the simplest design that meets the requirement for automatic failover without manual intervention. Health checks typically use HTTP/HTTPS probes or TCP port checks to verify server responsiveness.

Exam trap

The trap here is that candidates may think a single server with backups (Option B) provides high availability, but backups only protect data, not uptime, and failover requires redundant servers and automatic traffic switching.

Full explanation →

296

MCQhard

A vendor distributes a Linux package through multiple mirrors. Security wants to verify that the package really came from the vendor and was not altered after publication, even if a mirror or CDN is compromised. Which cryptographic mechanism should be checked?

A.A hash value published on the mirror site alone

B.A digital signature created with the vendor's private key

C.Symmetric encryption of the package with a shared secret

D.Key stretching with a slow password algorithm

AnswerB

A digital signature provides authenticity and integrity. If the package was signed with the vendor's private key, anyone with the matching public certificate can verify that the package came from the vendor and has not been altered since signing. This works even if the download is mirrored or relayed by an untrusted CDN, because verification does not depend on trusting the transport path.

Why this answer

A digital signature created with the vendor's private key provides both authentication (proving the package came from the vendor) and integrity (detecting any alteration after signing). Even if a mirror or CDN is compromised, the signature verification will fail if the package has been tampered with, because only the vendor's corresponding public key can validate the signature. This is the standard mechanism used by package managers like APT (with signed Release files) and RPM (with GPG signatures).

Exam trap

The trap here is that candidates confuse a simple hash (which provides integrity only if the hash source is trusted) with a digital signature (which provides both integrity and authentication even when the distribution channel is untrusted).

How to eliminate wrong answers

Option A is wrong because a hash value published on the mirror site alone provides integrity only if the hash itself is trusted; if the mirror is compromised, an attacker can replace both the package and its hash, making the verification useless. Option C is wrong because symmetric encryption with a shared secret protects confidentiality but does not provide non-repudiation or integrity verification against a compromised mirror; the shared secret would need to be distributed securely, and any party with the key could modify the package undetected. Option D is wrong because key stretching (e.g., PBKDF2, bcrypt) is a technique to slow down brute-force attacks on passwords, not a mechanism for verifying package authenticity or integrity.

Full explanation →

297

MCQeasy

A development team stores container images in a registry before deployment. Security wants to reduce the chance of shipping vulnerable libraries or packages inside the image. What should the team do before release?

A.Run the container as root so startup problems are less likely.

B.Scan the image and rebuild it from an approved base image.

C.Open the container port on the host firewall so the image can be reached faster.

D.Add more CPU and memory to the cluster to improve image security.

AnswerB

Scanning the image with a CVE-aware tool (e.g., Trivy, Grype) identifies known vulnerable packages before deployment, while rebuilding from an approved, hardened base image ensures the image starts from a patched and trusted foundation, eliminating many supply-chain risks. This is a preventive control that reduces the likelihood of an attacker exploiting a known flaw in runtime dependencies. The combination of automated scanning and trusted base images is a core DevSecOps practice.

Why this answer

Scanning the image for known vulnerabilities (CVEs) and rebuilding it from an approved, hardened base image ensures that only trusted, patched libraries and packages are included. This directly reduces the attack surface by eliminating vulnerable components before the image is deployed to production.

Exam trap

The trap here is that candidates may confuse operational practices (like running as root or opening ports) with security controls that directly address software supply chain risks, or mistakenly think that adding resources can compensate for insecure image content.

How to eliminate wrong answers

Option A is wrong because running containers as root violates the principle of least privilege and increases the risk of privilege escalation if the container is compromised. Option C is wrong because opening a container port on the host firewall does not affect the security of the image's contents; it only changes network accessibility and may increase exposure. Option D is wrong because adding CPU and memory resources does not address software vulnerabilities; resource allocation has no impact on the security of libraries or packages within the image.

Full explanation →

298

MCQmedium

A security analyst is reviewing the session management implementation of a web application. The application generates session tokens by computing the MD5 hash of the concatenation of the username and the current server timestamp rounded to the nearest hour. An attacker has obtained a valid session token for her own account and discovers that she can forge tokens for other users by simply substituting the username in the hash calculation with a known target username. Which type of attack is the web application most vulnerable to?

A.Session hijacking via cross-site scripting (XSS)

B.Session replay attack

C.Session prediction

D.Session fixation

AnswerC

The session token is generated using the username and a timestamp with low granularity, making it possible for an attacker who knows the algorithm to calculate valid tokens for any user. This is a classic session prediction vulnerability.

Why this answer

The session token is generated using MD5(username + timestamp rounded to the nearest hour). Since the attacker knows her own token and can compute the hash for any username with the same timestamp, she can predict tokens for other users. This is a classic session prediction vulnerability, as the token generation lacks sufficient entropy and relies on predictable inputs.

Exam trap

The trap here is confusing session prediction with session hijacking via XSS or session replay, but the key clue is that the attacker can compute the token herself by substituting the username, which directly indicates a predictable token generation scheme.

Why the other options are wrong

The vulnerability is in the predictable token generation (MD5 of username + timestamp), not in stealing tokens via XSS. The attacker forges tokens without needing to inject scripts or steal cookies.

A session replay attack involves capturing a valid session token and reusing it later to impersonate a user. In this scenario, the attacker is forging tokens for other users by manipulating the token generation algorithm, not replaying a captured token.

Session fixation requires an attacker to force a victim to use a known session ID, but here the attacker can compute valid tokens for any user without needing to fixate a session ID.

When would these options actually be correct?

A web application stores session tokens in cookies without HttpOnly or Secure flags, and an attacker exploits an XSS vulnerability to steal a victim's cookie and impersonate them. The question would describe a stored/reflected XSS that allows cookie theft.

A session replay attack would be correct if the question described an attacker intercepting a valid session token (e.g., via network sniffing) and reusing it to gain unauthorized access, without needing to modify the token or understand its generation method.

A web application accepts session tokens from URL parameters and does not regenerate the token after login. An attacker sends a victim a link with a predefined session ID, and after the victim logs in, the attacker uses that same session ID to hijack the session.

Why candidates pick the wrong answer

Candidates may confuse any session-related attack with session hijacking, and XSS is a common vector for stealing tokens, but here the token is forged, not stolen.

Candidates may confuse 'replay' with any attack that involves using a token obtained from one session in another, overlooking that replay specifically requires capturing and reusing an existing token without alteration.

Candidates may confuse the ability to forge tokens with the concept of fixing a session ID, as both involve an attacker controlling a session token, but the mechanisms differ.

Full explanation →

299

MCQmedium

After seizing a suspect's laptop, a responder creates a bit-for-bit disk image using a write blocker. The legal team wants the next step that most directly supports evidence integrity for later review. What should the responder do?

A.Open the image file and browse folders to confirm the contents look normal.

B.Compute and document cryptographic hash values for the source and the image.

C.Rename the image file with the case number and store it on a desktop.

D.Run a full antivirus scan on the image before logging it in.

AnswerB

The responder should hash the original source device (ideally via a write-blocked interface) and then hash the freshly created image file using a strong algorithm such as SHA-256. If the two digests match, the evidence is mathematically proven to be a bit-for-bit copy, and any future alteration can be detected by re-hashing the image and comparing to the documented value. Recording the algorithm, hash, and timestamp in the chain-of-custody gives investigators and courts an independent, verifiable method to confirm the image's integrity at any later point.

Why this answer

Computing and documenting cryptographic hash values (e.g., SHA-256 or MD5) for both the source drive and the bit-for-bit image creates a digital fingerprint. If the hashes match, it proves the image is an exact, unaltered copy of the original evidence, directly supporting integrity for later review. This step is foundational in forensic acquisition to meet legal standards for admissibility.

Exam trap

The trap here is that candidates may think browsing the image is harmless or that antivirus scans are always safe, but the exam tests the strict forensic requirement to never modify original evidence and to use hashing as the sole direct integrity check.

How to eliminate wrong answers

Option A is wrong because opening the image file to browse folders modifies metadata (e.g., last accessed timestamps) and risks altering the evidence, violating forensic best practices. Option C is wrong because renaming the file and storing it on a desktop does not provide any integrity verification; it only aids organization and may expose the image to accidental modification. Option D is wrong because running an antivirus scan on the image can modify the image file (e.g., by quarantining or deleting detected files), breaking the bit-for-bit integrity, and should only be done on a copy, not the original image.

Full explanation →

300

MCQeasy

A customer portal must keep serving requests if one application server stops responding. The team wants traffic to be sent to whichever healthy server is available. Which design should they implement?

A.A load balancer in front of multiple application servers

B.A RAID 1 array in the application server

C.A snapshot of the application server before each update

D.A longer password policy for the portal administrators

AnswerA

A load balancer sits in front of the application servers and continuously performs health checks (TCP or HTTP probes) against each node. When it detects a failed or unresponsive server, it stops sending new requests to that node and distributes the traffic among the remaining healthy servers. This provides automated failover and horizontal scaling, so the customer portal keeps serving requests even if one application instance goes down. At Layer 7, the load balancer can also inspect application responses, not just TCP connectivity, ensuring that servers with HTTP 500 errors are removed from rotation.

Why this answer

A load balancer distributes incoming traffic across multiple application servers and performs health checks (e.g., HTTP GET requests to a /health endpoint) to detect failures. If one server stops responding, the load balancer automatically routes requests only to the remaining healthy servers, ensuring continuous availability. This design directly meets the requirement for fault tolerance and active traffic distribution.

Exam trap

The trap here is that candidates confuse high availability (multiple servers with a load balancer) with data redundancy (RAID) or backup strategies (snapshots), thinking any form of redundancy solves the uptime requirement, but only a load balancer with health checks can actively reroute traffic away from a failed server.

How to eliminate wrong answers

Option B is wrong because RAID 1 (mirroring) provides disk-level redundancy for a single server, not application-level failover across multiple servers; it cannot route traffic away from a failed application server. Option C is wrong because a snapshot captures the state of a server at a point in time for backup or recovery, but it does not provide real-time traffic distribution or automatic failover when a server becomes unresponsive. Option D is wrong because a longer password policy improves authentication security for administrators but has no effect on server availability or traffic routing.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 226–300