Security+ SY0-701 SY0-701 Questions 301–375 | Page 5/14

301

Multi-Selecthard

A baseline review found that standard developer accounts are local administrators, unsigned tools can run from user profile folders, and reimaged systems still end up with unauthorized persistence. Which two changes best improve hardening while preserving developer work? Select two.

Select 2 answers

A.Remove local administrator rights from standard user accounts.

B.Enforce application allowlisting for approved executables and scripts.

C.Turn off logging to preserve disk space.

D.Allow unrestricted browser extension installs.

E.Merge all developer and production systems into one VLAN.

AnswersA, B

Removing local administrator rights from standard user accounts enforces least privilege by ensuring that malicious processes or accidental misconfigurations cannot write to protected system directories or modify security settings. Without local admin privileges, common persistence mechanisms like service creation, scheduled task manipulation, and registry run keys become far more difficult to implement. This control also contains the impact of a compromised session, limiting what an attacker can accomplish while still requiring them to find a separate privilege escalation vulnerability.

Why this answer

Removing local administrator rights from standard developer accounts enforces the principle of least privilege (PoLP). This prevents developers from making unauthorized system-wide changes, such as installing unsigned tools or creating persistence mechanisms, while still allowing them to perform their work with standard user permissions. This directly addresses the baseline review finding that standard developer accounts are local administrators, which is a common security misconfiguration.

Exam trap

The trap here is that candidates may think removing admin rights alone is sufficient, but the question requires two changes that best improve hardening while preserving developer work, and application allowlisting (Option B) is the second critical control to block unsigned tools from running in user profile folders, which removal of admin rights alone does not address.

Full explanation →

302

Matchingmedium

Match each governance need to the document type that best fits. 1. All employees must follow rules for acceptable use of company systems. 2. Every company laptop must use full-disk encryption and a 14-character screen-lock PIN. 3. The service desk follows these exact steps to verify a caller before resetting MFA. 4. Admins are encouraged to place non-production test data in approved folders when practical.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Policy

Standard

Procedure

Guideline

Why these pairings

AUP is a policy for acceptable use; standards are mandatory requirements; procedures are step-by-step instructions; guidelines are recommendations; policy is a high-level directive; baseline defines minimum configurations.

Full explanation →

303

Multi-Selecthard

A virtual file server was restored from last night’s backup. The service is online, but some finance users report missing spreadsheet changes and a few files show a 'recovered copy' timestamp. Which two checks should be completed before the team accepts the restore as successful? Select two.

Select 2 answers

A.Compare restored data against backup hashes or a manifest to verify that the copy is complete and uncorrupted.

B.Run an application-level validation test with finance users or sample transactions to confirm the data is usable.

C.Assume the restore is acceptable because the file server is online and users can browse shares.

D.Delete the previous night’s backup so the team will not accidentally restore it again.

E.Expose the restored server directly to the internet so remote users can test it faster.

AnswersA, B

Hash or manifest comparison confirms that the restored files match what was backed up and were not corrupted during storage or recovery. This is a direct integrity check and is more reliable than simply seeing that the server starts. It helps identify silent partial restores.

Why this answer

Comparing restored data against backup hashes or a manifest ensures the data integrity and completeness of the restore process. Even though the file server is online, missing spreadsheet changes and 'recovered copy' timestamps suggest possible corruption or incomplete restoration. Verifying hashes (e.g., SHA-256) against a known-good manifest confirms that every file was restored without bit-rot or truncation, which is a standard post-restore validation step in backup and recovery procedures.

Exam trap

The trap here is that candidates may assume a service being online and shares browsable is sufficient proof of a successful restore, ignoring the need for data integrity verification and application-level validation.

Full explanation →

304

MCQmedium

After a new MFA policy rollout, the SIEM generates an alert for five failed logins to a SaaS admin portal from one IP, followed by a successful login to the same account from an IP in another country. The account owner says they were in meetings all day. What should the analyst do first?

A.Disable the account immediately without checking any other logs.

B.Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.

C.Delete the alert because MFA was enabled and the login eventually succeeded.

D.Reimage the user's laptop to remove any possible malware right away.

AnswerB

This is the best first step because triage should validate the alert and establish context before disruptive containment. Correlating identity provider, VPN, and endpoint telemetry can show whether the login came from an expected corporate path, a known remote-access method, or a likely compromise. The analyst can then decide whether account disablement, password resets, or escalation is warranted based on evidence rather than a single suspicious event.

Why this answer

The alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Azure AD) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.

Exam trap

The trap here is that candidates assume MFA is infallible and ignore the geographic anomaly, leading them to delete the alert (Option C) or take premature action (Option A or D) without performing proper log correlation.

How to eliminate wrong answers

Option A is wrong because disabling the account immediately without checking other logs could disrupt legitimate access and ignores the possibility of a false positive or a misconfigured MFA policy. Option C is wrong because deleting the alert simply because MFA was enabled and the login succeeded overlooks the fact that MFA can be bypassed (e.g., via session hijacking, token replay, or social engineering), and the geographic anomaly warrants investigation. Option D is wrong because reimaging the laptop is a drastic, premature step that assumes compromise without evidence; the analyst must first confirm whether the successful login originated from the user's device or an attacker's system.

Full explanation →

305

MCQmedium

Based on the exhibit, what is the best next control to prevent noncompliant mobile devices from accessing corporate email while still allowing IT to wipe company data from lost phones?

A.Enforce conditional access so only compliant MDM-enrolled devices can reach email and enable selective wipe for corporate data.

B.Require users to set a longer password on the email app and keep the current access policy.

C.Disable email on all mobile devices and force users to use desktop computers only.

D.Rely on a remote full factory reset whenever a device is lost or reported stolen.

AnswerA

Conditional access stops noncompliant or compromised devices from using corporate email even if they have valid credentials. Selective wipe is especially important for BYOD because it removes work data without erasing personal content. Together, these controls support both access control and privacy, which is the correct architectural balance for the scenario.

Why this answer

It combines conditional access policies (e.g., Azure AD Conditional Access or Intune compliance policies) to block noncompliant devices from accessing corporate email, while using MDM selective wipe to remove only corporate data (e.g., email, documents) without affecting personal data on the device. This approach enforces security without requiring a full device wipe, preserving user privacy and IT control.

Exam trap

The trap here is that candidates often confuse full device wipe with selective wipe, assuming any remote wipe is acceptable, or they underestimate the importance of conditional access to enforce compliance before granting access.

How to eliminate wrong answers

Option B is wrong because requiring a longer password on the email app does not prevent noncompliant devices (e.g., jailbroken, missing patches) from accessing email, and it does not provide selective wipe capability. Option C is wrong because disabling email on all mobile devices is overly restrictive, reduces productivity, and fails to address the need for secure mobile access. Option D is wrong because a remote full factory reset wipes all personal data, violating user privacy and potentially causing data loss, whereas selective wipe targets only corporate data.

Full explanation →

306

Multi-Selectmedium

A security architect is evaluating a zero trust architecture (ZTA) for a remote workforce. Which three of the following components are essential to the implementation? (Choose three.)

Select 3 answers

.A policy engine that continuously evaluates trust based on user identity, device health, and context.

.A single, static firewall rule that allows all traffic from the corporate VPN IP range.

.Microsegmentation to limit lateral movement even after initial access is granted.

.A mandatory VPN for all remote users before accessing any resource.

.Encryption of all traffic, including internal east-west communications.

.Implicit trust for all devices that are connected to the internal network.

Why this answer

A policy engine is essential in zero trust architecture (ZTA) because it continuously evaluates trust based on user identity, device health, and context, dynamically granting or denying access. Microsegmentation is critical as it enforces granular access controls between workloads, preventing lateral movement even after an initial breach. Encrypting all traffic, including east-west communications, ensures data confidentiality and integrity across the network, aligning with the ZTA principle of never trusting and always verifying.

Exam trap

The SY0-701 exam often tests the misconception that a VPN is a core component of zero trust, but ZTA actually replaces VPNs with more granular, identity-based access controls that do not assume network-level trust.

Full explanation →

307

MCQmedium

A security analyst at a hospital is reviewing user permissions in the electronic health record (EHR) system. The analyst discovers that all nursing staff accounts are members of the 'Administrators' group, which grants full read and write access to all patient records, as well as the ability to modify system configuration settings. The nursing staff's job responsibilities only require viewing and updating records for patients currently assigned to them. Which security principle is most directly violated by this configuration?

A.Defense in depth

B.Least privilege

C.Non-repudiation

D.Availability

AnswerB

The principle of least privilege dictates that users should have only the minimum permissions needed to perform their duties. Granting nursing staff full administrative rights violates this principle because the staff only need limited, role-specific access to patient records.

Why this answer

The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. In this case, nursing staff only need read and write access to records of currently assigned patients, but membership in the 'Administrators' group grants full read/write access to all patient records and the ability to modify system configuration settings, which far exceeds their job requirements. This directly violates least privilege by providing excessive, unnecessary privileges that increase the risk of unauthorized access or accidental misconfiguration.

Exam trap

The trap here is that candidates may confuse 'least privilege' with 'defense in depth' because both are security principles, but defense in depth is about multiple layers of protection, not about limiting user permissions to the minimum necessary.

Why the other options are wrong

Defense in depth is a layered security strategy, not a principle violated by excessive permissions. The issue here is granting more access than needed, which directly violates least privilege.

Non-repudiation ensures that actions cannot be denied by the user, typically through audit logs or digital signatures. The scenario describes excessive permissions, not a lack of accountability for actions.

The question describes excessive permissions (full access to all records and system config) for nursing staff, which violates least privilege, not availability. Availability concerns uptime and access to systems when needed, which is not directly impacted by this misconfiguration.

When would these options actually be correct?

Defense in depth would be correct if the question described a scenario where multiple security controls (e.g., firewall, antivirus, access controls) are missing or bypassed, leading to a breach, and asks which principle is lacking.

A question where a user denies having performed a specific action (e.g., modifying a patient record), and the system lacks audit logs or digital signatures to prove otherwise, would make non-repudiation the correct answer.

A scenario where a hospital's EHR system experiences frequent downtime due to a single point of failure, or where a denial-of-service attack prevents nurses from accessing patient records, would make availability the most directly violated principle.

Why candidates pick the wrong answer

Candidates may confuse 'defense in depth' with general security best practices, thinking that having too many permissions weakens security layers, but the specific violation is about excessive privileges.

Candidates may confuse non-repudiation with authorization or access control, or think that excessive permissions could lead to repudiation issues, but the core violation here is about granting more access than needed.

Candidates may confuse 'availability' with 'access' — thinking that granting broad access ensures availability, or they may misinterpret the scenario as a risk to system availability due to potential misconfiguration.

Full explanation →

308

MCQmedium

A legacy payroll application cannot support multifactor authentication yet, but the business still needs to reduce risk while the application is being modernized. The security team limits access to a hardened jump host, requires manager approval for access requests, and adds extra logging until the application can be upgraded. What type of control is this?

A.Corrective control

B.Compensating control

C.Deterrent control

D.Preventive control

AnswerB

A compensating control is an alternative safeguard used when the preferred or required control cannot be implemented yet. Here, MFA is not supported by the legacy application, so the team reduces risk using a hardened jump host, approval workflow, and enhanced logging. Those measures do not replace MFA completely, but they provide a reasonable temporary risk reduction until the system is upgraded.

Why this answer

Compensating controls are alternative security measures implemented when primary controls (like MFA) cannot be applied due to technical limitations. In this scenario, the jump host restriction, manager approval, and enhanced logging serve as compensating controls to reduce risk until the legacy payroll application can be modernized to support MFA.

Exam trap

The trap here is that candidates may confuse compensating controls with preventive controls, mistakenly thinking that the jump host and approval process are directly preventing unauthorized access, when in fact they are alternative measures compensating for the missing MFA capability.

How to eliminate wrong answers

Option A is wrong because corrective controls are designed to remediate or reverse the effects of an incident after it has occurred (e.g., restoring from backup), not to reduce risk proactively while awaiting modernization. Option C is wrong because deterrent controls aim to discourage potential attackers through visible warnings or threats (e.g., security cameras, warning banners), not to provide alternative access restrictions and logging. Option D is wrong because preventive controls are intended to block security violations outright (e.g., firewalls, access control lists), but here the legacy application cannot support MFA, so a direct preventive control is not feasible; compensating controls are used instead.

Full explanation →

309

MCQhard

Based on the exhibit, which cryptographic mechanism provides proof that the update came from the vendor and was not altered?

A.Hashing, because matching SHA-256 values alone prove the file came from the vendor.

B.Symmetric encryption, because only the vendor and the customer share the secret key.

C.Digital signature, because only the vendor's private key can produce the verified signature.

D.Salting, because adding random data makes the update file easier to trust.

AnswerC

Digital signature is correct because the signature check proves both integrity and authenticity. The vendor signs the update with a private key, and anyone with the matching public key can verify that the file has not changed and that the signer possessed the private key. That is exactly the proof of origin the audit note is asking for.

Why this answer

A digital signature uses the vendor's private key to sign the update, and the customer verifies it using the vendor's public key. This asymmetric cryptographic mechanism ensures both authenticity (the update came from the vendor) and integrity (the update was not altered), as only the vendor's private key can produce a signature that validates with the corresponding public key.

Exam trap

The trap here is that candidates confuse hashing with digital signatures, thinking that a hash match alone proves the source, when in fact hashing only verifies integrity, not authenticity or non-repudiation.

How to eliminate wrong answers

Option A is wrong because hashing alone provides integrity (detecting changes) but does not prove the source; an attacker could replace both the file and its hash, and SHA-256 values matching only show the file hasn't changed, not that it came from the vendor. Option B is wrong because symmetric encryption uses a shared secret key, which does not provide non-repudiation or proof of origin; both the vendor and customer possess the same key, so the customer cannot prove the update came specifically from the vendor. Option D is wrong because salting adds random data to passwords or hashes to prevent rainbow table attacks, but it does not provide any mechanism for authentication or integrity verification of an update file.

Full explanation →

310

MCQmedium

A cloud-hosted application allows users to submit a URL for image processing. Logs show repeated requests such as `http://169.254.169.254/latest/meta-data/` and `http://localhost/admin`. The server is making outbound requests on behalf of the user input. What is the best defensive control to implement?

A.Allow any URL that returns a valid HTTP status code

B.Use a strict allowlist for outbound destinations and block link-local metadata addresses

C.Escape all quotation marks before sending the request

D.Require users to change their passwords after each upload

AnswerB

This is the best defense because the application is making server-side requests based on user input. A strict allowlist limits which external destinations the service may reach, and blocking link-local or internal addresses prevents access to sensitive metadata services and localhost resources. This directly reduces the risk of server-side request forgery in cloud environments.

Why this answer

The requests target the AWS EC2 instance metadata service (169.254.169.254) and localhost, which are classic Server-Side Request Forgery (SSRF) attacks. By using a strict allowlist for outbound destinations and explicitly blocking link-local metadata addresses, the application prevents the server from making unauthorized requests to internal or cloud metadata endpoints, thereby mitigating SSRF.

Exam trap

The trap here is that candidates may confuse SSRF with injection attacks and choose a sanitization option like escaping quotation marks, but the real vulnerability is the server's ability to make outbound requests to arbitrary destinations, which requires network-level controls.

How to eliminate wrong answers

Option A is wrong because allowing any URL that returns a valid HTTP status code would permit SSRF attacks, as attackers can craft URLs that reach internal services (e.g., metadata endpoints) that respond with a valid status. Option C is wrong because escaping quotation marks is a defense against injection attacks like SQL injection or XSS, but it does not prevent the server from making outbound requests to arbitrary destinations, which is the core issue in SSRF.

Full explanation →

311

MCQmedium

A branch office has users, finance workstations, printers, and IP phones on one flat network. The security team wants to reduce lateral movement if one user PC is compromised, but printers still need to receive print jobs from users. What is the best design change?

A.Keep one flat network and increase endpoint antivirus scanning frequency.

B.Place finance systems and user devices in separate VLANs and allow only the necessary print and business application traffic through filtering rules.

C.Move all printers into the finance VLAN to avoid managing inter-VLAN rules.

D.Disable printing so user workstations cannot communicate with any other device.

AnswerB

This design reduces lateral movement by separating high-value systems from general user devices. VLANs create logical segmentation, and targeted filtering permits only the traffic required for printing and approved business flows. It preserves functionality while sharply reducing the number of systems reachable after a compromise.

Why this answer

Segmenting the flat network into separate VLANs for finance systems and user devices enforces network segmentation, which limits lateral movement. By using VLANs and firewall rules to allow only necessary traffic (e.g., print jobs via IPP or SMB, and business application traffic), the organization reduces the attack surface while maintaining required functionality. This aligns with the principle of least privilege and zero trust architecture.

Exam trap

The trap here is that candidates often choose Option C, mistakenly thinking that consolidating printers into the finance VLAN simplifies management, but they overlook that printers are notoriously insecure and would become a bridge for lateral movement into the finance segment.

How to eliminate wrong answers

Option A is wrong because increasing endpoint antivirus scanning frequency does not prevent lateral movement on a flat network; once a user PC is compromised, the attacker can still freely move to other devices (including finance workstations) on the same broadcast domain. Option C is wrong because moving all printers into the finance VLAN would expose printers to finance systems without proper isolation, and printers often have weak security (e.g., default credentials, unpatched firmware), creating a pivot point for attackers to reach finance assets; it also fails to address the need for inter-VLAN rules to allow user print jobs.

Full explanation →

312

Multi-Selectmedium

Which four of the following are effective mitigations against SQL injection attacks? (Choose four.)

Select 4 answers

.Using parameterized queries or prepared statements

.Implementing input validation and sanitization

.Enforcing least privilege for database accounts

.Disabling error messages that reveal database structure

.Blocking all user input containing the word 'SELECT'

.Using client-side JavaScript validation exclusively

Why this answer

Parameterized queries and prepared statements are effective because they separate SQL logic from user input, ensuring that input is treated as data rather than executable code. This prevents attackers from injecting malicious SQL commands into query strings, as the database engine compiles the query structure before parameters are bound.

Exam trap

The trap here is that all four options are correct, so candidates must recognize that the question expects them to select all four, rather than being misled into thinking one is incorrect due to common misconceptions about input validation being insufficient alone.

Full explanation →

313

MCQmedium

Based on the exhibit, which cloud deployment choice best satisfies the workload requirements? Exhibit: Workload requirements: - Processes regulated customer records - Should not share underlying compute with other tenants if avoidable - Team wants provider-managed hardware maintenance - Application will run in a public cloud Which deployment choice is the best fit?

A.Shared public tenancy on standard virtual machines.

B.Community cloud shared with other regulated organizations.

C.Public cloud with a dedicated host or equivalent single-tenant compute placement.

D.On-premises private cloud with company-owned servers and full hardware management.

AnswerC

This is the best match because it gives the organization stronger tenant isolation while still using provider-managed cloud infrastructure. A dedicated host or similar single-tenant placement reduces exposure to neighboring tenants and is well suited for regulated data without requiring the customer to buy and maintain physical servers. It balances security and operational convenience.

Why this answer

A dedicated host or single-tenant compute placement in a public cloud ensures the workload does not share underlying physical hardware with other tenants, meeting the 'should not share underlying compute' requirement. It also provides provider-managed hardware maintenance and runs in a public cloud, aligning with all stated workload requirements for processing regulated customer records.

Exam trap

The trap here is that candidates may confuse 'community cloud' (Option B) as meeting isolation needs, but it still involves multi-tenant compute sharing unless explicitly configured with dedicated hosts, which is not stated in the option.

How to eliminate wrong answers

Option A is wrong because shared public tenancy on standard virtual machines inherently shares the underlying physical server with other tenants, violating the requirement to avoid sharing compute if possible. Option B is wrong because a community cloud, while shared with other regulated organizations, still involves multi-tenant compute sharing and does not guarantee single-tenant isolation; it also may not offer provider-managed hardware maintenance in the same way as a public cloud dedicated host. Option D is wrong because an on-premises private cloud with company-owned servers requires the team to manage hardware maintenance themselves, contradicting the requirement for provider-managed hardware maintenance.

Full explanation →

314

MCQmedium

A CFO at a mid-sized company receives an urgent email that appears to come from the CEO's email address, requesting an immediate wire transfer of $50,000 to a new vendor for a time-sensitive project. The email address displayed is 'ceo@cornpany.com' instead of the legitimate 'ceo@company.com'. The CFO follows the instruction and initiates the transfer. Later, the real CEO denies sending such a request. Which of the following security controls would have been MOST effective in preventing this type of attack from succeeding?

A.Deploying a stronger email spam filter that blocks all emails from unrecognized domains

B.Requiring multi-factor authentication (MFA) for all corporate email accounts

C.Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before execution

D.Enabling Transport Layer Security (TLS) encryption for all outgoing email communications

AnswerC

This is correct because email authentication cannot fully prevent CEO fraud, especially when the attacker uses a lookalike domain or spoofed display name. Requiring a verbal confirmation via a pre-established phone number obtained from a trusted directory, not the email itself, creates an out-of-band verification channel. This ensures the financial instruction is genuine before any transfer is executed, directly mitigating the impersonation risk.

Why this answer

The attack is a business email compromise (BEC) using a lookalike domain. A policy requiring verbal verification via a known phone number adds a human out-of-band check that bypasses the email channel entirely, preventing the fraudulent transfer even if the email appears legitimate. This control directly addresses the social engineering aspect of the attack, which technical controls alone cannot fully mitigate.

Exam trap

The trap here is that candidates often choose a technical control like MFA or spam filters, overlooking that the attack exploits human trust and domain spoofing rather than account compromise, so the most effective control is a procedural one that bypasses the email channel entirely.

Why the other options are wrong

The email came from a lookalike domain ('cornpany.com'), not an unrecognized domain; a spam filter blocking unrecognized domains would not catch this because the domain is similar to a known one, and the filter might not block it if the domain is not in the blocklist.

MFA protects against unauthorized access to email accounts, but in this attack, the email came from a spoofed domain (ceo@cornpany.com), not a compromised account. The CFO was not tricked by a lack of MFA but by a deceptive sender address.

TLS encryption protects data in transit from eavesdropping but does not verify the sender's identity or prevent spoofed email addresses, so it would not stop a phishing attack that uses a lookalike domain.

When would these options actually be correct?

In a scenario where an organization receives a high volume of phishing emails from completely unknown or newly registered domains, and the attack relies on the recipient not recognizing the sender's domain, a stronger spam filter blocking all emails from unrecognized domains would be most effective.

In a scenario where an attacker gains access to a legitimate executive's email account (e.g., via phishing) and uses it to send fraudulent wire transfer requests, MFA would prevent the initial account compromise, thus stopping the attack.

A question where the threat is interception of sensitive financial data during email transmission, such as an attacker capturing unencrypted emails containing wire transfer instructions. In that case, enabling TLS would prevent the attacker from reading the content.

Why candidates pick the wrong answer

Candidates may think that any email from an external or suspicious domain should be blocked, but they overlook that the attack uses a domain that is very similar to a legitimate one, which would bypass typical spam filters.

Candidates often associate MFA with preventing all email-based attacks, overlooking that this specific attack relies on domain spoofing rather than account takeover.

Candidates may confuse encryption with authentication, thinking that securing the communication channel also verifies the sender's legitimacy, or they may overestimate the scope of TLS protections.

Full explanation →

315

MCQmedium

A security analyst is reviewing authentication logs from a corporate web application. The logs show that over a span of two hours, a single external IP address attempted to log in with 500 different usernames, each using the same password 'Spring2024!'. Only a few of these attempts succeeded. Which type of attack is most likely being observed?

A.Brute force attack

B.Password spraying attack

C.Credential stuffing attack

D.Dictionary attack

AnswerB

Correct. Password spraying involves trying a small number of common passwords against many accounts to avoid detection and lockout. The single password used across numerous usernames is the hallmark of this attack.

Why this answer

This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against many different usernames. This technique avoids account lockout policies that typically trigger after multiple failed attempts on a single account, and the few successful logins indicate valid credentials were found.

Exam trap

The trap here is confusing password spraying with brute force: candidates see 'same password' and think brute force, but the key distinction is the attacker targets many usernames with one password, not one username with many passwords.

Why the other options are wrong

A brute force attack typically tries many passwords against a single username, but here one password is tried against many usernames, which is characteristic of password spraying.

Credential stuffing uses previously leaked username/password pairs, not a single password across many usernames. The attack here uses the same password for all attempts, which is characteristic of password spraying.

A dictionary attack typically uses a list of common passwords against a single username, but here the attacker used one password against many usernames, which is characteristic of password spraying.

When would these options actually be correct?

A brute force attack would be correct if the logs showed a single username being targeted with many different password attempts (e.g., thousands of passwords against one account).

An exam scenario where logs show multiple login attempts using different username/password combinations that match known credential dumps from previous breaches, with many successful logins due to password reuse.

A security analyst observes logs showing a single username being targeted with hundreds of different passwords from a common password list, with a few successful logins. This would indicate a dictionary attack.

Why candidates pick the wrong answer

Candidates may confuse 'brute force' as any attack that tries many login attempts, not realizing the specific pattern of password spraying uses one password across many usernames.

Candidates may confuse credential stuffing with password spraying because both involve many usernames, but they forget that credential stuffing relies on known password pairs, not a single password.

Candidates may confuse 'dictionary attack' with any attack using a list of common passwords, not realizing that the direction (many passwords per user vs. one password per many users) distinguishes it from password spraying.

Full explanation →

316

MCQmedium

A firewall rule change was implemented directly in production to allow a new vendor IP range. Within minutes, several internal services became unreachable because the rule order changed unexpectedly. Which change-management practice would have most likely prevented this outage?

A.Testing the change in a staging environment and approving it through a peer-reviewed change process before production.

B.Applying the rule during business hours so the team can respond faster if something breaks.

C.Making the change first in production because that is the only environment that matters.

D.Documenting the outage after the vendor confirms their IP range is valid.

AnswerA

A tested, peer-reviewed change process helps catch rule-order problems, dependency issues, and unintended access impacts before production is affected. Firewall changes can alter traffic flow in subtle ways, so validating them in a nonproduction environment and having a formal approval path reduces the chance of service disruption. A backout plan also gives the team a quick recovery path if the production change behaves differently than expected.

Why this answer

Implementing the change in a staging environment first allows validation of the rule order and its impact on traffic flow without affecting production. A peer-reviewed change process ensures that the rule insertion point (e.g., before a deny-all or after a permit statement) is verified, preventing the accidental reordering that caused the outage. This aligns with the change-management principle of testing in a representative environment before production deployment.

Exam trap

The trap here is that candidates may confuse 'change management' with 'incident response' or 'documentation,' leading them to choose options that address symptoms (e.g., faster response or post-hoc documentation) rather than the root cause of unvalidated rule order changes.

How to eliminate wrong answers

Option B is wrong because applying the rule during business hours does not address the root cause—unexpected rule reordering—and may increase risk if the change breaks services during peak usage. Option C is wrong because making the change directly in production bypasses all validation and review, which is precisely the practice that led to the outage. Option D is wrong because documenting the outage after the fact does nothing to prevent it; proactive change management requires testing and approval before implementation.

Full explanation →

317

MCQmedium

A branch office's network closet has repeated unauthorized access issues after staff badge in and hold the door for others. Management wants a control that allows one person through after valid badge use and helps prevent tailgating. Which control is best?

A.Closed-circuit television cameras, because they record the doorway for later review.

B.A mantrap, because it physically restricts entry to one person at a time.

C.A motion sensor, because it can detect movement inside the room.

D.A door closer, because it ensures the door automatically shuts after use.

AnswerB

A mantrap is a physical access control system consisting of a small vestibule with two interlocking doors, where only one door can open at a time. After the first door closes and locks, the individual must present valid credentials (e.g., badge or biometric) inside the booth before the second door releases, ensuring that only one authorized person passes through per cycle. This design inherently prevents tailgating by making it impossible for a second person to slip in with the first, directly addressing the repeated unauthorized access.

Why this answer

A mantrap is a physical security control consisting of a small space with two interlocking doors, typically requiring authentication to enter and exit. It ensures that only one person can pass through at a time, effectively preventing tailgating by trapping unauthorized individuals between the doors if they attempt to follow an authorized user.

Exam trap

The SY0-701 exam often tests the distinction between preventive and detective controls, leading candidates to choose CCTV because it is a common security measure, even though it does not actively prevent tailgating.

How to eliminate wrong answers

Option A is wrong because closed-circuit television cameras are a detective control, not a preventive one; they record incidents for later review but do not physically stop tailgating in real time. Option C is wrong because a motion sensor detects movement inside the room but does not control entry or prevent multiple people from passing through a door simultaneously.

Full explanation →

318

Matchingeasy

Match each security control type to the best example in a small office environment.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

A firewall blocks inbound remote desktop traffic from the internet.

A SIEM alert notifies analysts after multiple failed logins occur.

A clean backup is restored after malware is removed from a laptop.

A visible warning sign says the area is under video surveillance.

A policy requires users to lock their screens when stepping away.

A jump host is used temporarily until direct administration is safely allowed.

Why these pairings

These matches classify security controls by type: administrative involves policies, technical uses technology, physical secures premises, deterrent discourages violations, preventive stops incidents, and detective identifies occurrences.

Full explanation →

319

MCQeasy

A sales manager's laptop is often taken home and may contain customer pricing spreadsheets and contract drafts. Which control best protects the files if the laptop is stolen?

A.Hashing the files

B.Full-disk encryption

C.Using TLS on the office Wi-Fi

D.File compression

AnswerB

Full-disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and user files, using a symmetric cipher such as AES. When the laptop is powered off or the volume is locked, the encryption key is not readily available, so the storage media appears as random data to anyone who removes the drive or boots from external media. A thief cannot recover the sales manager's files without the correct passphrase, PIN, or hardware-bound key, making FDE the definitive control for protecting data at rest on portable devices.

Why this answer

Full-disk encryption (FDE) protects all data on the laptop's storage drive by encrypting the entire volume, including the operating system, applications, and files. If the laptop is stolen, the thief cannot access the customer pricing spreadsheets and contract drafts without the decryption key (e.g., a pre-boot PIN or TPM-based key). This renders the data unreadable even if the drive is removed and attached to another system, directly addressing the risk of physical theft.

Exam trap

The trap here is that candidates confuse confidentiality controls (encryption) with integrity controls (hashing) or network protection (TLS), mistakenly thinking hashing or TLS can protect data at rest on a stolen device.

How to eliminate wrong answers

Option A is wrong because hashing is a one-way cryptographic function used for integrity verification (e.g., detecting file tampering), not for confidentiality; it does not prevent an attacker from reading the files. Option C is wrong because TLS (Transport Layer Security) protects data in transit over the office Wi-Fi, but once the laptop is stolen, the files are at rest on the local drive and TLS offers no protection against offline access. Option D is wrong because file compression (e.g., ZIP) only reduces file size and optionally adds a weak password, but it does not provide strong encryption; modern compression tools are not designed to resist forensic attacks on a stolen device.

Full explanation →

320

MCQeasy

An EDR alert shows a user workstation launching an unfamiliar executable from the Downloads folder and then making repeated outbound connections to an IP address in another country. What is the best first response by the security team?

A.Wait for more alerts before taking any action to avoid disrupting the user

B.Isolate the workstation from the network and begin incident triage

C.Immediately reinstall the operating system without collecting evidence

D.Disable the user's account in the directory service and close the ticket

AnswerB

Network isolation is the correct first response because it immediately severs the attacker's ability to maintain command-and-control or reach other hosts, containing the blast radius. Unlike destructive actions, isolation preserves volatile evidence (memory, running processes) and non-volatile artifacts for proper forensic triage. This action aligns with NIST SP 800-61 containment strategies and gives the incident response team a controlled environment to investigate without the threat continuing to propagate.

Why this answer

Isolating the workstation from the network immediately stops the potential command-and-control (C2) communication and prevents lateral movement, which is the priority first response in incident triage. The EDR alert indicates a suspicious executable from the Downloads folder making repeated outbound connections to a foreign IP, which strongly suggests malware or a trojan. Isolating the host preserves volatile evidence (e.g., memory, network connections) for forensic analysis while containing the threat.

Exam trap

The trap here is that candidates may confuse incident response phases (e.g., jumping to eradication or recovery before containment) or think that disabling the user account is sufficient, when in fact the running process must be contained first to stop active network communication.

How to eliminate wrong answers

Option A is wrong because waiting for more alerts allows the malware to continue exfiltrating data or spreading to other systems, violating the containment-first principle of incident response. Option C is wrong because immediately reinstalling the OS destroys all volatile evidence (e.g., memory, running processes, network artifacts) needed for root cause analysis and attribution, and may miss persistence mechanisms. Option D is wrong because disabling the user account does not stop the already-running malicious process from making outbound connections or executing further payloads; the host must be contained first.

Full explanation →

321

Multi-Selecteasy

A company wants visibility into who changed settings in its cloud account and what commands ran on a cloud VM. Which two log sources should the team enable first? Select two.

Select 2 answers

A.Cloud provider audit or API logs

B.Guest operating system event logs

C.Printer spooler logs

D.Browser history from employees' home PCs

E.DHCP lease logs from the office router

AnswersA, B

Cloud provider audit or API logs (e.g., AWS CloudTrail, Azure Activity Log, Google Cloud Audit Logs) are the authoritative record of control-plane operations. Every API call that creates, modifies, or deletes a cloud resource is captured with the identity of the caller, source IP, timestamp, and request parameters. These logs are essential for determining exactly who changed security group rules, IAM policies, or other configuration settings, and they are tamper-evident by design when enabled with integrity validation or log file validation.

Why this answer

Cloud provider audit or API logs (Option A) capture all changes made to the cloud account via the provider's management plane, including who modified settings and when. Guest operating system event logs (Option B) record commands executed within the VM itself, such as PowerShell or bash commands, providing visibility into runtime activities. Together, these two sources cover both the control plane (account-level changes) and data plane (VM-level commands) for comprehensive monitoring.

Exam trap

The trap here is that candidates often confuse guest OS logs with hypervisor logs or assume cloud provider logs alone are sufficient, missing that VM-level command execution requires OS-level logging.

Full explanation →

322

MCQmedium

Based on the exhibit, which change would most improve the security of the stored password data?

A.Store the passwords in encrypted form so they can be recovered later if needed.

B.Add a unique salt per password and use a slow password hashing algorithm.

C.Replace the hash with a plain SHA-256 digest because it is modern and widely supported.

D.Append the application name to each password before hashing to make the hashes unique.

AnswerB

Adding a unique random salt to each password before hashing ensures that two users with the same password produce completely different stored values, defeating precomputed rainbow tables and cross-user correlation. Pairing that salt with a deliberately slow, memory-hard password hashing algorithm such as Argon2id, scrypt, or bcrypt forces an attacker to spend significant CPU and memory for every single guess, making offline brute-force and dictionary attacks prohibitively expensive. The salt is stored in plaintext next to the hash and does not need to be secret — its purpose is to prevent parallel cracking and eliminate shortcut tables, while the algorithm's cost factor is what actually protects weak passwords.

Why this answer

Adding a unique salt per password prevents precomputed rainbow table attacks, and using a slow password hashing algorithm (like bcrypt, PBKDF2, or Argon2) increases the computational cost of brute-force attacks. This combination ensures that even if the password hashes are compromised, attackers cannot efficiently crack them. Salting also ensures that identical passwords produce different hashes, eliminating the ability to detect shared passwords across accounts.

Exam trap

The trap here is that candidates often confuse hashing with encryption or assume that a 'modern' hash like SHA-256 is sufficient for password storage, overlooking the critical need for salting and key stretching to defend against brute-force and rainbow table attacks.

How to eliminate wrong answers

Option A is wrong because storing passwords in encrypted form (reversible) violates the fundamental security principle that passwords should never be recoverable; encryption keys can be compromised, exposing all passwords. Option C is wrong because plain SHA-256 is a fast, general-purpose hash designed for integrity checks, not password storage; it lacks salting and is vulnerable to GPU-accelerated brute-force attacks. Option D is wrong because appending the application name is a weak, predictable form of salting that does not provide per-password uniqueness and does not slow down hashing; it offers minimal protection against rainbow tables or targeted attacks.

Full explanation →

323

MCQmedium

A security architect proposes adding endpoint protection, network segmentation, multifactor authentication, email filtering, and immutable backups so that one failed safeguard does not expose the entire organization. What security strategy is being described?

A.Defense in depth

B.Least privilege

C.Need-to-know

D.Zero trust

AnswerA

Defense in depth uses multiple independent controls so that if one layer fails, others still reduce the chance of compromise or limit the damage. The mix of endpoint, network, identity, email, and recovery controls in the scenario is a textbook layered approach. It is especially useful because attackers rarely defeat every safeguard at once.

Why this answer

Defense in depth is a layered security strategy where multiple, independent controls (endpoint protection, network segmentation, MFA, email filtering, immutable backups) are deployed so that if one safeguard fails, others continue to protect the organization. This approach ensures no single point of failure can compromise the entire environment, aligning directly with the scenario described.

Exam trap

The trap here is that candidates confuse 'defense in depth' with 'least privilege' because both involve multiple controls, but defense in depth specifically requires overlapping, independent layers rather than just restricting permissions.

How to eliminate wrong answers

Option B (Least privilege) is wrong because it focuses on restricting user permissions to the minimum necessary for their role, not on deploying multiple overlapping safeguards. Option C (Need-to-know) is wrong because it is a subset of least privilege that limits access to data based on job necessity, not a strategy for layering protective controls.

Full explanation →

324

MCQeasy

A workstation suddenly begins making SMB connections to many internal servers within a few minutes. What is the best immediate response?

A.Allow the traffic because SMB is a normal file-sharing protocol.

B.Isolate the workstation from the network for containment.

C.Delete the local event logs to reduce alert noise.

D.Disable all SMB services on every server immediately.

AnswerB

Isolating the workstation from the network is the correct first response because it immediately contains the suspicious activity and prevents the host from reaching other systems, which limits lateral movement and the blast radius of a possible compromise. This preserves the ability to inspect traffic and run forensics without the risk of in-flight attacks. In incident response, containment is prioritized before any remediation or eradication steps, making this the safest choice.

Why this answer

The workstation's sudden SMB connections to many internal servers strongly indicate compromise, such as ransomware or worm propagation. Isolating the workstation immediately contains the threat, preventing lateral movement and further damage while preserving forensic evidence.

Exam trap

The trap here is that candidates may think SMB traffic is always benign because it is a legitimate protocol, failing to recognize that a sudden spike in SMB connections to multiple internal servers is a red flag for active lateral movement.

How to eliminate wrong answers

Option A is wrong because allowing the traffic ignores the anomalous behavior; SMB is normal for file sharing, but a sudden burst of connections to many servers is a classic sign of automated malicious activity like ransomware encryption or worm spread. Option C is wrong because deleting event logs destroys critical forensic evidence needed to investigate the incident, and it does not stop the malicious activity. Option D is wrong because disabling all SMB services on every server is an overly drastic, disruptive response that would break legitimate business operations and is not a targeted containment step.

Full explanation →

325

MCQmedium

A finance laptop is powered on, the user is still logged in, and it remains connected to Wi-Fi after a malware alert. What should the responder do first to preserve volatile evidence?

A.Power the laptop off immediately to stop any further attacker activity.

B.Collect volatile data such as memory, running processes, and active network connections.

C.Run a full antimalware scan before touching any other data.

D.Disconnect the power cable and remove the battery to prevent changes.

AnswerB

Volatile evidence is the first thing to lose when a machine shuts down or is rebooted, so collecting it immediately is the best move. Memory, process lists, open sockets, and logged-in sessions can reveal malware injection, command-and-control activity, or stolen credentials in use. Preserving that state before containment actions or shutdown gives investigators a better picture of what happened on the system.

Why this answer

The laptop is powered on, the user is logged in, and it is connected to the network, meaning volatile data (memory contents, running processes, active network connections) is at immediate risk of being lost if the system is shut down or tampered with. The responder must collect this data first to preserve evidence of the malware's current state, including any malicious processes, network connections, and in-memory artifacts that would disappear on power loss.

Exam trap

The trap here is that candidates mistakenly believe immediate shutdown (Option A) stops attacker activity, but in forensic practice, preserving volatile evidence by capturing memory and network state is always the priority before any power-down action.

How to eliminate wrong answers

Option A is wrong because powering off the laptop immediately destroys all volatile data (RAM, process lists, network connection states) and may trigger anti-forensic mechanisms in malware that wipe traces on shutdown; the correct first step is to capture volatile data before any power state change. Option C is wrong because running a full antimalware scan modifies the system state (reads files, creates logs, may quarantine or delete files) and overwrites or destroys volatile evidence in memory and active connections, violating forensic preservation principles.

Full explanation →

326

MCQhard

Based on the exhibit, what is the best eradication decision for the server compromise?

A.Restart sshd and monitor the system for another login attempt.

B.Manually delete the cron entry and reverse the SSH change on the live server.

C.Rebuild the server from a trusted image and restore only known-good data after evidence is preserved.

D.Increase the SIEM retention period and keep the current server online.

AnswerC

The server shows multiple signs of compromise: unauthorized key-based access, script download, cron persistence, and SSH configuration tampering. Those indicators make simple cleanup too risky. A rebuild from a trusted image is the most reliable eradication step, especially once the host is isolated. Evidence should be preserved first, then the service should be restored from validated data and a hardened baseline.

Why this answer

A server compromise implies that the attacker may have achieved persistence through modified binaries, kernel modules, or rootkits that cannot be reliably removed by simple remediation steps. Rebuilding from a trusted image ensures that all malicious artifacts are eliminated, and restoring only known-good data from backups (after forensic preservation) prevents reintroduction of compromised files. This aligns with the CompTIA incident response process, where eradication must remove all traces of the threat, and rebuilding is the safest approach for a confirmed compromise.

Exam trap

The trap here is that candidates may think manual remediation (Option B) is sufficient because they underestimate the attacker's ability to hide persistence mechanisms, or they confuse containment (e.g., isolating the server) with eradication (completely removing the threat).

How to eliminate wrong answers

Option A is wrong because restarting sshd does not remove the attacker's persistence mechanism (e.g., modified SSH configuration or cron job) and only temporarily disrupts access; the attacker could simply log in again. Option B is wrong because manually deleting a cron entry and reversing an SSH change on a live server is unreliable—the attacker may have installed a rootkit, backdoor, or modified system binaries that cannot be fully reversed, leaving the system still compromised. Option D is wrong because increasing SIEM retention does not address the existing compromise; keeping the compromised server online continues to expose the network to data exfiltration or lateral movement.

Full explanation →

327

Multi-Selecteasy

A company uses a SaaS email platform. The provider manages the servers and application code. Which two tasks remain the company's responsibility? Select two.

Select 2 answers

A.Configuring who can access company mailboxes and administrative roles.

B.Applying security patches to the provider's mail servers.

C.Deciding what data may be stored in the service and how it is classified.

D.Replacing failed provider storage disks.

E.Hardening the provider's hypervisor.

AnswersA, C

The provider manages the mail system infrastructure, but access control remains the customer's responsibility under the SaaS shared responsibility model. The company must create and manage user accounts, assign mailbox permissions, configure administrative roles, and enforce least privilege via role-based access control. This includes implementing conditional access policies, multi-factor authentication, and periodic access reviews to prevent privilege creep.

Why this answer

In a SaaS model, the customer retains administrative control over user access and role-based permissions. This includes configuring mailbox permissions, setting up multi-factor authentication, and managing administrative roles within the provider's interface. The provider handles the underlying infrastructure, but identity and access management (IAM) remains the customer's responsibility.

Exam trap

The SY0-701 exam often tests the misconception that 'patching' is always the customer's job, but in SaaS the provider handles all infrastructure patching, while the customer's responsibility is limited to configuration and data governance.

Full explanation →

328

MCQmedium

A records manager is preparing to delete old HR emails next week under the retention schedule. Legal notifies the team that those messages may be needed for an active investigation. What should the records manager do first?

A.Delete the emails on schedule and archive only the subject lines.

B.Place the emails on legal hold and suspend normal deletion for those records.

C.Move the emails to a shared folder so legal can review them later.

D.Compress the emails into an encrypted file and continue with deletion.

AnswerB

A legal hold is the correct action when records might be needed for an investigation, audit, or litigation. It overrides the normal retention schedule and requires the organization to preserve relevant data until legal or compliance staff releases the hold. This protects evidence integrity and avoids accidental destruction of records that could be important to the case.

Why this answer

When legal notifies that emails may be needed for an active investigation, the records manager must immediately suspend normal deletion and place a legal hold on those records. This preserves the data in its original state, preventing spoliation and ensuring compliance with e-discovery obligations. Deleting or moving the emails could destroy metadata or chain of custody, violating legal hold requirements.

Exam trap

The trap here is that candidates think moving emails to a shared folder is a safe preservation step, but it actually breaks the formal legal hold process and can compromise metadata and chain of custody, which is why the correct first action is to suspend deletion via a legal hold.

How to eliminate wrong answers

Option A is wrong because deleting the emails and archiving only subject lines destroys the body content and metadata (e.g., headers, timestamps, attachments) that are critical for legal discovery; this would likely constitute spoliation. Option C is wrong because moving the emails to a shared folder alters their original location and may break retention policies or audit trails, and it does not formally suspend the retention schedule—legal hold requires a documented, tamper-proof preservation process, not just relocation.

Full explanation →

329

MCQhard

EDR on a workstation shows winword.exe spawning powershell.exe with hidden, no-profile, and encoded arguments. No new executable is written to disk. Minutes later, a scheduled task creation is blocked, but the same host continues making HTTPS requests to a cloud IP address. Which malware category best fits this behavior?

A.Trojan, because the malicious activity likely started from a user-opening event.

B.Worm, because the host is making repeated outbound network connections.

C.Rootkit, because the process is using hidden commands and network connections.

D.Fileless attack, because the payload is executed in memory using legitimate scripting tools and leaves little on disk.

AnswerD

Fileless attack is the best fit because the sequence uses trusted built-in tools, encoded PowerShell, and no obvious executable drop on disk. The suspicious behavior happens in memory and through script interpretation, which makes detection harder than with traditional malware files. The blocked scheduled task and later HTTPS beaconing are consistent with in-memory execution and persistence attempts after initial delivery.

Why this answer

The attack uses legitimate tools (winword.exe spawning powershell.exe) with hidden, no-profile, and encoded arguments to execute a payload entirely in memory, never writing a new executable to disk. This is the hallmark of a fileless attack, which relies on in-memory execution and living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection. The subsequent scheduled task creation block and persistent HTTPS connections to a cloud IP further indicate a fileless malware that establishes command-and-control (C2) without dropping files.

Exam trap

The trap here is that candidates see 'hidden commands' and 'network connections' and incorrectly associate them with a rootkit, but the 'hidden' refers to PowerShell's `-WindowStyle Hidden` parameter, not kernel-level hiding, and the network connections are standard HTTPS C2 traffic, not a rootkit's stealthy communication.

How to eliminate wrong answers

Option A is wrong because a Trojan typically requires a user to execute a malicious file that is written to disk, but here no new executable is written to disk and the activity starts from a legitimate Office process spawning PowerShell in memory. Option B is wrong because a Worm self-replicates and spreads automatically across networks, often exploiting vulnerabilities; the repeated outbound HTTPS connections here are for C2 communication, not for self-propagation. Option C is wrong because a Rootkit is designed to hide its presence by modifying the operating system kernel or drivers, whereas this attack uses hidden PowerShell arguments (a command-line flag) and does not involve kernel-level concealment or driver installation.

Full explanation →

330

MCQhard

Based on the exhibit, which security principle should the team strengthen to reduce the chance that stolen credentials alone provide access to sensitive data?

A.Least privilege, because the user should only have the minimum file permissions needed.

B.Zero trust, because every request should be re-evaluated instead of relying on the earlier VPN login.

C.Need-to-know, because all finance data should be hidden from anyone outside the department.

D.Defense in depth, because multiple layers are always better than one control.

AnswerB

Zero trust fits the exhibit because access is being allowed based on an earlier authentication event and network location alone. A zero-trust design would re-evaluate each request using factors such as device health, identity, and context instead of assuming the session is safe for 12 hours.

Why this answer

The exhibit shows a scenario where a VPN session grants persistent access to sensitive data without re-authentication. Zero trust is correct because it mandates continuous verification of every request, not just the initial VPN login, so stolen credentials alone would not provide ongoing access to sensitive data. This principle enforces micro-segmentation and per-request authorization, directly addressing the vulnerability of credential theft.

Exam trap

The trap here is that candidates confuse zero trust with defense in depth, assuming multiple security layers automatically verify every request, when in fact defense in depth can still rely on a single persistent trust decision (like a VPN session) that stolen credentials can exploit.

How to eliminate wrong answers

Option A is wrong because least privilege limits the scope of access (e.g., file permissions) but does not prevent a stolen credential from being reused across sessions; it reduces blast radius but not the risk of credential reuse. Option C is wrong because need-to-know restricts data access based on role, but it still relies on the initial authentication and does not require re-evaluation of each request, so stolen credentials would still grant access to permitted data. Option D is wrong because defense in depth adds multiple controls (e.g., firewalls, IDS), but without a zero-trust architecture, a single stolen credential can bypass all layers if the VPN session remains trusted; it does not specifically address the re-evaluation gap.

Full explanation →

331

MCQmedium

A security engineer writes a script that computes SHA-256 hashes of critical server configuration files every night and sends an alert if any hash value has changed since the previous night. Which security goal is this control primarily designed to protect?

A.Confidentiality

B.Integrity

C.Availability

D.Authentication

AnswerB

Integrity ensures that data has not been tampered with or altered by unauthorized parties. Comparing hashes allows the engineer to detect any unauthorized changes to the configuration files, directly supporting the integrity goal. This is the correct answer.

Why this answer

The script computes SHA-256 hashes of configuration files and compares them nightly to detect any unauthorized or accidental changes. This directly protects the integrity of the files by ensuring they have not been modified, which is the core security goal of integrity. Confidentiality and availability are not addressed by hash comparison.

Exam trap

The trap here is confusing integrity with confidentiality because hashing involves cryptographic algorithms, leading candidates to mistakenly think it protects secrecy rather than detecting unauthorized modification.

Why the other options are wrong

The script detects unauthorized changes to configuration files, which is a measure to ensure data has not been altered, directly supporting integrity. Confidentiality concerns preventing unauthorized disclosure, not detecting changes.

The control detects unauthorized changes to configuration files, which is a violation of integrity, not availability. Availability ensures systems are accessible and operational, which is not directly addressed by hash monitoring.

Authentication verifies identity (e.g., who made a change), but the script detects unauthorized changes to file content, which is an integrity concern, not authentication.

When would these options actually be correct?

A question where the control involves encrypting configuration files or restricting read access to them, such as 'A security engineer implements file-level encryption to protect server configuration files from unauthorized viewing. Which security goal is primarily protected?'

A question asking about a control that ensures configuration files are accessible and not deleted or corrupted, such as redundant backups or failover systems, would make availability the correct answer.

A question asking which security goal is primarily protected by requiring a username and password (or biometric) before allowing changes to configuration files would have authentication as the correct answer.

Why candidates pick the wrong answer

Candidates may confuse hashing with encryption or think that protecting files from tampering also implies keeping them secret, but hashing alone does not provide confidentiality.

Candidates may confuse integrity with availability because both are part of the CIA triad, and they might think that detecting changes helps prevent system downtime, but the primary goal is data accuracy, not uptime.

Candidates may confuse integrity (data unchanged) with authentication (verifying source), thinking that detecting changes also verifies the source of the change.

Full explanation →

332

MCQeasy

A file server suddenly renames documents with a new extension and displays a note demanding payment in cryptocurrency to restore access. What type of malware is most likely involved?

A.Ransomware

B.Spyware

C.Worm

D.Rootkit

AnswerA

This is the classic symptom pattern for ransomware. Files are renamed or encrypted, access is disrupted, and the attacker demands payment for recovery. The ransom note and the sudden file changes together make ransomware the best answer.

Why this answer

Ransomware is designed to encrypt files on a system, making them inaccessible, and then demand a ransom—typically in cryptocurrency—to restore access. The sudden renaming of documents with a new extension is a hallmark of ransomware encryption, as it appends a custom extension to indicate the files have been locked. The displayed note demanding payment confirms the extortion motive, which is unique to ransomware among the given options.

Exam trap

The trap here is that candidates may confuse ransomware with other malware types that alter files or display messages, but only ransomware specifically encrypts files and demands a ransom for decryption.

How to eliminate wrong answers

Option B (Spyware) is wrong because spyware is designed to covertly monitor user activity and collect sensitive information, not to encrypt or rename files or demand ransom. Option C (Worm) is wrong because a worm is a self-replicating malware that spreads across networks without requiring user interaction, and it typically does not encrypt files or display ransom notes. Option D (Rootkit) is wrong because a rootkit is a type of malware that hides its presence and provides persistent privileged access to a system, but it does not perform file encryption or extortion.

Full explanation →

333

MCQeasy

A branch office loses power briefly several times each month. Which control best helps keep network equipment running long enough for an orderly shutdown?

A.A UPS

B.A badge reader

C.A locked filing cabinet

D.A fire extinguisher

AnswerA

A UPS provides temporary battery power so systems can stay up briefly or shut down safely.

Why this answer

A UPS (Uninterruptible Power Supply) provides battery backup power to network equipment during a power outage, allowing enough time for an orderly shutdown to prevent data corruption or hardware damage. Unlike surge protectors, a UPS actively supplies clean, regulated power from its batteries when the mains fail, making it the correct control for this scenario.

Exam trap

The trap here is that candidates might confuse a UPS with a surge protector or power strip, thinking any power-related device provides backup runtime, whereas only a UPS contains batteries to sustain power after an outage.

How to eliminate wrong answers

Option B is wrong because a badge reader is an access control mechanism used to restrict physical entry to a facility or room, not a device that provides backup power. Option C is wrong because a locked filing cabinet is a physical security control for protecting sensitive documents, not for maintaining power to network equipment during an outage.

Full explanation →

334

Multi-Selectmedium

A business unit wants to keep using a customer portal even though a low-likelihood, high-impact dependency risk was identified. Leadership does not want to stop the service, but it does want to lower exposure and formally document the remaining risk. Which two actions best fit that approach? Select two.

Select 2 answers

A.Implement compensating controls to reduce the chance or impact of the event.

B.Immediately shut down the portal until the dependency risk is completely eliminated.

C.Formally accept the remaining residual risk at the appropriate management level.

D.Ignore the finding until the next annual audit cycle.

E.Transfer the issue to the help desk by opening a routine support ticket.

AnswersA, C

This is the most direct way to reduce exposure while keeping the service running. Compensating controls, such as extra monitoring, rate limiting, or alternate processing steps, lower either likelihood or impact without requiring the business to stop operations. That matches the stated goal of continuing service while reducing risk.

Why this answer

Implementing compensating controls is a standard risk mitigation strategy that reduces the likelihood or impact of a dependency risk without stopping the service. For a customer portal, this could include adding web application firewall (WAF) rules, rate limiting, or failover mechanisms to lower exposure while keeping the portal operational.

Exam trap

The trap here is confusing risk acceptance with ignoring the risk or deferring it operationally, leading candidates to pick options like D or E instead of recognizing that formal acceptance requires documented management approval and that compensating controls are a valid mitigation strategy.

Full explanation →

335

MCQmedium

A SOC analyst reviews email platform logs for a finance user account. At 08:12, the user successfully signs in from Denver. At 08:15, the same account signs in from a residential ISP in another state. At 08:16, the mailbox creates a new external forwarding rule and deletes the original alert message. The user says they did not set up forwarding. What is the best assessment?

A.False positive caused by normal mailbox synchronization behavior across devices.

B.True positive indicating likely account compromise and unauthorized mailbox abuse.

C.Benign activity because the user successfully authenticated with valid credentials and no malware was detected.

D.A denial-of-service event because the attacker is attempting to overwhelm the mail system.

AnswerB

The sequence of impossible travel, an unexpected sign-in source, and creation of an external forwarding rule strongly indicates unauthorized access. Deleting the alert email suggests the attacker is trying to hide evidence. The most likely conclusion is that the account is compromised and requires immediate response actions.

Why this answer

The rapid succession of logins from geographically distant locations (Denver and a different state via a residential ISP) within three minutes, followed immediately by creation of an external forwarding rule and deletion of the original alert message, is a classic indicator of account takeover. The user's denial of setting up forwarding confirms the activity is unauthorized. This pattern aligns with attacker behavior: after compromising credentials, they establish persistence (forwarding) and cover tracks (deleting alerts).

Exam trap

The trap here is that candidates mistakenly equate valid authentication with legitimate activity, ignoring the strong circumstantial evidence of impossible travel and unauthorized rule creation that clearly indicates compromise.

How to eliminate wrong answers

Option A is wrong because normal mailbox synchronization across devices would not create an external forwarding rule or delete an alert message; synchronization only replicates existing folder/item changes, not administrative rule creation. Option C is wrong because successful authentication with valid credentials does not rule out compromise—attackers often use stolen or phished credentials, and the subsequent anomalous actions (geographic impossibility, rule creation) override any assumption of benign activity. Option D is wrong because a denial-of-service event would involve overwhelming the mail system with traffic, not a single account's specific configuration changes and message deletion.

Full explanation →

336

MCQhard

Based on the exhibit, what is the best conclusion about the signed document?

A.The invoice is confidential because the signature encrypts the document contents.

B.The invoice was not changed after signing and the signer’s certificate chain validated correctly.

C.The invoice can be edited if the timestamp is still within business hours.

D.The sender’s private key is now public because the certificate verified successfully.

AnswerB

A valid digital signature confirms that the document digest still matches the signed value and that the certificate chain was trusted by the verifier. That means the invoice has not been altered since signing, and the signature can be associated with the trusted certificate identity shown in the exhibit.

Why this answer

A valid digital signature provides both integrity (the document was not altered after signing) and authentication (the signer's certificate chain validates to a trusted root). The exhibit shows a successful signature validation, which cryptographically proves that the invoice has not been modified since signing and that the signing certificate is trusted.

Exam trap

The trap here is confusing digital signatures with encryption — candidates often think signing encrypts the document, but signing only provides integrity and non-repudiation, not confidentiality.

How to eliminate wrong answers

Option A is wrong because a digital signature does not encrypt the document; it only creates a hash signed with the private key, leaving the contents readable. Option C is wrong because a valid digital signature is independent of time of day; business hours have no effect on cryptographic validity. Option D is wrong because certificate validation proves the signer's identity, not that the private key is public; the private key remains secret and is never revealed by a successful verification.

Full explanation →

337

MCQmedium

A public web server becomes unreachable during an outage. Netflow shows a large number of DNS responses arriving from many open resolvers, while the server itself only sent tiny spoofed DNS queries with the victim's address as the source. What type of attack is this?

A.DNS zone transfer abuse against the organization.

B.DNS amplification reflection denial-of-service.

C.A replay attack against a web application session token.

D.ARP poisoning inside the local network segment.

AnswerB

This is DNS amplification reflection because the attacker spoofs the victim's IP address in small requests to open resolvers, causing large responses to be sent to the victim instead. The result is a bandwidth flood that can make the server unreachable even though the victim never initiated the traffic. The key clues are tiny queries, spoofed source addresses, many resolvers, and a high volume of unsolicited responses. This is a classic distributed denial-of-service pattern.

Why this answer

This is a classic DNS amplification reflection DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's address) to open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. The NetFlow data shows the server receiving many large DNS responses while only sending tiny spoofed queries, confirming the amplification and reflection vectors.

Exam trap

The trap here is confusing the direction of traffic: candidates may think the server is the attacker because it sends queries, but the spoofed source IP and large incoming responses reveal it is the victim of a reflection attack.

How to eliminate wrong answers

Option A is wrong because DNS zone transfer abuse involves an unauthorized request for a full zone file from a DNS server, not a flood of responses from open resolvers. Option C is wrong because a replay attack captures and retransmits a valid session token to impersonate a user, which does not involve DNS traffic or bandwidth exhaustion.

Full explanation →

338

MCQmedium

After implementing MFA and stronger monitoring, a department still has a small chance of account misuse that could affect a low-value internal tool. The business owner reviews the remaining exposure and agrees it is within tolerance. What should happen next?

A.Escalate the issue to legal because all residual risk must be eliminated.

B.Document the residual risk and obtain formal acceptance from the risk owner.

C.Remove MFA because the remaining risk is already low.

D.Treat the issue as resolved because monitoring alone eliminates all risk.

AnswerB

When controls have reduced the likelihood and impact but some exposure remains, the remaining risk should be documented and formally accepted by the appropriate risk owner. This creates accountability, supports governance, and shows that the organization knowingly approved the remaining exposure after considering business value, cost, and tolerance.

Why this answer

After implementing MFA and stronger monitoring, the remaining exposure is residual risk that must be formally documented and accepted by the risk owner (the business owner). This aligns with the risk management process in Security Program Management, where residual risk that falls within the organization's risk appetite is accepted rather than eliminated. The business owner's agreement indicates formal acceptance, which should be recorded for audit and compliance purposes.

Exam trap

The trap here is that candidates may think all risk must be eliminated or that monitoring alone suffices, but CompTIA tests the understanding that residual risk can be accepted when it falls within the organization's risk appetite, especially for low-value assets.

How to eliminate wrong answers

Option A is wrong because it states that all residual risk must be eliminated, which contradicts the principle of risk acceptance—organizations accept residual risk that is within tolerance, especially for low-value assets. Option C is wrong because removing MFA would increase the risk exposure, not reduce it, and the remaining risk is already deemed acceptable by the business owner. Option D is wrong because monitoring alone does not eliminate all risk; it only detects misuse, and residual risk remains even with monitoring in place.

Full explanation →

339

MCQmedium

A web service begins experiencing severe latency. Netflow shows thousands of short DNS queries leaving the attacker network, while a much larger volume of DNS responses is arriving at the victim’s public IP address from many open resolvers. Which attack is most likely occurring?

A.Replay attack using previously captured packets

B.DNS reflection and amplification denial-of-service attack

C.ARP poisoning that redirects local traffic on a LAN

D.Session hijacking through stolen authentication cookies

AnswerB

This is the best match. The attacker sends small DNS requests that cause open resolvers to send much larger responses to the victim's IP address. Because the victim receives the responses, the attack uses reflection; because the responses are much larger than the requests, it also uses amplification. The result is bandwidth exhaustion and severe latency, which are common symptoms of a volumetric DDoS attack.

Why this answer

The attack described is a DNS reflection and amplification denial-of-service attack. The attacker sends thousands of short DNS queries with a spoofed source IP (the victim's IP) to many open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. NetFlow shows a small volume of queries leaving the attacker and a much larger volume of responses arriving at the victim, which is the hallmark of amplification (small request, large response) combined with reflection (responses from third-party resolvers).

Exam trap

The trap here is that candidates may confuse the high volume of responses arriving at the victim with a simple volumetric attack, missing the key indicators of reflection (responses from many different IPs) and amplification (small queries generating large responses), which uniquely identify a DNS reflection/amplification DDoS.

How to eliminate wrong answers

Option A is wrong because a replay attack involves capturing and retransmitting valid packets to impersonate a user or repeat a transaction, not generating massive traffic from open resolvers to a victim. Option C is wrong because ARP poisoning is a local network attack that manipulates ARP tables to intercept traffic on a LAN, not a volumetric DDoS attack using DNS over the internet. Option D is wrong because session hijacking through stolen cookies targets a user's authenticated session, not the network-level flooding of a victim with DNS responses.

Full explanation →

340

MCQmedium

A SOC analyst receives an alert from the EDR system indicating that the process 'C:\Program Files\Vendor\Updater.exe' attempted to modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key on a user's workstation. The analyst checks the file hash and finds it matches a known legitimate software updater. Which of the following actions is most appropriate for the analyst to take?

A.Disable the software updater immediately to prevent further registry modifications.

B.Create an exception rule in the EDR to suppress future alerts for this process.

C.Investigate the user's recent activity and check for signs of process hollowing or DLL injection.

D.Isolate the workstation from the network and reimage the system immediately.

AnswerC

This is the correct next step. The analyst should examine the process's behavior in depth, including checking for anomalies such as unexpected command-line arguments, suspicious parent processes, or indicators of code injection, before concluding whether the alert is a false positive.

Why this answer

The EDR alert indicates a legitimate process (Updater.exe) modifying a critical persistence registry key (Run). Even with a known good hash, the process could be compromised via process hollowing or DLL injection, where malicious code runs under the guise of a trusted executable. Investigating user activity and checking for these attack techniques is the appropriate next step to confirm whether the behavior is benign or indicative of a threat.

Exam trap

The trap here is that candidates assume a matching file hash guarantees the process is safe, overlooking that attackers can subvert a legitimate process at runtime through memory-based attacks that do not alter the file on disk.

Why the other options are wrong

The file hash matches a known legitimate updater, so disabling it without further investigation could disrupt necessary updates and is not justified by the alert alone.

Isolating and reimaging is too drastic given that the file hash matches a known legitimate updater; the alert is likely a false positive or indicates a sophisticated attack like process hollowing, which requires investigation first.

When would these options actually be correct?

This would be correct if the EDR alert indicated that the process was unsigned, had a suspicious file path, or was known malware, and the analyst had confirmed malicious activity requiring immediate containment.

This would be correct if the EDR alert indicated a known malicious process (e.g., ransomware) modifying the Run key, and the analyst had confirmed the file hash matched a known threat, requiring immediate containment.

Why candidates pick the wrong answer

Candidates may assume any registry modification to autorun keys is malicious and jump to disabling the process, overlooking that legitimate software updaters often modify this key for startup persistence.

Candidates may default to aggressive containment actions when seeing registry modifications, especially in high-stakes scenarios, without considering that legitimate software updaters commonly modify the Run key.

Full explanation →

341

MCQeasy

A laptop is suspected of being used in a malware incident. It is still powered on and connected to Wi-Fi. What should the responder do before shutting it down?

A.Install endpoint protection updates on the laptop right away.

B.Capture volatile evidence such as running processes and memory contents.

C.Delete suspicious files so the malware can no longer spread.

D.Reboot the laptop immediately to clear the suspected malware.

AnswerB

This is the best action because volatile data can disappear when the system is powered off or rebooted. Running processes, network connections, logged-on users, and memory contents may contain the strongest clues about active malware and attacker activity. Preserving this information first supports later investigation and helps responders understand what happened before they take more disruptive containment steps.

Why this answer

Volatile evidence, such as running processes, network connections, and memory contents, is lost when the system is powered off. Capturing this data first preserves critical forensic artifacts that can reveal the malware's behavior, persistence mechanisms, and indicators of compromise (IOCs). In a live incident, the responder must follow the order of volatility (RFC 3227) to collect the most ephemeral data before it disappears.

Exam trap

The trap here is that candidates mistakenly think immediate containment (e.g., deleting files or rebooting) is the priority, but the SY0-701 exam emphasizes preserving volatile evidence first to support forensic analysis and legal proceedings.

How to eliminate wrong answers

Option A is wrong because installing endpoint protection updates could alter the system state, overwrite evidence, or trigger anti-forensic behavior by the malware. Option C is wrong because deleting suspicious files destroys evidence and may not stop the malware, which could be running in memory or have persistence mechanisms. Option D is wrong because rebooting clears volatile memory (RAM), losing critical evidence like running processes, network connections, and injected code, and may allow malware to evade detection.

Full explanation →

342

MCQeasy

An employee notices that a contractor left a printed report containing customer data on a conference room table. What should the employee do first?

A.Take a photo of the report and post it in the team chat as a warning.

B.Secure the report and report the incident through the company's approved process.

C.Leave the report where it is so the contractor can collect it later.

D.Shred the report immediately without telling anyone.

AnswerB

The best first action is to protect the sensitive document from further exposure and then report it through the proper process. This limits privacy impact, preserves accountability, and allows the organization to handle the issue according to policy. It also teaches safe behavior without unnecessarily spreading the data.

Why this answer

The immediate priority is to protect the sensitive customer data from further unauthorized access by securing the report, and then to follow the organization's incident response policy. This aligns with the principle of data breach containment and the requirement to report security incidents through official channels to ensure proper investigation and compliance with regulations like GDPR or HIPAA.

Exam trap

The trap here is that candidates may think immediate destruction (shredding) is the best way to protect data, but they overlook the legal and procedural requirement to preserve evidence and report the incident through official channels.

How to eliminate wrong answers

Option A is wrong because taking a photo and posting it in a team chat would further expose the sensitive customer data to unauthorized individuals, violating data privacy and potentially escalating the breach. Option C is wrong because leaving the report unattended continues to expose the data to anyone who enters the conference room, failing to contain the incident. Option D is wrong because shredding the report without reporting destroys potential evidence needed for an investigation into how the data was exposed and whether other data was compromised, violating incident response procedures.

Full explanation →

343

MCQmedium

Users in a warehouse report an SMS claiming a missed delivery. The link opens a login page that closely matches the company portal, and several users later receive unauthorized password reset emails. What attack is most likely?

A.Smishing, because the malicious lure is delivered through text messaging.

B.Vishing, because the attackers are likely trying to get a callback from the victims.

C.Spear phishing, because the message appears customized for warehouse employees.

D.Baiting, because the fake delivery notice tempts users to click for a reward.

AnswerA

Smishing is specifically an SMS-based phishing attack. The deceptive text message claiming a missed delivery and the accompanying fake portal are classic smishing indicators, as the attack vector is the Short Message Service on mobile devices. The message creates urgency to lure users into clicking a malicious link, which is the core mechanism of smishing.

Why this answer

The attack is smishing because the initial lure is delivered via SMS (Short Message Service), directing victims to a fraudulent login page. This aligns with the definition of smishing, a form of phishing that uses text messages to trick recipients into revealing sensitive information. The subsequent unauthorized password reset emails confirm credential compromise, which is the typical goal of smishing attacks.

Exam trap

CompTIA often tests the distinction between attack vectors (SMS vs. email vs. voice) rather than the content of the lure, so candidates may confuse smishing with spear phishing if they focus on the customized delivery notice instead of the delivery method.

How to eliminate wrong answers

Option B is wrong because vishing (voice phishing) relies on voice calls or voicemail prompts to elicit a callback, not an SMS with a link. Option C is wrong because spear phishing involves highly targeted, personalized emails, not SMS messages, and the scenario does not indicate the message was customized beyond a generic delivery notice. Option D is wrong because baiting involves offering a physical or digital lure (e.g., a free USB drive or download) to entice action, not a deceptive SMS link to a fake login page.

Full explanation →

344

MCQmedium

A vendor-supported legacy application can run only with a deprecated browser plug-in on two engineering workstations for 30 days while a replacement is tested. Management wants to allow the exception without weakening the security program. What is the best action?

A.Approve the exception informally by email and revisit it if problems appear.

B.Document a time-bound exception, record the risk, apply compensating controls, and schedule review before expiration.

C.Disable all monitoring on the workstations so the application will function normally.

D.Publish the exception as a permanent guideline so other teams can follow it.

AnswerB

A formal, time-bound exception is the correct governance approach because it explicitly documents the accepted risk, names the system owner, and specifies why the legacy application must operate outside baselines. Compensating controls — such as host-based firewalls, application allowlisting, or network segmentation — are implemented to reduce exposure while the exception is active. Scheduling a review before expiration forces a reassessment of whether the vulnerability still exists, whether the controls remain effective, and whether the application can now be upgraded or retired.

Why this answer

It follows the formal exception process required by a mature security program: documenting the exception with a specific time bound (30 days), recording the associated risk, applying compensating controls (such as network segmentation or host-based firewall rules to isolate the deprecated plug-in), and scheduling a review before expiration ensures the risk is managed and the exception does not become permanent. This aligns with the SY0-701 objective of implementing risk management processes, where time-bound exceptions with compensating controls are the standard way to handle legacy dependencies without weakening the overall security posture.

Exam trap

The trap here is that candidates often choose Option A (informal approval) because it seems quick and pragmatic, but the SY0-701 exam emphasizes that any exception must be formally documented, risk-assessed, and time-bound to maintain a defensible security program.

How to eliminate wrong answers

Option A is wrong because an informal email approval lacks documentation, risk recording, and compensating controls, which violates the security program's requirement to track and manage exceptions; it also creates an audit trail gap that could lead to uncontrolled risk. Option C is wrong because disabling all monitoring on the workstations removes visibility into security events, directly weakening the security program and violating the principle of defense in depth; the application only needs the deprecated plug-in, not the elimination of monitoring. Option D is wrong because publishing the exception as a permanent guideline would institutionalize a temporary risk, contradicting the 30-day replacement timeline and potentially encouraging other teams to adopt insecure practices without proper risk assessment.

Full explanation →

345

MCQmedium

A scan keeps reporting the same medium-severity TLS configuration issue on a public web server. The application owner says the vendor software cannot be changed until next quarter, but they can place the service behind a reverse proxy that enforces stronger cipher settings. How should the issue be handled in the vulnerability management process?

A.Close the finding as fixed because the reverse proxy reduces the risk

B.Record an exception, document the compensating control, and set a review or remediation date

C.Mark the finding as a false positive and remove it from future scans

D.Ignore the finding until the vendor releases a new version

AnswerB

Recording an exception is the correct approach because the vulnerability is genuine but the organization is choosing to accept the residual risk in exchange for a documented compensating control (the reverse proxy). This formal risk acceptance process ensures that the finding remains visible, involves the appropriate decision-makers, and assigns a review or remediation date so the risk is revisited rather than forgotten. It also provides an audit trail that clearly distinguishes between a false positive and a deliberate, managed risk acceptance, which is essential for compliance frameworks like PCI DSS or NIST.

Why this answer

The vulnerability management process requires that when a vulnerability cannot be immediately remediated, compensating controls must be formally documented as an exception with a scheduled remediation date. In this scenario, the reverse proxy enforces stronger cipher settings, effectively mitigating the TLS misconfiguration at the network edge, which is a valid compensating control. Recording the exception ensures auditability and prevents the finding from being prematurely closed while the vendor software remains vulnerable.

Exam trap

The trap here is that candidates assume a compensating control automatically closes the finding, when in fact vulnerability management requires an exception process with documentation and a future remediation date to ensure the root cause is eventually addressed.

How to eliminate wrong answers

Option A is wrong because simply placing a reverse proxy does not fix the underlying TLS configuration on the origin server; the finding should not be closed as 'fixed' since the vulnerability still exists on the server itself. Option C is wrong because the TLS configuration issue is a real vulnerability, not a false positive, and removing it from scans would bypass proper risk tracking and violate vulnerability management best practices.

Full explanation →

346

Drag & Dropmedium

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.

Full explanation →

347

MCQeasy

Employees in a lobby report that their phones automatically connected to a wireless network named "CorpWiFi." Soon after, they were prompted to sign in through a web page that did not look like the normal company portal. What attack is most likely?

A.Bluetooth pairing attack

B.Evil twin

C.NFC relay attack

D.MAC flooding

AnswerB

An evil twin is a rogue wireless access point that imitates a legitimate SSID so victims connect to it by mistake. The fake network name and suspicious sign-in page strongly suggest a malicious clone of the real Wi-Fi.

Why this answer

The scenario describes an evil twin attack, where a rogue access point (AP) broadcasts a SSID identical to the legitimate corporate network ("CorpWiFi"). When employees' devices automatically connect to the stronger signal of the rogue AP, they are served a fake captive portal designed to capture credentials or other sensitive data. This attack exploits the lack of mutual authentication in standard 802.11 Wi-Fi associations.

Exam trap

The trap here is that candidates may confuse an evil twin with a simple misconfiguration or a phishing attack, but the key indicator is the automatic connection to a network with the same SSID followed by a suspicious login page, which directly points to a rogue AP impersonating the legitimate network.

How to eliminate wrong answers

Option A is wrong because a Bluetooth pairing attack requires active pairing initiation and does not involve a web-based sign-in prompt or automatic Wi-Fi connection. Option C is wrong because an NFC relay attack extends the range of an NFC transaction (e.g., contactless payment) and does not create a fake Wi-Fi network or captive portal. Option D is wrong because MAC flooding is a Layer 2 attack that floods a switch's CAM table to force it into hub mode, enabling packet sniffing; it does not involve a rogue wireless network or a sign-in page.

Full explanation →

348

MCQeasy

An operations manager states that the customer portal may be unavailable for no more than 15 minutes in a month before the issue must be escalated to executives. Which risk management concept does this statement describe?

A.Risk appetite, because it describes the organization’s overall willingness to take risk.

B.Risk tolerance, because it sets a specific measurable threshold for acceptable impact.

C.Risk transfer, because the business is moving the outage risk to another party.

D.Risk avoidance, because the organization is eliminating the portal risk completely.

AnswerB

Risk tolerance is the specific, measurable limit an organization is willing to accept for a particular risk or service. In this case, the 15-minute outage threshold is a clear boundary that triggers escalation, so it is a tolerance statement.

Why this answer

Risk tolerance defines the specific, measurable deviation from risk appetite that an organization is willing to accept. The operations manager's statement sets a precise threshold—15 minutes of unavailability per month—before escalation is required, which is a classic example of risk tolerance in IT service management.

Exam trap

CompTIA often tests the distinction between risk appetite (broad willingness) and risk tolerance (specific measurable threshold), causing candidates to confuse the two when a numeric value is given.

How to eliminate wrong answers

Option A is wrong because risk appetite is the broad, high-level willingness to accept risk (e.g., 'we accept some downtime'), not a specific numeric threshold like 15 minutes. Option C is wrong because risk transfer involves shifting risk to a third party (e.g., via insurance or outsourcing), not setting an internal escalation policy. Option D is wrong because risk avoidance means eliminating the risk entirely (e.g., taking the portal offline permanently), not defining a tolerance for acceptable downtime.

Full explanation →

349

MCQmedium

The security team configures the badge system so employees must present both a badge and a PIN before entering the data center. The access logs are reviewed weekly for failed attempts. Which pair of control types best describes these measures?

A.Preventive and detective, because one measure blocks access and the other identifies suspicious activity.

B.Corrective and recovery, because the logs can restore access after a badge failure.

C.Deterrent and compensating, because the PIN discourages attackers and the logs replace the badge reader.

D.Administrative and physical, because the weekly review and the badge reader are both physical measures.

AnswerA

Requiring a badge and PIN is preventive because it attempts to stop unauthorized entry before it happens. Reviewing access logs is detective because it helps identify misuse or attempted misuse after the fact. Together, these controls reduce the likelihood of unauthorized entry while also giving the security team visibility into failed or unusual access attempts. This is a practical layered approach.

Why this answer

The badge and PIN requirement is a preventive control that blocks unauthorized access to the data center, while the weekly review of access logs is a detective control that identifies suspicious activity after the fact. Preventive controls stop incidents before they occur, and detective controls discover violations that have already happened, making this pair the best fit for the described measures.

Exam trap

The trap here is confusing detective controls (which identify past events) with corrective controls (which fix issues), or misclassifying administrative controls (like policy reviews) as physical controls, leading candidates to pick option D.

How to eliminate wrong answers

Option B is wrong because corrective and recovery controls are designed to fix or restore systems after an incident (e.g., restoring access after a badge failure), but the logs are used for review, not for restoration. Option C is wrong because deterrent controls discourage attackers (e.g., warning signs), not PINs that actively block access, and compensating controls provide alternative protection when a primary control fails, not logs that replace a badge reader. Option D is wrong because the weekly review is an administrative control (policy/procedure), not a physical measure, and the badge reader is a physical control, not an administrative one.

Full explanation →

350

MCQmedium

Based on the exhibit, what is the best security change to address the exposed management access on the cloud VM?

A.Ask the provider to patch the guest operating system on the VM.

B.Move SSH to a public IP on the VM so administrators can reach it more easily.

C.Restrict SSH through a bastion host or VPN and remove direct internet access to the VM.

D.Enable object storage versioning to protect the VM from unauthorized logins.

AnswerC

Restricting SSH through a bastion host or VPN eliminates the VM's direct internet exposure, forcing all management traffic to traverse a controlled, authenticated gateway. This reduces the attack surface by hiding the VM's SSH port from the public, adds logging and access control, and ensures only approved administrators with strong authentication can reach the management interface. It is the recommended security change for managing an IaaS VM.

Why this answer

Exposing SSH directly to the internet on a cloud VM creates a significant attack surface, allowing brute-force and credential-stuffing attacks. A bastion host (jump box) or VPN provides a controlled, authenticated entry point, while removing direct internet access to the VM ensures management traffic is isolated and audited. This aligns with the principle of defense in depth and the AWS/cloud best practice of using a bastion host for administrative access.

Exam trap

CompTIA often tests the misconception that patching (Option A) or moving the service to a public IP (Option B) solves exposure issues, when the real security flaw is the lack of network segmentation and a controlled access point like a bastion host or VPN.

How to eliminate wrong answers

Option A is wrong because patching the guest OS addresses software vulnerabilities but does not eliminate the exposed SSH management interface on the public internet; the core issue is network exposure, not missing patches. Option B is wrong because moving SSH to a public IP makes the management access even more exposed, increasing the attack surface and violating the principle of least privilege. Option D is wrong because object storage versioning is a data protection feature for recovering from accidental deletion or overwrite of objects; it has no relevance to securing VM management access or preventing unauthorized logins.

Full explanation →

351

MCQeasy

A desktop engineering team needs the document that sets the mandatory minimum password length and screen-lock timeout for all company laptops. Which document type should they use?

A.Policy

B.Standard

C.Guideline

D.Procedure

AnswerB

A standard defines mandatory, specific requirements such as exact password length, timeout values, or encryption settings. In this case, the team needs a document that tells them the minimum baseline every laptop must meet. Standards are enforceable and precise, which makes them the right fit for organization-wide technical requirements.

Why this answer

A standard specifies mandatory technical requirements, such as minimum password length and screen-lock timeout, that must be implemented on all company laptops. Unlike a policy, which is high-level and states management intent, a standard provides the specific, enforceable configuration settings. This aligns with the desktop engineering team's need for a document that dictates exact technical parameters.

Exam trap

The trap here is confusing a policy (the 'what' and 'why') with a standard (the 'how much' or 'how many'), leading candidates to choose 'Policy' because they think it sets rules, but policies lack the specific, measurable technical thresholds that standards provide.

How to eliminate wrong answers

Option A is wrong because a policy is a high-level statement of management intent and goals, not a document that sets specific technical values like 'minimum password length of 8 characters' or 'screen-lock timeout of 15 minutes'. Option C is wrong because a guideline offers recommendations and best practices, not mandatory requirements; the team needs a document that enforces compliance, not just suggests. Option D is wrong because a procedure provides step-by-step instructions on how to perform a task (e.g., how to configure a password policy in Group Policy), not the actual mandatory values themselves.

Full explanation →

352

MCQhard

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

A.Run one server and keep nightly backups in cloud object storage.

B.Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.

C.Deploy active-active multi-region capacity with identical production load in both regions.

D.Add RAID 1 and a spare power supply to the database server.

AnswerB

This provides local redundancy for server failure and a lower-cost secondary site for failover if the primary site is lost.

Why this answer

It combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Exam trap

The trap here is that candidates often confuse high availability (local redundancy) with disaster recovery (site-level failover), and incorrectly assume that RAID or backups alone satisfy the requirement for automatic failover after a site outage.

How to eliminate wrong answers

Option A is wrong because nightly backups in cloud object storage provide only point-in-time recovery, not automatic failover or near-continuous availability; a server failure would cause extended downtime while restoring from backup. Option C is wrong because active-active multi-region capacity with identical production load in both regions directly contradicts management's requirement to avoid paying for fully active production capacity in two regions. Option D is wrong because RAID 1 and a spare power supply protect only against local hardware failures (disk or power supply) within a single server, not against a server failure or a full site outage.

Full explanation →

353

MCQeasy

A SOC analyst sees 38 failed logins for a finance user account from one public IP address over 4 minutes, followed by one successful login. What should the analyst do first?

A.Immediately delete the account to stop any further access attempts.

B.Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.

C.Assume the account is compromised and notify all users to change their passwords.

D.Close the alert because one successful login means the activity was normal.

AnswerB

Correlating related logs is the best first step because it helps determine whether the event is a real attack or an expected user behavior pattern. Authentication logs, VPN records, and account activity can show whether the source IP, timing, and device match a legitimate session. Good triage focuses on confirmation before disruptive response actions.

Why this answer

The analyst must first verify whether the failed logins followed by a successful login represent a brute-force attack or legitimate behavior, such as a user mistyping their password and then succeeding. Correlating authentication logs with user activity and VPN records helps confirm if the public IP belongs to a known remote user or VPN endpoint, which is a standard first step in incident response to avoid false positives.

Exam trap

The trap here is that candidates assume a successful login after many failures always indicates compromise, but the question tests the critical first step of verification through log correlation before taking any action.

How to eliminate wrong answers

Option A is wrong because immediately deleting the account disrupts business operations and destroys forensic evidence; account deletion should only occur after thorough investigation and confirmation of compromise. Option C is wrong because assuming compromise without verification leads to unnecessary panic and password fatigue; the analyst must first correlate logs to determine if the activity is expected before initiating a password reset. Option D is wrong because one successful login after many failures does not indicate normal activity—it could indicate a successful brute-force attack, and closing the alert without investigation violates security operations procedures.

Full explanation →

354

Multi-Selecthard

A SIEM analyst reviews the following sequence from a VPN and email platform over 15 minutes: 47 failed logins against different accounts from one public IP, one successful VPN login from that same IP, a new inbox forwarding rule to an external address, and a mailbox sign-in from a device never seen before. Which three findings most strongly support a password-spraying-to-compromise scenario? Select three.

Select 3 answers

A.Many failed logins across different usernames from the same source IP in a short time window.

B.A successful VPN login from the same source IP after the burst of failures.

C.An inbox forwarding rule sending messages to an external address.

D.A workstation patch installation completed earlier that day.

E.The mailbox server reported normal disk utilization during the same hour.

AnswersA, B, C

This pattern is the hallmark of password spraying, where an attacker tests a small set of common passwords against a large number of accounts to evade account lockout thresholds. The single source IP indicates a coordinated scripted attempt, and the short time window suggests automation. In the MITRE ATT&CK framework, this maps to T1110.003 (Password Spraying) under Initial Access.

Why this answer

A high volume of failed logins against multiple accounts from a single public IP within a short time window is the hallmark of a password-spraying attack, where the attacker tries a few common passwords across many usernames to avoid account lockout. This pattern is distinct from a brute-force attack, which targets a single account with many passwords.

Exam trap

The trap here is that candidates may think a single successful login or a forwarding rule alone is suspicious, but the question asks for findings that most strongly support the password-spraying-to-compromise scenario, which requires the combination of the spray pattern, the successful login from the same source, and the post-compromise persistence action.

Full explanation →

355

Multi-Selectmedium

After several password-reset incidents, the security team wants one document that sets mandatory minimum controls for privileged accounts and another that tells the help desk the exact steps to verify identity and reset access. Which two document types should they use? Select two.

Select 2 answers

A.Policy, because it explains the organization's overall security intent in broad terms.

B.Standard, because it defines the mandatory minimum requirements that everyone must follow.

C.Procedure, because it gives the exact step-by-step actions for help desk staff.

D.Guideline, because it provides recommended practices that staff may ignore if needed.

E.Baseline, because it is mainly used as a casual reference document for analysts.

AnswersB, C

A standard is the right document for mandatory baseline requirements, such as minimum password length, MFA requirements, or privileged account rules. It converts policy intent into specific, measurable requirements that can be enforced consistently across the organization.

Why this answer

A standard defines mandatory minimum requirements that must be followed, such as password length, complexity, and MFA enforcement for privileged accounts. This ensures consistent security controls across the organization without ambiguity, unlike a policy which is high-level intent.

Exam trap

The trap here is confusing a policy (high-level intent) with a standard (mandatory minimums), and a guideline (optional) with a procedure (step-by-step), leading candidates to pick A and D instead of B and C.

Full explanation →

356

MCQmedium

During a conference, several employees connect to a wireless network named the same as the hotel's guest Wi-Fi. Shortly after connecting, they receive certificate warnings when accessing the company portal, and packet capture shows a nearby laptop advertising the same SSID and relaying traffic. What type of attack is most likely?

A.Rogue access point or evil twin attack, because a fake wireless network impersonates a legitimate one.

B.Replay attack, because previously captured wireless frames are being resent to the network.

C.DNS poisoning, because users are being sent to the wrong website through altered name resolution.

D.Denial of service, because users are simply unable to connect reliably.

AnswerA

An evil twin is a rogue access point that broadcasts the same SSID as a legitimate corporate network, often with a stronger signal, causing nearby clients to auto-associate. Once connected, the attacker can perform man-in-the-middle attacks, capture authentication credentials, or redirect users to malicious sites. This precisely matches the conference scenario, where employees are lured to a fake wireless network that impersonates a trusted one.

Why this answer

The attack described is an evil twin (a type of rogue access point) because the attacker sets up a laptop broadcasting the same SSID as the hotel's legitimate guest Wi-Fi. When employees connect to this fake network, the attacker can intercept traffic and present a fraudulent certificate for the company portal, triggering certificate warnings. The packet capture confirming the laptop is relaying traffic proves it is acting as a man-in-the-middle, not merely a passive listener.

Exam trap

The trap here is that candidates confuse an evil twin with a simple rogue access point, but the key differentiator is that the evil twin specifically impersonates a legitimate SSID to trick users, while a rogue AP might use a different SSID; the certificate warning and relayed traffic confirm the man-in-the-middle role, not just unauthorized access.

How to eliminate wrong answers

Option B is wrong because a replay attack involves capturing and retransmitting valid wireless frames (e.g., authentication or data packets) to impersonate a user or gain unauthorized access, but here the attacker is actively advertising a fake SSID and relaying live traffic, not replaying old frames. Option C is wrong because DNS poisoning alters DNS resolution to redirect users to a malicious site, but the scenario describes certificate warnings on the company portal and a laptop relaying traffic, not a manipulated DNS response. Option D is wrong because a denial of service attack would prevent connectivity or degrade performance, whereas users are successfully connecting to the fake network and receiving certificate warnings, indicating active interception rather than service disruption.

Full explanation →

357

MCQmedium

A SOC analyst investigates a host after an employee opens an invoice attachment. The endpoint shows PowerShell running in a hidden window, no new executable files are created on disk, and the same suspicious activity returns after a reboot. What is the most likely attack type?

A.Fileless attack, because the malicious activity is operating primarily in memory and using native tools.

B.Ransomware, because the user opened an email attachment.

C.Worm, because PowerShell is a common scripting tool.

D.Rootkit, because the attacker is hiding the process from normal tools.

AnswerA

Fileless attacks rely on legitimate scripting engines and memory-resident techniques instead of dropping obvious executable files. Hidden PowerShell activity, repeated behavior after reboot, and the absence of a new binary are strong signs that the attacker is leveraging trusted operating system components. This approach often helps malware evade traditional file-based scanning while still achieving persistence or command execution.

Why this answer

The attack is fileless: it runs PowerShell in a hidden window without writing new executables to disk, and persistence after reboot indicates the malicious code is stored in the registry or a script that loads into memory at startup. Fileless attacks leverage native tools like PowerShell, WMI, or .NET to execute payloads entirely in memory, bypassing traditional file-based detection.

Exam trap

The trap here is that candidates confuse 'fileless' with 'no persistence' or assume any attachment-based attack is ransomware, but the key indicators—hidden PowerShell, no new executables, and post-reboot persistence—point directly to a fileless attack using native Windows tools.

How to eliminate wrong answers

Option B is wrong because ransomware typically encrypts files and demands payment, but the scenario describes no encryption, no ransom note, and no new executables—only persistent in-memory PowerShell activity. Option C is wrong because a worm self-replicates across networks without user interaction, while this attack requires the user to open an invoice attachment and shows no lateral movement or self-propagation.

Full explanation →

358

MCQeasy

An employee receives a text message saying their payroll account is locked and asks them to tap a link and enter a one-time passcode. What type of attack is this?

A.Phishing

B.Smishing

C.Vishing

D.Baiting

AnswerB

Smishing is phishing delivered by SMS or another text messaging service. The attacker uses urgency and a fake account-lock message to trick the user into clicking a malicious link and giving away a one-time code.

Why this answer

Smishing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) that lures the recipient into tapping a link and entering a one-time passcode. Unlike generic phishing which uses email, smishing specifically exploits SMS trust and the limited screen real estate of mobile devices to bypass security awareness.

Exam trap

The trap here is that candidates confuse smishing with generic phishing because both involve a link and credential theft, but the exam specifically tests the delivery method (SMS vs. email) as the distinguishing factor.

How to eliminate wrong answers

Option A (Phishing) is wrong because phishing specifically refers to email-based social engineering, not SMS/text messaging. Option C (Vishing) is wrong because vishing uses voice calls or voicemail, not text messages. Option D (Baiting) is wrong because baiting involves offering a physical or digital lure (e.g., a free USB drive or download) to trick the victim, not a direct message requesting credentials.

Full explanation →

359

MCQeasy

System administrators need to manage internal switches from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. What should be used?

A.Telnet over port 23 with an allow list on the firewall.

B.A VPN into the internal network, then SSH or HTTPS for administration.

C.RDP directly to the switch management interface from the public IP address.

D.Open the management port to the internet and rely on a long password.

AnswerB

This is the best answer because it keeps management interfaces off the public internet while still allowing secure remote administration. The VPN provides encrypted transport and can enforce strong user authentication, and SSH or HTTPS protects the device management session itself. This layered approach matches common best practice for remote admin access and reduces exposure of sensitive management services.

Why this answer

A VPN creates an encrypted tunnel over the internet, protecting management traffic in transit. Once connected to the internal network, SSH (for CLI) or HTTPS (for web GUI) provides strong authentication and encryption for switch administration. This approach avoids exposing management ports directly to the internet, reducing the attack surface.

Exam trap

The trap here is that candidates may think Telnet with a firewall allow list is sufficient, overlooking that Telnet provides no encryption, or they may confuse RDP as a valid switch management protocol, when switches typically use SSH or HTTPS for administration.

How to eliminate wrong answers

Option A is wrong because Telnet transmits all data, including credentials, in cleartext (no encryption), violating the encryption requirement. Option C is wrong because RDP is designed for remote desktop access to workstations, not for switch management interfaces, and exposing it directly to the internet bypasses the requirement to avoid direct exposure. Option D is wrong because opening the management port to the internet violates the requirement to avoid direct exposure, and relying solely on a long password does not provide strong authentication (e.g., no multi-factor or certificate-based authentication) and leaves the system vulnerable to brute-force attacks.

Full explanation →

360

Multi-Selectmedium

Which three of the following are characteristics of the principle of least privilege? (Choose three.)

Select 3 answers

.Users are granted only the permissions necessary to perform their job functions

.Administrative accounts are used only for administrative tasks, not daily work

.Privileges are reviewed and revoked when no longer needed

.All users have equal access to all system resources

.Privileges are granted permanently once assigned

.Users are given full control over all shared folders

Why this answer

The principle of least privilege dictates that users should only have the minimum permissions necessary to complete their job functions, which reduces the attack surface and limits potential damage from compromised accounts. Administrative accounts should be reserved exclusively for administrative tasks to prevent accidental or malicious misuse of elevated privileges. Regularly reviewing and revoking privileges ensures that access rights remain aligned with current job requirements, preventing privilege creep.

Exam trap

The trap here is that candidates may confuse the principle of least privilege with the concept of 'zero trust' or mistakenly think that permanent privilege grants are acceptable if initially assigned correctly, ignoring the need for ongoing review and revocation.

Full explanation →

361

Multi-Selecthard

A finance app uses the corporate IdP for authentication. A user who moved out of finance can still approve invoices until the browser session expires, and the app caches local roles. Which two changes best make access changes take effect faster without storing app passwords? Select two.

Select 2 answers

A.Shorten token and session lifetimes, and require reauthentication for high-risk actions.

B.Increase password complexity but keep session duration unchanged.

C.Use current IdP group claims for authorization instead of cached local roles.

D.Disable SSO and email one-time passwords for every login.

E.Keep long-lived sessions to reduce help desk tickets.

AnswersA, C

Shortening token and session lifetimes directly limits the window in which a previously issued access token or session cookie remains valid after an IdP-based role change; combined with step-up authentication (e.g., requiring a fresh TOTP or password for invoice approval), it forces a new authorization decision at the exact moment of a high-risk action. This aligns with the principle of least privilege because stale JWT claims or cached roles expire quickly, and sensitive operations trigger an additional proof of identity, reducing the likelihood of an unauthorized approval.

Why this answer

Shortening token and session lifetimes reduces the window during which stale permissions remain active, and requiring reauthentication for high-risk actions (like approving invoices) ensures that the user's current authorization status is verified before sensitive operations. This directly addresses the problem of cached roles persisting beyond the user's actual group membership changes.

Exam trap

The trap here is that candidates may think increasing password complexity or disabling SSO improves security, but the question specifically asks for changes that make access changes take effect faster without storing app passwords, so the focus must be on session/token lifetimes and authorization source, not authentication strength.

Full explanation →

362

MCQmedium

A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?

A.Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.

B.Deploy a secure web gateway and require all remote users to browse through a proxy.

C.Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.

D.Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.

AnswerC

A software-defined perimeter (SDP) or zero trust network access (ZTNA) solution authenticates and authorizes each connection request individually, creating an encrypted tunnel only to the requested application. This prevents lateral movement because the user never receives a network-level address on the internal LAN.

Why this answer

A software-defined perimeter (SDP) implements zero trust by authenticating both the user and device before granting access to specific applications, not the entire network. This prevents lateral movement by ensuring that even after authentication, the endpoint can only reach the allowed application, not the full LAN. This aligns with the zero trust principle of 'never trust, always verify' and micro-segmentation.

Exam trap

The trap here is that candidates often confuse 'stronger authentication' (MFA) or 'better firewalling' (NGFW) with zero trust, but zero trust requires eliminating implicit trust at the network layer by granting access only to specific applications, not the entire LAN.

Why the other options are wrong

A next-generation firewall with strict rules still provides network-layer access to the entire LAN after authentication, which does not prevent lateral movement by compromised endpoints. Zero trust requires per-request, least-privilege access to specific resources, not broad network access.

A secure web gateway (SWG) primarily filters web traffic and enforces policies for web-based applications, but it does not provide per-application, identity-aware access control for all remote resources. It still typically operates at the network layer and does not fully implement zero trust's principle of least privilege for individual applications.

Enabling MFA for VPN and using split tunneling still grants full network-layer access to the LAN after authentication, which violates zero trust's principle of least privilege and does not prevent lateral movement by compromised endpoints.

When would these options actually be correct?

This option would be correct if the question asked for a solution to improve network security by segmenting traffic and enforcing application-level controls without changing the VPN architecture, or if the goal was to replace an outdated firewall with a more advanced one for better traffic inspection.

This option would be correct if the question focused on securing web traffic for remote users, such as 'A company wants to enforce acceptable use policies and block malicious websites for remote employees. Which solution best achieves this?' In that context, an SWG with proxy is appropriate.

This option would be correct in a scenario where the goal is to improve authentication security for an existing VPN without changing the network access model, such as reducing credential theft risks while maintaining full LAN access for legacy applications.

Why candidates pick the wrong answer

Candidates may think that a next-generation firewall with strict rules is sufficient to enforce zero trust, but they overlook that zero trust requires granular, per-session access to specific applications rather than network-layer access.

Candidates may confuse a secure web gateway with a zero trust solution because both involve granular control and identity verification, but an SWG is limited to web traffic and does not cover all remote access scenarios required for zero trust.

Candidates may think that adding MFA and split tunneling enhances security enough to align with zero trust, but they overlook that zero trust requires per-request micro-segmentation and application-specific access, not just stronger authentication at the network perimeter.

Full explanation →

363

MCQmedium

A security architect is designing a defense strategy for a database containing sensitive customer records. The architect implements a network firewall to restrict inbound traffic to only the application server, enforces file-level encryption for the database files, requires multi-factor authentication for all administrative access, and deploys a database activity monitoring system to alert on unusual queries. Which security principle is the architect primarily applying?

A.Least privilege

B.Defense in depth

C.Separation of duties

D.Fail safe

AnswerB

Defense in depth is a security architecture principle that deliberately deploys multiple, independent layers of controls—such as firewalls, intrusion detection systems, full-disk encryption, and multi-factor authentication—so that a failure or bypass of any single layer does not leave the system exposed. The architect's strategy of combining preventive, detective, and corrective technical controls across different points in the attack surface is the exact embodiment of this layered-defense model, where residual risk from one control is mitigated by another.

Why this answer

The architect is applying defense in depth by layering multiple independent security controls: a network firewall, file-level encryption, multi-factor authentication, and database activity monitoring. This strategy ensures that if one control fails, others still provide protection, which is the core principle of defense in depth. Each layer addresses a different attack vector, making it significantly harder for an attacker to compromise the database.

Exam trap

The trap here is that candidates often confuse defense in depth with least privilege because both involve multiple controls, but defense in depth is about layering different types of controls, not just restricting permissions.

Why the other options are wrong

The question describes multiple overlapping controls (firewall, encryption, MFA, monitoring) that together provide layered security, which is the essence of defense in depth, not least privilege. Least privilege would focus on restricting permissions to the minimum necessary, which is not the primary theme here.

The scenario describes multiple overlapping security controls (firewall, encryption, MFA, monitoring), which is the essence of defense in depth, not separation of duties. Separation of duties would require dividing critical tasks among different individuals to prevent fraud or error, which is not mentioned.

The architect's strategy involves multiple overlapping controls (firewall, encryption, MFA, monitoring), which is the essence of defense in depth, not fail safe. Fail safe ensures that when a control fails, the system defaults to a secure state, which is not described here.

When would these options actually be correct?

A scenario where a security architect restricts database user permissions to only the specific tables and queries needed for their job role, and implements role-based access control to ensure no user has more access than required. The question would emphasize minimizing access rights rather than layering controls.

A question where an organization splits database administration and security auditing roles between two different teams, or requires two people to approve changes to sensitive data, would make separation of duties the correct answer.

A scenario where a security control is designed to default to a secure state upon failure, such as a door lock that remains locked during a power outage, or a firewall that blocks all traffic if it crashes, would make fail safe the correct answer.

Why candidates pick the wrong answer

Candidates may confuse the concept of least privilege with the idea of restricting inbound traffic to only the application server, which is a form of access restriction, but the question's broader focus on multiple layers makes defense in depth the correct answer.

Candidates may confuse 'separation of duties' with 'layered security' because both involve multiple controls, but separation of duties specifically addresses dividing responsibilities among people, not technical layers.

Candidates may confuse 'fail safe' with 'defense in depth' because both involve security measures, but fail safe specifically addresses system behavior during failures, not layered defenses.

Full explanation →

364

Multi-Selecthard

A customer portal must stay online if an entire site fails, and the company must also be able to recover if data is corrupted or encrypted by ransomware. Which two design choices best satisfy both requirements? Select two.

Select 2 answers

A.Use active-active or automatic failover between two sites with health checks.

B.Keep only RAID 1 inside each server, because mirroring alone handles site outages.

C.Maintain immutable offsite backups and test restores on a regular schedule.

D.Store nightly backups on the same storage array as the production data.

E.Replace the load balancer with a static DNS record for each server.

AnswersA, C

A second site with automatic failover or active-active traffic handling preserves availability when one location goes offline. Health checks let the load balancer or orchestration layer stop sending traffic to a failed site quickly. This directly addresses the requirement to keep the portal online during a total site outage.

Why this answer

Active-active or automatic failover between two sites with health checks ensures that if an entire site fails, traffic is automatically redirected to the surviving site, maintaining availability. This design satisfies the first requirement of staying online during a site failure by using redundant infrastructure and health monitoring to detect and react to outages.

Exam trap

The trap here is that candidates often assume RAID or local backups provide sufficient protection against site outages and ransomware, but RAID only handles disk failure and same-site backups are vulnerable to the same ransomware attack, so both requirements demand geographically separate, immutable backups and multi-site failover.

Full explanation →

365

Multi-Selectmedium

Which four of the following are common indicators of a phishing attack? (Choose four.)

Select 4 answers

.Urgent or threatening language demanding immediate action

.Spoofed sender email address that mimics a legitimate domain

.Unsolicited attachment or link that prompts credential entry

.Presence of a digital signature from a trusted certificate authority

.Grammatical errors and poor formatting in the message body

.A request for sensitive information via a secure web portal

Why this answer

These four options are correct because they represent classic hallmarks of phishing attacks. Urgent or threatening language is a social engineering tactic to bypass rational thought. Spoofed sender addresses exploit trust in familiar domains.

Unsolicited attachments or links are the primary delivery mechanism for phishing payloads. Grammatical errors and poor formatting often indicate a lack of professional quality control typical of legitimate organizations.

Exam trap

The SY0-701 exam often tests the misconception that technical security features like digital signatures or HTTPS encryption automatically indicate legitimacy, when in fact attackers can obtain valid certificates or bypass signature verification through social engineering.

Full explanation →

366

MCQmedium

A security analyst in the SOC observes a sudden spike in failed authentication attempts from a single external IP address targeting multiple user accounts over the last 30 minutes. After confirming the logs are accurate, which of the following actions should the analyst take FIRST according to standard incident response procedures?

A.Block the IP address at the firewall immediately.

B.Disable all user accounts that were targeted.

C.Escalate the incident to the incident response team.

D.Capture a memory dump of all affected servers.

AnswerC

Escalation is the first step after detection. The incident response team will follow the organization's plan to analyze, contain, eradicate, and recover from the incident. This ensures a coordinated and controlled response.

Why this answer

According to standard incident response procedures (NIST SP 800-61), the first step after confirming an anomaly is to escalate the incident to the incident response team. This ensures that a coordinated, documented, and legally defensible response is initiated, rather than taking unilateral action that could destroy evidence or disrupt legitimate services. The SOC analyst's role is to detect and validate, not to independently execute containment measures without authorization.

Exam trap

The trap here is that candidates often confuse 'immediate containment' with 'first action,' forgetting that escalation and validation must precede any technical countermeasure to ensure proper evidence preservation and coordinated response.

Why the other options are wrong

Blocking the IP immediately bypasses proper incident response procedures, which require initial analysis and escalation to ensure the action is justified and does not disrupt legitimate traffic or alert an attacker prematurely.

Disabling all targeted user accounts is premature and overly disruptive; the analyst must first confirm the incident and escalate to the incident response team to coordinate a proper response, as per standard procedures.

Capturing a memory dump is a forensic step typically performed after containment and escalation, not as a first response to an ongoing brute-force attack. The immediate priority is to stop the attack and involve the incident response team.

When would these options actually be correct?

A question where the scenario explicitly states that the IP is confirmed malicious (e.g., from a known threat feed) and the organization's policy allows automated blocking for such indicators, with the analyst instructed to take immediate containment action.

If the question stated that the failed authentication attempts were successful for several accounts, indicating a confirmed account compromise, then disabling those accounts immediately would be the correct first step to prevent further unauthorized access.

This would be correct if the question described a suspected malware infection or unauthorized access on a critical server, where preserving volatile evidence is crucial before any system changes or shutdowns.

Why candidates pick the wrong answer

Candidates may think blocking the IP is a quick, effective containment step, but they overlook the need for proper escalation and analysis to avoid false positives and follow established protocols.

Candidates may think that disabling accounts is a quick way to stop the attack, but they overlook the need for proper incident handling and the potential business impact of disabling accounts without verification.

Candidates may think forensic evidence collection is always the first step, confusing incident response order or overemphasizing evidence preservation over immediate containment.

Full explanation →

367

MCQmedium

A security analyst notices repeated attempts to copy large amounts of data to USB drives from a user's workstation. The analyst suspects the user may be exfiltrating company proprietary data. The company wants to implement a technical control that can both detect and block such data exfiltration without completely disabling all USB ports, as some users require USB for authorized work. Which of the following would best meet this requirement?

A.Implement a host-based intrusion detection system (HIDS) that alerts on USB insertion events.

B.Deploy a data loss prevention (DLP) agent configured with rules to monitor and block unauthorized data transfers to removable media.

C.Enable BitLocker encryption on all USB drives to prevent unauthorized data access.

D.Configure the local group policy to disable all USB ports on all workstations.

AnswerB

A DLP agent can inspect data in real time, apply policies to classify sensitive content, and block transfers that violate company rules. This meets the need to both detect and block exfiltration while still permitting authorized USB use.

Why this answer

A Data Loss Prevention (DLP) agent can be configured with granular rules to monitor and block unauthorized data transfers to removable media (e.g., USB drives) based on content inspection, file type, or volume thresholds. This allows authorized USB usage while preventing exfiltration of proprietary data, meeting the requirement for both detection and blocking without disabling all USB ports.

Exam trap

The trap here is that candidates often confuse detection-only controls (like HIDS alerts) with prevention controls, or they assume encryption (BitLocker) can stop data exfiltration, when in fact encryption only protects data at rest and does not prevent copying from the host.

Why the other options are wrong

A HIDS alerts on USB insertion but does not block data transfers; it only detects, not prevents, exfiltration.

BitLocker encryption protects data at rest by encrypting the USB drive, but it does not monitor or block the act of copying data to the drive. It cannot detect or prevent exfiltration because the user can still copy data to an encrypted drive.

Disabling all USB ports prevents all USB use, including authorized work, which contradicts the requirement to allow some users to use USB for legitimate purposes.

When would these options actually be correct?

If the requirement was only to detect and alert on USB usage events (e.g., for auditing or forensic purposes) without needing to block data transfers, a HIDS would be appropriate.

A question where the requirement is to protect sensitive data on USB drives from unauthorized access if the drive is lost or stolen, and the control is a preventive encryption measure, not detection or blocking of data transfers.

In a scenario where the organization has no need for USB devices and wants to completely eliminate the risk of USB-based data exfiltration or malware introduction, disabling all USB ports via group policy is a straightforward and effective technical control.

Why candidates pick the wrong answer

Candidates may confuse detection with prevention, or think that alerting on USB insertion is sufficient to stop exfiltration.

Candidates may confuse encryption with data loss prevention, thinking that encrypting the drive prevents unauthorized copying, but encryption only secures data after it is written, not the act of writing.

Candidates may think that disabling USB ports is the simplest way to stop data exfiltration, overlooking the need to allow authorized USB usage as specified in the question.

Full explanation →

368

MCQeasy

An auditor asks for evidence that the new workstation hardening baseline is actually applied across all finance laptops. Which evidence is the best to provide?

A.A copy of the hardening policy that says all laptops must be secured.

B.A manager’s email confirming that the baseline was announced to the team.

C.Screenshots from one finance laptop showing the baseline settings.

D.An automated compliance report from the configuration management tool showing baseline status across all devices.

AnswerD

An automated compliance report is the strongest evidence because it is repeatable, covers the full population, and shows whether the baseline is actually enforced. Auditors generally prefer objective evidence that can be validated across multiple systems rather than isolated screenshots or statements.

Why this answer

An automated compliance report from a configuration management tool (e.g., Microsoft Intune, SCCM, or Ansible) provides verifiable, centralized evidence that the hardening baseline is applied across all finance laptops. Unlike manual screenshots or policy documents, this report shows real-time or historical compliance status for every device, proving enforcement at scale.

Exam trap

The trap here is that candidates often choose Option C (screenshots) because it shows actual settings, but they overlook the requirement for evidence across all devices, not just one sample.

How to eliminate wrong answers

Option A is wrong because a copy of the hardening policy only states the requirement; it does not provide evidence that the baseline was actually applied to any device. Option B is wrong because a manager’s email confirming an announcement is hearsay and does not demonstrate technical enforcement or verification of settings. Option C is wrong because screenshots from a single laptop only prove compliance for that one device, not for the entire fleet of finance laptops, and can be easily staged or falsified.

Full explanation →

369

Multi-Selecteasy

A records clerk finds paper forms containing customer identifiers. The retention period has expired, and no legal hold applies. Which two actions are appropriate next? Select two.

Select 2 answers

A.Verify that the retention schedule has been satisfied and no hold exists

B.Destroy the forms using the organization's approved disposal method

C.Keep the forms in a personal desk drawer until someone asks for them

D.Take the papers home for safe keeping before shredding later

E.Refile the forms in an archive cabinet because they are old records

AnswersA, B

Before destroying any record, the clerk must confirm both the retention schedule's minimum period has elapsed and that no legal, regulatory, or internal hold is currently active. Checking for holds is critical because a pending audit, litigation, or investigation suspends the right to dispose of records, even if the retention date has passed. Premature destruction under a hold could result in spoliation sanctions and severe legal penalties. This verification step is the gatekeeper that makes the subsequent disposal legally defensible.

Why this answer

Before disposing of any records, the records clerk must confirm that the retention period has fully elapsed and that no legal hold (such as a litigation hold or regulatory hold) is active. This verification step ensures compliance with organizational data governance policies and avoids spoliation of evidence. Option B is correct because once verification is complete, the approved disposal method (e.g., cross-cut shredding, incineration, or secure shredding service) must be used to render the customer identifiers irrecoverable, aligning with data minimization and privacy requirements.

Exam trap

The trap here is that candidates may assume that simply because the retention period has expired, immediate destruction is always the correct next step, overlooking the critical verification step to ensure no legal hold is in place.

Full explanation →

370

MCQeasy

Guest tablets in a conference room use the same physical switches as employee devices. The security team wants guests to have internet access only, with no route to internal subnets. Which design best meets the goal?

A.Keep guests on the same VLAN and rely on a separate Wi-Fi password.

B.Place guests on a separate VLAN and block internal access with ACLs.

C.Use stronger WPA3 encryption on the wireless network and leave the network flat.

D.Enable MAC address filtering on the switch and allow all ports to remain in the default network.

AnswerB

A VLAN segregates guest devices into a separate Layer 3 subnet, breaking their ability to directly reach internal hosts by IP at Layer 2. The ACLs applied on the router or Layer 3 switch then explicitly deny the guest subnet from accessing internal subnets, while still permitting the guests to reach the internet and necessary services like DHCP and DNS. This creates a defense-in-depth boundary that controls traffic based on network segments, rather than relying on the wireless encryption or address filtering, making it the correct and industry-standard approach.

Why this answer

Placing guest tablets on a separate VLAN segments traffic at Layer 2, and applying ACLs on the Layer 3 interface (SVI or router) blocks all routes to internal subnets while permitting internet access. This design ensures that even though guests share the same physical switches, their traffic is isolated from employee VLANs and cannot reach internal resources.

Exam trap

The trap here is that candidates confuse authentication/encryption methods (password, WPA3, MAC filtering) with network segmentation, failing to recognize that only Layer 2 VLAN separation combined with Layer 3 ACLs can enforce routing restrictions between subnets.

How to eliminate wrong answers

Option A is wrong because relying on a separate Wi-Fi password does not provide network segmentation; devices on the same VLAN can still communicate at Layer 2, and a guest could potentially discover and access internal hosts. Option C is wrong because stronger WPA3 encryption protects wireless traffic from eavesdropping but does not prevent a guest device from routing to internal subnets if the network is flat (no VLAN segmentation). Option D is wrong because MAC address filtering only controls which devices can connect to the switch port, but it does not restrict traffic between VLANs or subnets; leaving all ports in the default network allows guests to reach internal resources directly.

Full explanation →

371

MCQmedium

A data center has repeated tailgating incidents at the entry to the server room. Management wants a control that forces one person to pass after badge authentication and prevents two people from entering together. What should be installed?

A.A mantrap between the outer door and the server room entrance

B.A CCTV camera focused on the doorway

C.A motion sensor inside the server room

D.A standard badge reader with no additional controls

AnswerA

A mantrap is a small interlocking vestibule with two doors; the outer door must close and lock before the inner door opens, allowing only one authenticated person to be inside at a time. It may also use weight sensors or volumetric detection to deny entry if more than one person is present. This physically enforces single-person entry, making tailgating impossible without forced entry.

Why this answer

A mantrap is a physical security control with two interlocking doors that enforces one-person entry. After badge authentication at the outer door, the inner door will not unlock until the outer door closes and locks, preventing two people from entering together. This directly addresses tailgating by creating a small vestibule that can only hold one authenticated person at a time.

Exam trap

The SY0-701 exam often tests the distinction between passive monitoring (CCTV) and active prevention (mantrap), leading candidates to mistakenly choose CCTV because they think recording alone will deter tailgating.

How to eliminate wrong answers

Option B is wrong because a CCTV camera only provides passive monitoring and does not physically prevent two people from entering together; it records incidents but does not enforce access control. Option C is wrong because a motion sensor inside the server room detects movement after entry but cannot stop tailgating at the door; it might even trigger false alarms from authorized occupants. Option D is wrong because a standard badge reader with no additional controls allows anyone to follow an authenticated user through the door without any physical barrier or detection mechanism to prevent tailgating.

Full explanation →

372

Matchingeasy

Match each cryptographic action to the most appropriate use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Protect the data if the laptop is stolen.

Check that the file was not changed during download.

Make identical passwords produce different hash values.

Confirm the file came from the expected sender and stayed intact.

Replace an encryption key on a planned schedule.

Why these pairings

Encryption ensures confidentiality, hashing ensures integrity, digital signatures provide authentication and non-repudiation, key exchange enables secure key distribution, certificate signing establishes trust, and random numbers are essential for key generation.

Full explanation →

373

MCQeasy

A SOC analyst wants to make sure logs from multiple servers can be compared accurately during an incident review. What should be configured on those systems?

A.A local administrator account with the same password on every server

B.Time synchronization using the same trusted time source

C.A larger disk size on the log server

D.A separate VLAN for each application server

AnswerB

Time synchronization via a common trusted time source (such as an internal NTP server or a public stratum-1 source) ensures all servers generate logs with consistent timestamps. Without this alignment, event sequences from different systems appear skewed by the clock offset, making it impossible to reconstruct a true attack timeline. NTP (Network Time Protocol) with authentication (e.g., NTPv4 with symmetric keys or MS-SNTP) prevents an attacker from spoofing time updates, which is critical for forensic accuracy and log integrity.

Why this answer

Time synchronization using a trusted time source (e.g., NTP) ensures that all servers share the same clock. During incident review, accurate log correlation depends on timestamps being consistent across systems; even a few seconds of drift can misalign event sequences. Without synchronized time, comparing logs from multiple servers becomes unreliable, potentially obscuring the true timeline of an attack.

Exam trap

The trap here is that candidates may confuse administrative convenience (same password) or storage capacity with the fundamental need for temporal consistency, overlooking that log correlation depends on synchronized clocks, not identical credentials or disk space.

How to eliminate wrong answers

Option A is wrong because using a local administrator account with the same password on every server violates the principle of least privilege and creates a massive security risk—if one server is compromised, all servers are exposed. It does nothing to ensure log timestamps are consistent. Option C is wrong because increasing disk size on the log server only addresses storage capacity, not the accuracy of timestamp comparisons across servers; logs can still have misaligned times even if storage is abundant.

Full explanation →

374

MCQeasy

A web login form returns access after a tester enters `' OR '1'='1'--` into the username field. What type of attack is this?

A.Cross-site scripting

B.SQL injection

C.Session hijacking

D.Insecure deserialization

AnswerB

SQL injection occurs when user input is concatenated into an SQL statement without proper parameterization, allowing the database to interpret part of that input as SQL syntax. In a login query like `SELECT * FROM users WHERE username = '$user' AND password = '$pass'`, entering `' OR 1=1 --` in the username field closes the string, injects an always-true condition, and comments out the password check. This makes the `WHERE` clause evaluate to true for at least one row, so the database returns a valid user record and the application grants authenticated access. Because the attacker directly altered the query's logic rather than executing browser code or reusing a token, this is a textbook SQL authentication bypass.

Why this answer

The input `' OR '1'='1'--` is a classic SQL injection payload that manipulates the SQL query logic. By injecting a single quote to break out of the string context, the `OR '1'='1'` condition makes the WHERE clause always true, and the `--` comments out the rest of the query. This bypasses authentication because the database returns a valid row, granting access without a correct password.

Exam trap

The trap here is that candidates may confuse SQL injection with cross-site scripting because both involve injecting malicious input, but SQL injection targets the database layer via SQL syntax, while XSS targets the browser via HTML/JavaScript.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into web pages viewed by other users, not manipulating database queries to bypass authentication. Option C is wrong because session hijacking involves stealing or predicting a valid session token (e.g., via packet sniffing or session fixation) to impersonate an authenticated user, not altering the login query logic.

Full explanation →

375

MCQmedium

An accounts payable clerk receives an email that continues a real vendor conversation from last week. The sender domain is only one character different from the vendor's real address. The message says the invoice is overdue and asks the clerk to update the payment account before the end of the day. What is the best next action?

A.Reply to the email asking for confirmation of the new bank details.

B.Verify the request using a known phone number or portal from previous records before taking action.

C.Forward the email to the vendor's entire contact list to warn them immediately.

D.Open the attached invoice to check whether the payment information matches past records.

AnswerB

Using a known out-of-band contact method confirms whether the request is legitimate without trusting the suspicious email path.

Why this answer

The email exhibits classic signs of a business email compromise (BEC) attack: a spoofed sender domain (typosquatting) and urgent payment redirection. The best next action is to verify the request out-of-band using a trusted phone number or portal from previous records, as this bypasses any compromised email channels and confirms the legitimacy of the request before any financial loss occurs.

Exam trap

The trap here is that candidates may think opening the attachment to check payment details is a safe verification step, but in reality, attachments in phishing emails are a common vector for malware delivery, and the correct action is always to verify through a trusted, independent channel.

How to eliminate wrong answers

Option A is wrong because replying to the email could reach the attacker if the sender domain is spoofed or the account is compromised, and asking for confirmation via email does not provide any security verification. Option C is wrong because forwarding the email to the vendor's entire contact list could spread phishing links or malware, and it may cause unnecessary panic or further compromise other recipients. Option D is wrong because opening the attached invoice could execute malware or lead to credential harvesting, and checking payment information against past records does not verify the authenticity of the sender or the request.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 301–375