Security+ SY0-701 SY0-701 Questions 376–450 | Page 6/14

376

Multi-Selecteasy

A business unit keeps a low-priority legacy tool but adds extra monitoring and patching. The company also buys cyber insurance to reduce the financial effect of a loss. Which two risk treatment strategies are being used? Select two.

Select 2 answers

A.Acceptance

B.Mitigation

C.Avoidance

D.Transfer

E.Deterrent

AnswersB, D

Mitigation reduces risk likelihood or impact through added controls, so extra monitoring and patching lower the legacy tool's exposure while the business unit retains it. This matches the stem's first treatment, distinct from the insurance-based transfer applied to financial loss.

Why this answer

Mitigation (B) is correct because the business unit keeps the legacy tool but reduces its risk exposure by adding extra monitoring and patching, which are compensating controls that lower the likelihood or impact of a loss. Transfer (D) is correct because purchasing cyber insurance shifts the financial consequences of a potential loss to the insurer, which is the defining characteristic of risk transfer. Acceptance (A) does not apply because the organization is actively applying controls rather than simply acknowledging and retaining the risk without action.

Avoidance (C) does not apply because the legacy tool is still kept in use rather than being eliminated or discontinued. Deterrent (E) is not a distinct risk treatment strategy here; monitoring and patching are preventive/detective controls supporting mitigation, not a separate deterrent strategy.

Exam trap

The trap here is that candidates may confuse risk acceptance (keeping the asset without additional controls) with risk mitigation (adding controls), or they may fail to recognize that cyber insurance is a transference strategy, not mitigation or acceptance.

Full explanation →

377

MCQmedium

A data center has repeated tailgating incidents at the entry to the server room. Management wants a control that forces one person to pass after badge authentication and prevents two people from entering together. What should be installed?

A.A mantrap between the outer door and the server room entrance

B.A CCTV camera focused on the doorway

C.A motion sensor inside the server room

D.A standard badge reader with no additional controls

AnswerA

A mantrap is a small interlocking vestibule with two doors; the outer door must close and lock before the inner door opens, allowing only one authenticated person to be inside at a time. It may also use weight sensors or volumetric detection to deny entry if more than one person is present. This physically enforces single-person entry, making tailgating impossible without forced entry.

Why this answer

A mantrap is a physical security control with two interlocking doors that enforces one-person entry. After badge authentication at the outer door, the inner door will not unlock until the outer door closes and locks, preventing two people from entering together. This directly addresses tailgating by creating a small vestibule that can only hold one authenticated person at a time.

Exam trap

The SY0-701 exam often tests the distinction between passive monitoring (CCTV) and active prevention (mantrap), leading candidates to mistakenly choose CCTV because they think recording alone will deter tailgating.

How to eliminate wrong answers

Option B is wrong because a CCTV camera only provides passive monitoring and does not physically prevent two people from entering together; it records incidents but does not enforce access control. Option C is wrong because a motion sensor inside the server room detects movement after entry but cannot stop tailgating at the door; it might even trigger false alarms from authorized occupants. Option D is wrong because a standard badge reader with no additional controls allows anyone to follow an authenticated user through the door without any physical barrier or detection mechanism to prevent tailgating.

Full explanation →

378

Matchingeasy

Match each cryptographic action to the most appropriate use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Protect the data if the laptop is stolen.

Check that the file was not changed during download.

Make identical passwords produce different hash values.

Confirm the file came from the expected sender and stayed intact.

Replace an encryption key on a planned schedule.

Why these pairings

Encryption ensures confidentiality, hashing ensures integrity, digital signatures provide authentication and non-repudiation, key exchange enables secure key distribution, certificate signing establishes trust, and random numbers are essential for key generation.

Full explanation →

379

MCQeasy

A SOC analyst wants to make sure logs from multiple servers can be compared accurately during an incident review. What should be configured on those systems?

A.A local administrator account with the same password on every server

B.Time synchronization using the same trusted time source

C.A larger disk size on the log server

D.A separate VLAN for each application server

AnswerB

Time synchronization via a common trusted time source (such as an internal NTP server or a public stratum-1 source) ensures all servers generate logs with consistent timestamps. Without this alignment, event sequences from different systems appear skewed by the clock offset, making it impossible to reconstruct a true attack timeline. NTP (Network Time Protocol) with authentication (e.g., NTPv4 with symmetric keys or MS-SNTP) prevents an attacker from spoofing time updates, which is critical for forensic accuracy and log integrity.

Why this answer

Time synchronization using a trusted time source (e.g., NTP) ensures that all servers share the same clock. During incident review, accurate log correlation depends on timestamps being consistent across systems; even a few seconds of drift can misalign event sequences. Without synchronized time, comparing logs from multiple servers becomes unreliable, potentially obscuring the true timeline of an attack.

Exam trap

The trap here is that candidates may confuse administrative convenience (same password) or storage capacity with the fundamental need for temporal consistency, overlooking that log correlation depends on synchronized clocks, not identical credentials or disk space.

How to eliminate wrong answers

Option A is wrong because using a local administrator account with the same password on every server violates the principle of least privilege and creates a massive security risk—if one server is compromised, all servers are exposed. It does nothing to ensure log timestamps are consistent. Option C is wrong because increasing disk size on the log server only addresses storage capacity, not the accuracy of timestamp comparisons across servers; logs can still have misaligned times even if storage is abundant.

Full explanation →

380

MCQeasy

A web login form returns access after a tester enters `' OR '1'='1'--` into the username field. What type of attack is this?

A.Cross-site scripting

B.SQL injection

C.Session hijacking

D.Insecure deserialization

AnswerB

SQL injection occurs when user input is concatenated into an SQL statement without proper parameterization, allowing the database to interpret part of that input as SQL syntax. In a login query like `SELECT * FROM users WHERE username = '$user' AND password = '$pass'`, entering `' OR 1=1 --` in the username field closes the string, injects an always-true condition, and comments out the password check. This makes the `WHERE` clause evaluate to true for at least one row, so the database returns a valid user record and the application grants authenticated access. Because the attacker directly altered the query's logic rather than executing browser code or reusing a token, this is a textbook SQL authentication bypass.

Why this answer

The input `' OR '1'='1'--` is a classic SQL injection payload that manipulates the SQL query logic. By injecting a single quote to break out of the string context, the `OR '1'='1'` condition makes the WHERE clause always true, and the `--` comments out the rest of the query. This bypasses authentication because the database returns a valid row, granting access without a correct password.

Exam trap

The trap here is that candidates may confuse SQL injection with cross-site scripting because both involve injecting malicious input, but SQL injection targets the database layer via SQL syntax, while XSS targets the browser via HTML/JavaScript.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into web pages viewed by other users, not manipulating database queries to bypass authentication. Option C is wrong because session hijacking involves stealing or predicting a valid session token (e.g., via packet sniffing or session fixation) to impersonate an authenticated user, not altering the login query logic.

Full explanation →

381

MCQmedium

An accounts payable clerk receives an email that continues a real vendor conversation from last week. The sender domain is only one character different from the vendor's real address. The message says the invoice is overdue and asks the clerk to update the payment account before the end of the day. What is the best next action?

A.Reply to the email asking for confirmation of the new bank details.

B.Verify the request using a known phone number or portal from previous records before taking action.

C.Forward the email to the vendor's entire contact list to warn them immediately.

D.Open the attached invoice to check whether the payment information matches past records.

AnswerB

The lookalike domain and urgency indicate a business email compromise attempt. Verifying the payment change through a known phone number or portal from previous records, rather than replying to the message, confirms legitimacy out of band before any action is taken.

Why this answer

The email exhibits classic signs of a business email compromise (BEC) attack: a spoofed sender domain (typosquatting) and urgent payment redirection. The best next action is to verify the request out-of-band using a trusted phone number or portal from previous records, as this bypasses any compromised email channels and confirms the legitimacy of the request before any financial loss occurs.

Exam trap

The trap here is that candidates may think opening the attachment to check payment details is a safe verification step, but in reality, attachments in phishing emails are a common vector for malware delivery, and the correct action is always to verify through a trusted, independent channel.

How to eliminate wrong answers

Option A is wrong because replying to the email could reach the attacker if the sender domain is spoofed or the account is compromised, and asking for confirmation via email does not provide any security verification. Option C is wrong because forwarding the email to the vendor's entire contact list could spread phishing links or malware, and it may cause unnecessary panic or further compromise other recipients. Option D is wrong because opening the attached invoice could execute malware or lead to credential harvesting, and checking payment information against past records does not verify the authenticity of the sender or the request.

Full explanation →

382

Matchingeasy

Match each cryptographic primitive to its main purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Producing a fixed-length value used to detect changes.

Using the same secret key to encrypt and decrypt data.

Using a public key and private key pair for encryption or decryption.

Proving who signed something and showing it was not changed.

Creating, storing, rotating, and retiring cryptographic keys safely.

Why these pairings

Symmetric encryption is efficient for large data, asymmetric encryption enables key exchange and signatures, hash functions ensure integrity, MACs combine integrity and authenticity, digital signatures add non-repudiation, and KDFs strengthen passwords for key use.

Full explanation →

383

MCQmedium

An engineering team requests a 30-day exception to use an unsupported browser plug-in on two workstations so a customer deliverable can be finished. Security agrees the business need is legitimate, but wants to reduce exposure. What must be included before the exception is approved?

A.A verbal approval from the engineering manager and no additional documentation.

B.A documented exception with an end date, compensating controls, and approval by the risk owner.

C.A standing waiver that remains in place until the project finishes, with no review date.

D.A guideline reminding the team to avoid risky behavior when practical.

AnswerB

A proper exception should be documented, time-limited, and tied to risk ownership so the organization knows who accepted the exposure and when it must be reviewed again. Compensating controls help reduce the danger while the exception is active. This keeps the exception controlled rather than allowing an open-ended deviation from security requirements.

Why this answer

A documented exception with a defined end date, compensating controls, and risk-owner approval is the correct approach. Security exceptions should be controlled, reviewable, and temporary whenever possible. That structure shows the business need was acknowledged while ensuring someone has formally accepted the residual risk and the organization can reassess the exception before it becomes indefinite.

Why others are wrong: A verbal approval is not enough for auditability or accountability. A standing waiver without a review date can quietly become permanent and increase exposure. A guideline does not authorize deviation from policy or provide the controls required for an exception process. The question is about formal exception handling, not informal advice.

Full explanation →

384

MCQmedium

A security analyst detects real-time data exfiltration from a critical production database that supports customer transactions. The exfiltration appears to be occurring via a compromised application service account. Which containment strategy should the analyst implement FIRST to minimize damage while preserving forensic data?

A.Disconnect the database server from the network.

B.Shut down the database server.

C.Implement network segmentation to isolate the server.

D.Block the IP address of the suspected attacker.

AnswerA

Disconnecting the database server from the network is the immediate containment step because it severs the active data transfer channel at the network interface, halting further exfiltration while leaving the operating system, running processes, and volatile memory intact. This preservation is vital for forensic acquisition of memory-resident indicators, encryption keys, and live command-and-control sessions. It also avoids the risk of file corruption from a forced shutdown, allowing investigators to recover logs and database state cleanly.

Why this answer

Disconnecting the database server from the network (Option A) immediately stops the active data exfiltration by severing all network communication, including the compromised service account's outbound connections. This preserves the server's volatile memory, running processes, and disk state for forensic analysis, unlike a shutdown which would destroy critical evidence. It is the fastest containment action that minimizes data loss while maintaining the integrity of forensic artifacts.

Exam trap

The SY0-701 exam often tests the misconception that shutting down a server is the safest containment action, but the trap here is that shutdown destroys volatile forensic data (e.g., active network connections, memory-resident malware) that is critical for attribution and root cause analysis.

Why the other options are wrong

Shutting down the server destroys volatile forensic data (e.g., memory, active connections) and may cause data corruption or loss, violating the priority to preserve evidence while stopping exfiltration.

Blocking the IP address is ineffective because the attacker may use multiple IPs or proxies, and the compromised service account can still be used for further attacks from other sources. It does not stop the ongoing exfiltration via the legitimate database connection.

When would these options actually be correct?

If the question stated that the server is already isolated and the goal is to prevent further damage from a ransomware attack that encrypts data, shutting down could halt encryption and preserve encrypted files for recovery.

This would be correct in a scenario where the attack is from a single, static external IP and the goal is to quickly stop a brute-force login attempt on a web application, without affecting internal services or needing to preserve network connections for forensics.

Why candidates pick the wrong answer

Candidates may think shutting down is the fastest way to stop data loss, not realizing it destroys forensic evidence and risks data integrity.

Candidates may think blocking the attacker's IP is a quick and easy first step, similar to common security practices for external threats, without realizing that in this case the exfiltration uses a legitimate internal service account, making IP blocking irrelevant.

Full explanation →

385

MCQmedium

A company wants employees to sign in once to access several SaaS applications, but it also wants to require MFA only when users connect from unmanaged devices or outside the corporate network. Which architecture best supports this goal?

A.Create separate usernames and passwords for each SaaS application and disable browser-based token sharing.

B.Implement federated identity with single sign-on and conditional access policies tied to device posture and network location.

C.Use local accounts in each SaaS application and rotate passwords every 30 days.

D.Grant all employees the same access role to simplify authentication and reduce support tickets.

AnswerB

Federation lets the organization use one identity provider for multiple SaaS applications, which enables single sign-on. Conditional access then adds policy-based decisions such as requiring MFA for unmanaged devices or external access. This combination is both more secure and more user-friendly than separate credentials or blanket MFA for every sign-in.

Why this answer

Federated identity with single sign-on (SSO) allows users to authenticate once and access multiple SaaS applications, while conditional access policies evaluate device posture (e.g., compliance status, managed vs. unmanaged) and network location (e.g., corporate IP range vs. external) to enforce MFA only when risk conditions are met. This architecture leverages standards like SAML 2.0 or OpenID Connect for SSO and integrates with device management systems (e.g., MDM) to assess device health before granting access.

Exam trap

The trap here is that candidates often confuse 'federated identity' with simple password synchronization or think that SSO alone handles MFA, missing the critical role of conditional access policies that dynamically enforce MFA based on device and network context.

How to eliminate wrong answers

Option A is wrong because creating separate usernames and passwords for each SaaS application eliminates SSO, forcing users to sign in repeatedly, and disabling browser-based token sharing does not address MFA requirements based on device or network context. Option C is wrong because using local accounts in each SaaS application with 30-day password rotation increases administrative overhead, fails to provide SSO, and does not support conditional MFA enforcement tied to device posture or network location. Option D is wrong because granting all employees the same access role violates the principle of least privilege, does not enable SSO, and provides no mechanism to enforce MFA based on device or network conditions.

Full explanation →

386

MCQmedium

A SOC analyst sees many login attempts against one SaaS account from hundreds of IPs over 20 minutes. Most passwords are valid-looking, but only a few result in successful logons, and the successful attempts use a password pattern that was exposed in a public breach list. What is the best mitigation to reduce this attack?

A.Increase password length requirements only.

B.Implement breached-password screening plus MFA.

C.Disable account lockouts to avoid user inconvenience.

D.Allow unlimited retries so legitimate users are never blocked.

AnswerB

This attack is consistent with credential stuffing, where attackers reuse passwords taken from prior breaches across many accounts. Breached-password screening helps stop users from choosing known-compromised passwords, and MFA adds a second barrier if a password is guessed or reused. Together, these controls reduce the chance that stolen credentials will work at scale. The scenario's pattern of many IPs and a small number of successful logins is exactly the kind of activity these controls are meant to disrupt.

Why this answer

The attack uses passwords from a public breach list, so breached-password screening would block those known compromised passwords. Additionally, MFA would stop the attacker even if they use a valid breached password, as they lack the second factor. This combination directly addresses the two key weaknesses: reused breached passwords and the lack of additional authentication.

Exam trap

The trap here is that candidates often focus on preventing brute-force attempts (e.g., lockouts) rather than recognizing that the attack uses valid breached passwords, making password screening and MFA the correct defense.

How to eliminate wrong answers

Option A is wrong because increasing password length requirements does not prevent the use of passwords that are already exposed in a breach list; attackers can still use long but compromised passwords. Option C is wrong because disabling account lockouts would allow the attacker to continue brute-force attempts indefinitely without triggering any defense, increasing the risk of successful logons.

Full explanation →

387

MCQmedium

A server room uses raised flooring and sits below a chilled-water pipe. Facilities wants the earliest warning if water starts accumulating under the floor tiles. Which control should be added?

A.Add more motion detectors near the racks.

B.Use badge readers on the server room door.

C.Install smoke detectors only.

D.Install leak-detection sensors or a moisture detection cable tied to alerts.

AnswerD

Leak-detection sensors placed under the floor can detect water as soon as it appears, which is exactly what facilities wants here. Early warning lets staff respond before equipment is damaged or a larger outage occurs. For a room below a chilled-water pipe, environmental monitoring is more effective than access control or motion detection because the hazard is liquid intrusion rather than unauthorized entry.

Why this answer

Leak-detection sensors or moisture-detection cables are specifically designed to detect water accumulation under raised floors, providing the earliest possible warning. These sensors trigger alerts when moisture is present, allowing facilities to respond before water damages equipment or causes downtime. This directly addresses the risk of a chilled-water pipe leak in a server room environment.

Exam trap

The trap here is that candidates may confuse environmental monitoring controls (like leak detection) with physical security controls (like motion detectors or badge readers), or assume smoke detectors are sufficient for all hazard detection, when they are specific to fire only.

How to eliminate wrong answers

Option A is wrong because motion detectors detect movement (e.g., people or objects) and cannot sense water or moisture, so they provide no warning of a water leak. Option B is wrong because badge readers control physical access to the server room but do not detect environmental hazards like water accumulation. Option C is wrong because smoke detectors are designed to detect smoke or fire, not water; they would not activate until a fire occurs, missing the water leak entirely.

Full explanation →

388

Multi-Selectmedium

A security manager is designing a security program to align with business goals. Which three of the following are essential components of a security program that directly support governance and oversight? (Choose three.)

Select 3 answers

.Establishing a security steering committee with executive sponsorship

.Implementing a vulnerability scanning tool across all endpoints

.Developing and maintaining security policies, standards, and procedures

.Conducting periodic risk assessments to inform decision-making

.Deploying a next-generation firewall to segment the network

.Installing endpoint detection and response agents on all workstations

Why this answer

A security steering committee with executive sponsorship ensures that security initiatives have top-down support and alignment with business objectives, which is a core governance function. Developing and maintaining security policies, standards, and procedures provides the formal framework for enforcing security controls and ensuring compliance, directly supporting oversight. Conducting periodic risk assessments informs decision-making by identifying and prioritizing risks, which is essential for governance and resource allocation.

Exam trap

The trap here is confusing operational security tools (like vulnerability scanners and firewalls) with governance components, which are about oversight, policy, and strategic alignment rather than specific technical implementations.

Full explanation →

389

MCQmedium

A firewall analyst reviews logs and sees one external IP address sending connection attempts to TCP ports 22, 80, 139, 445, and 3389 on dozens of internal hosts every few seconds. No payloads are delivered and no sessions are established. What is the most likely activity?

A.Port scanning, because the source is systematically probing many ports and hosts for exposed services.

B.Reflection-based denial-of-service, because the attacker is using third-party systems to amplify traffic.

C.Man-in-the-middle, because the attacker is intercepting communications between internal hosts.

D.Protocol abuse, because the attacker is sending malformed traffic to crash services.

AnswerA

This is a classic port-scanning pattern. The source IP is sending a high volume of connection attempts (often SYN packets) to multiple destination ports across many internal hosts in a short window, without completing the TCP handshake. This behavior is consistent with automated reconnaissance tools like Nmap, which systematically probe for open services to identify attack surface before exploitation. The lack of established sessions and the breadth of targets make any other conclusion improbable.

Why this answer

The observed behavior—a single external IP sending connection attempts to multiple TCP ports (22, 80, 139, 445, 3389) across many internal hosts at regular intervals—is the hallmark of a port scan. The absence of payload delivery or session establishment confirms the attacker is only probing for open services, not attempting exploitation or data transfer. This matches the definition of a reconnaissance activity, specifically a horizontal port scan targeting common service ports.

Exam trap

The trap here is that candidates may confuse a port scan with a denial-of-service attack because of the high frequency of connection attempts, but the key distinction is that no sessions are established and no payloads are delivered, which rules out DoS and exploitation.

How to eliminate wrong answers

Option B is wrong because reflection-based denial-of-service (e.g., NTP amplification) relies on spoofed source IPs and large response payloads from third-party servers, not direct connection attempts from a single external IP with no sessions established. Option C is wrong because man-in-the-middle attacks require the attacker to position themselves between communicating hosts (e.g., via ARP spoofing or rogue access points), not to send unsolicited connection probes from an external address. Option D is wrong because protocol abuse involves sending malformed or non-compliant traffic to trigger crashes or vulnerabilities, whereas this traffic is standard TCP SYN packets with no payload, and no sessions are established to deliver malformed data.

Full explanation →

390

MCQmedium

After several employees clicked on a realistic phishing email, management wants a control that both improves user behavior and gives the security team a way to measure improvement over time. Which approach is best?

A.Send a company-wide reminder not to open suspicious emails

B.Run simulated phishing campaigns with immediate feedback and follow-up training

C.Block all external email messages at the gateway

D.Require employees to change passwords every week

AnswerB

Simulated phishing campaigns are effective because they deliver a realistic, safe exercise that directly addresses the human factor in phishing. When an employee clicks a simulated link, immediate feedback appears at the moment of the mistake, allowing them to see what they missed, and follow-up training reinforces the correct recognition and reporting behavior. Each campaign round provides quantitative metrics (click rates, report rates) that let security teams track improvement over time and identify high-risk individuals for targeted coaching, making the intervention measurable and adaptive rather than a one-time broadcast.

Why this answer

Simulated phishing campaigns with immediate feedback and follow-up training directly address user behavior by providing a safe, controlled environment where employees can learn to recognize phishing attempts. This approach also gives the security team measurable metrics (e.g., click rates over time) to track improvement, aligning with the goal of both behavioral change and quantifiable assessment.

Exam trap

CompTIA often tests the distinction between administrative controls (like policies or reminders) and technical controls that provide both behavioral change and measurable outcomes, leading candidates to choose a simple policy reminder (Option A) instead of a proactive, data-driven approach like simulated phishing.

How to eliminate wrong answers

Option A is wrong because a company-wide reminder is a one-time, passive communication that does not provide measurable data or actively change user behavior through practice and reinforcement. Option C is wrong because blocking all external email is an overly restrictive technical control that disrupts legitimate business communication and does not improve user awareness or provide a metric for behavioral improvement. Option D is wrong because requiring weekly password changes does not address phishing susceptibility, can lead to weaker password practices (e.g., predictable patterns), and provides no direct feedback or measurement of phishing awareness.

Full explanation →

391

Drag & Dropmedium

Drag and drop the steps to implement a backup strategy following the 3-2-1 rule into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The 3-2-1 rule ensures redundancy: three copies, two different media, one offsite. Testing is crucial to verify recoverability.

Full explanation →

392

MCQeasy

An employee gets a text message saying their mobile carrier will suspend service unless they tap a link and verify their account details. What type of attack is this?

A.Smishing, because the attacker is using SMS messages to trick the user

B.Vishing, because the attacker is using a voice call to pressure the user

C.Baiting, because the attacker is offering a free service upgrade

D.Tailgating, because the attacker is trying to enter a building behind someone else

AnswerA

Smishing is phishing delivered over SMS: the attacker impersonates the mobile carrier and uses a link to harvest credentials or account details. The SMS channel is the defining axis distinguishing it from email phishing, vishing over voice calls, or pretexting.

Why this answer

This is smishing because the attacker uses SMS (Short Message Service) as the delivery vector to send a fraudulent message that tricks the recipient into clicking a malicious link. Smishing is a form of social engineering that exploits the trust users place in text-based communications from known entities like mobile carriers, often leading to credential theft or malware installation.

Exam trap

The trap here is that candidates may confuse smishing with vishing because both involve phishing via telecommunications, but the key differentiator is the medium: SMS (text) versus voice call.

How to eliminate wrong answers

Option B is wrong because vishing (voice phishing) relies on voice calls, not SMS text messages, to deceive the victim. Option C is wrong because baiting involves offering something enticing (e.g., a free download or USB drive) to lure the victim into an action, not sending a threatening SMS about service suspension. Option D is wrong because tailgating is a physical security attack where an unauthorized person follows an authorized individual into a restricted area, which has no relation to SMS-based deception.

Full explanation →

393

MCQeasy

An HR spreadsheet contains employee names, Social Security numbers, and bank account numbers. Which label is most appropriate under a Public, Internal, Confidential, and Restricted scheme?

A.Public, because it is used by the HR department and not shared externally.

B.Internal, because only employees should see it.

C.Confidential, because the information should be kept private but not tightly controlled.

D.Restricted, because it contains highly sensitive personal and financial data.

AnswerD

This is correct because Social Security numbers and bank account numbers are highly sensitive identifiers and financial data. Restricted labels are used for information that needs the strongest handling controls, limited access, and careful sharing rules. If exposed, this data could cause identity theft, fraud, and regulatory issues, so the strictest label is appropriate.

Why this answer

A spreadsheet containing employee names, Social Security numbers, and bank account numbers includes personally identifiable information (PII) and financial account data, which are subject to strict regulatory controls (e.g., GDPR, GLBA, or state breach notification laws). Under a Public/Internal/Confidential/Restricted classification scheme, 'Restricted' is the most appropriate label because it indicates the highest level of sensitivity and requires access control mechanisms such as encryption at rest (e.g., AES-256), strict least-privilege permissions, and audit logging to prevent unauthorized disclosure or modification.

Exam trap

The trap here is that candidates confuse 'Confidential' with 'Restricted' because both imply privacy, but 'Restricted' is the correct label for data that requires the highest level of control, such as PII and financial account numbers, whereas 'Confidential' is often used for less sensitive internal data like salary ranges or performance reviews.

How to eliminate wrong answers

Option A is wrong because 'Public' classification means data can be freely shared with anyone, but this spreadsheet contains highly sensitive personal and financial data that must never be exposed externally. Option B is wrong because 'Internal' classification allows access to all employees, but not all employees should have access to Social Security numbers and bank account numbers; this violates the principle of least privilege and could lead to data breaches. Option C is wrong because 'Confidential' typically implies moderate sensitivity with some access controls, but the presence of Social Security numbers and bank account numbers demands the highest level of protection, including mandatory encryption and strict access logging, which aligns with 'Restricted' rather than 'Confidential'.

Full explanation →

394

MCQmedium

A software supplier used by your company is adding a new library to its product and says the change is "internal only." Your security team wants better visibility into future component risks before the next renewal. What requirement would BEST support supply chain due diligence?

A.Require the supplier to provide a marketing summary of its development process.

B.Require an updated software bill of materials and a notification process for material component changes.

C.Ask the supplier to promise that future vulnerabilities will never affect the product.

D.Approve the change if the new library is open source and widely used.

AnswerB

This is the best requirement because it improves transparency and ongoing risk awareness. An updated software bill of materials helps the organization understand what is inside the product, while a formal notification process ensures material changes are communicated before they create surprise exposure. Together, these controls support continuous supply chain due diligence rather than a one-time review at purchase time.

Why this answer

A Software Bill of Materials (SBOM) provides a detailed inventory of all components in a product, enabling the security team to assess risks from new libraries. Requiring an SBOM plus a notification process for material changes gives proactive visibility into component risks, directly supporting supply chain due diligence as recommended by frameworks like NIST SP 800-161.

Exam trap

The trap here is that candidates may think a marketing summary or a promise of no vulnerabilities is sufficient for due diligence, but CompTIA emphasizes that only a verifiable, technical artifact like an SBOM with change notifications provides the visibility required for ongoing risk management.

How to eliminate wrong answers

Option A is wrong because a marketing summary is a high-level, non-technical document that omits specific component details and version information needed for risk assessment. Option C is wrong because no supplier can guarantee zero future vulnerabilities; this is an unrealistic and unenforceable promise that bypasses due diligence. Option D is wrong because open-source and widely used libraries can still contain critical vulnerabilities (e.g., Log4j), and approval without vetting the specific version and its dependencies ignores supply chain risk.

Full explanation →

395

Multi-Selecteasy

A developer wants to reduce the risk of SQL injection in a new customer search form. Which two changes are the best mitigations? Select two.

Select 2 answers

A.Use parameterized queries or prepared statements for all database access.

B.Validate and constrain user input before it reaches the database layer.

C.Store the database password in the page source so the app can connect faster.

D.Disable TLS so the application can inspect requests more easily.

E.Allow the application to build SQL statements by concatenating raw user input.

AnswersA, B

Parameterized queries and prepared statements separate SQL logic from user-supplied data by defining a query template with placeholders and binding input as parameters. The database engine then treats the bound values as literal data, never as executable code, so even malicious input containing SQL keywords or operators cannot alter the intended query structure. This is the most effective defense against SQL injection because it eliminates the mechanism the attack relies on.

Why this answer

Parameterized queries and prepared statements separate SQL logic from user-supplied data, ensuring that input is treated as a literal value rather than executable code. This prevents attackers from injecting malicious SQL commands into the query string, as the database driver automatically escapes or binds parameters safely. This is the most effective defense against SQL injection attacks.

Exam trap

The trap here is that candidates may think input validation alone is sufficient, but the exam emphasizes that parameterized queries are the definitive mitigation, while validation is a secondary defense-in-depth layer.

Full explanation →

396

MCQmedium

A help desk technician receives an alert that an unmanaged laptop was plugged into a conference room network jack and was automatically placed into a restricted network segment until it passed a security check. Which control is responsible for that behavior?

A.Network access control (NAC).

B.Data loss prevention (DLP).

C.Intrusion prevention system (IPS).

D.Sandboxing gateway.

AnswerA

NAC (Network Access Control) is the security technology that evaluates a device's security posture before granting network access. It typically uses protocols like 802.1X for authentication and checks compliance criteria—such as patch level, antivirus status, or encryption—via an agent or client. If a device is found noncompliant, NAC can isolate it into a quarantine VLAN or redirect it to remediation servers, thereby directly controlling admission. This aligns exactly with the incident described, where an unmanaged device must be assessed and segregated.

Why this answer

Network Access Control (NAC) is the correct answer because it is specifically designed to enforce security policies on devices attempting to connect to a network. When an unmanaged laptop is plugged into a network jack, NAC evaluates the device's compliance (e.g., antivirus status, patch level) and, if it fails, automatically places it into a restricted segment (e.g., a quarantine VLAN) until it passes a security check. This behavior is a core function of NAC solutions like Cisco ISE or Aruba ClearPass, which use 802.1X or MAC authentication bypass to dynamically assign VLANs based on device posture.

Exam trap

The trap here is that candidates often confuse NAC with an IPS or firewall because both can block traffic, but NAC specifically controls access at the point of network entry (Layer 2) based on device identity and compliance, not by inspecting packet payloads.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) focuses on monitoring and preventing unauthorized transmission of sensitive data, not on controlling network access or quarantining devices. Option C is wrong because an Intrusion Prevention System (IPS) inspects network traffic for malicious patterns and blocks attacks, but it does not enforce pre-admission security checks or dynamically segment devices based on compliance. Option D is wrong because a sandboxing gateway detonates suspicious files in an isolated environment to analyze behavior, but it does not manage network access or quarantine endpoints at the switch port level.

Full explanation →

397

MCQmedium

A security manager is preparing a quarterly report for the board of directors on the effectiveness of the organization's security program. The manager has access to detailed technical data, including firewall log statistics, patch compliance percentages, and number of phishing simulation clicks. Which of the following would be the most appropriate way to present this information to the board?

A.Provide a list of all firewall rule changes made during the quarter.

B.Show a trend chart of the number of security incidents categorized by severity, along with average time to resolve.

C.Include raw logs of the top 10 most frequent alerts from the SIEM.

D.Describe the technical architecture of the intrusion prevention system.

AnswerB

This option provides a high-level, actionable summary that demonstrates the security program's effectiveness. Incident trends by severity and resolution time are key performance indicators that the board can use to assess risk reduction and operational maturity.

Why this answer

It presents security program effectiveness in a business-relevant format: trend charts of incidents by severity and resolution times directly address risk reduction and operational efficiency, which board members need for strategic oversight. Unlike raw technical data, this aggregated, visualized information enables non-technical stakeholders to assess whether the security program is improving over time.

Exam trap

The trap here is that candidates mistake operational granularity (firewall changes, raw logs) for meaningful board-level metrics, failing to recognize that executives need summarized, trend-based data that ties security activities to business outcomes like risk reduction and efficiency.

Why the other options are wrong

The board of directors needs high-level, summarized information to assess security program effectiveness, not granular operational details like firewall rule changes.

The board of directors needs high-level, summarized information to assess security program effectiveness, not detailed technical architecture. Describing the IPS architecture is too granular and does not convey performance or risk trends.

When would these options actually be correct?

A question asking for the best way to demonstrate compliance with change management procedures or to provide evidence of firewall policy enforcement during an audit would make this option correct.

A question asking for the best way to present technical details to a new IT security team member who needs to understand the system's design and capabilities would make this option correct.

Why candidates pick the wrong answer

Candidates may think that showing specific actions (rule changes) proves security activity, but they overlook the board's need for strategic, not operational, data.

Candidates may think that explaining the IPS architecture demonstrates technical depth and security posture, but they overlook the audience's need for strategic, not technical, information.

Full explanation →

398

Multi-Selecteasy

A help desk team is writing a procedure for resetting MFA after a user loses a phone. Which two details belong in the procedure rather than in the policy? Select two.

Select 2 answers

A.The exact step-by-step verification process the technician must follow

B.The specific screen clicks or tool used to reset the MFA device

C.A statement that all employees must use MFA to access company systems

D.A general goal of protecting accounts from unauthorized access

E.A broad rule that users should protect company credentials

AnswersA, B

The exact step-by-step verification process is the core of any standard operating procedure. For MFA resets, this includes verifying the user's identity via a secondary channel (e.g., manager approval, knowledge-based verification) and enumerating the sequence of admin console actions. This specificity ensures that any technician performs the reset identically, minimizing risk of unauthorized changes and creating an auditable trail.

Why this answer

A procedure must contain the exact step-by-step verification process the technician follows to confirm the user's identity before resetting MFA. This operational detail ensures consistency and security, whereas a policy would only state the high-level requirement (e.g., 'verify identity'). Without precise steps, technicians might skip critical checks, leading to unauthorized MFA resets.

Exam trap

The trap here is confusing policy (broad rules and goals) with procedure (specific, actionable steps), leading candidates to select high-level statements like 'all employees must use MFA' instead of the detailed verification and tool-specific steps that actually belong in a procedure.

Full explanation →

399

Multi-Selecthard

A records room has repeated tailgating after hours and occasional door propping during deliveries. Management wants one control that prevents follow-on entry and another that immediately alerts security if the door is forced open or left ajar. Which two controls best meet the need? Select two.

Select 2 answers

A.Install a mantrap at the room entrance.

B.Add a door position sensor tied to an alarm or SIEM alert.

C.Place a larger warning sign on the wall beside the door.

D.Mount a visible camera over the door only.

E.Replace the mechanical lock with the same type of lock and no monitoring.

AnswersA, B

A mantrap is an enclosed vestibule with two interlocking doors; only one door can open at a time, and the system verifies a single valid credential before unlocking the second door. This physically isolates each entrant, so a second person cannot slip through behind an authorized user, directly eliminating tailgating. It can also be configured with anti-passback logic to prevent badge sharing and repeated entry.

Why this answer

A mantrap (option A) prevents tailgating by requiring one door to close before the next can open, effectively stopping follow-on entry. A door position sensor (option B) detects when the door is forced open or left ajar and triggers an immediate alert to security via an alarm or SIEM integration, meeting the requirement for real-time notification.

Exam trap

The trap here is that candidates often choose a camera (option D) thinking it provides real-time alerting, but a standard visible camera without integrated analytics does not automatically alert on door status—it only records footage for later review.

Full explanation →

400

MCQmedium

A vulnerability scan identifies four issues across a small company. Which item should the operations team remediate first?

A.A critical flaw on a disconnected training laptop that is used only in the lab

B.A high-severity flaw on an internet-facing customer portal with public exploit code available

C.A medium-severity flaw on an internal print server that stores no sensitive data

D.A low-severity flaw on an archive server scheduled for retirement next month

AnswerB

This is the best choice because risk is driven by both likelihood and impact. An internet-facing system with public exploit code has a much higher chance of being attacked, and a customer portal can affect sensitive data and business operations. Even if another issue has a higher severity label, exposure and active exploitability make this item the most urgent business risk.

Why this answer

The internet-facing customer portal with a high-severity flaw and public exploit code presents the highest risk to the organization. The combination of high attack surface (exposed to the internet), high severity, and readily available exploit code means an attacker can easily compromise the system, leading to data breach, financial loss, or reputational damage. Remediation prioritization should follow risk-based principles, where likelihood and impact are both high.

Exam trap

The trap here is that candidates often focus solely on the severity score (critical vs. high) without considering the attack surface and exploitability, leading them to pick the critical flaw on the isolated laptop instead of the high-severity flaw on the internet-facing system.

How to eliminate wrong answers

Option A is wrong because a disconnected training laptop used only in a lab has no network connectivity, so the critical flaw cannot be exploited remotely; the risk is effectively zero until it is reconnected, making it a lower priority. Option C is wrong because a medium-severity flaw on an internal print server that stores no sensitive data has limited impact and a lower attack surface (internal only), so it does not warrant immediate remediation over an internet-facing high-severity issue. Option D is wrong because a low-severity flaw on an archive server scheduled for retirement next month poses minimal risk, and the server's impending decommissioning means the flaw will be eliminated soon without active remediation.

Full explanation →

401

MCQmedium

A security analyst is investigating a data integrity incident where an attacker exploited a vulnerability in a web application to alter customer account balance records in the database. The analyst identifies the exact records that were modified and restores those records from a verified read-only backup taken prior to the attack. Which security goal is the analyst primarily addressing by restoring the records from backup?

A.Confidentiality

B.Integrity

C.Availability

D.Non-repudiation

AnswerB

Integrity is the security goal that assures data remains accurate, complete, and unchanged from its legitimate state. In this scenario, the unauthorized modifications directly violate that requirement, because the database no longer reflects the original authorized values. Restoring from a known-good backup is a corrective control that re-establishes an untampered baseline, thereby remediating the integrity breach and returning the data to a trustworthy condition.

Why this answer

Restoring the altered customer account balance records from a verified read-only backup directly addresses the integrity security goal. Integrity ensures that data is accurate and has not been modified by unauthorized parties. By reverting the records to their pre-attack state, the analyst is correcting the unauthorized modifications, thereby restoring the trustworthiness of the data.

Exam trap

The trap here is that candidates may confuse restoring data from backup with ensuring availability, but the primary goal in this scenario is to correct unauthorized modifications, which is a core integrity function.

Why the other options are wrong

Restoring records from a backup directly addresses the alteration of data, which is an integrity issue, not confidentiality. Confidentiality concerns unauthorized disclosure, not unauthorized modification.

Restoring records from backup addresses data integrity by correcting unauthorized modifications, not availability, which concerns ensuring systems and data are accessible when needed.

Restoring records from backup addresses integrity by reverting unauthorized modifications, not non-repudiation, which concerns proving actions occurred (e.g., digital signatures).

When would these options actually be correct?

A security analyst discovers that an attacker exfiltrated sensitive customer data from a database. The analyst restores the database from a backup to ensure that any backdoors or unauthorized copies are removed, but the primary goal addressed is preventing further unauthorized access, i.e., confidentiality.

A question where a DDoS attack overwhelms a web server, making customer accounts inaccessible, and the analyst restores service from a backup to ensure uptime. The primary goal addressed would be availability.

Non-repudiation would be correct if the question asked about ensuring that a user cannot deny performing a transaction, such as by implementing digital signatures or audit logs that provide proof of origin and integrity.

Why candidates pick the wrong answer

Candidates may confuse data protection with data integrity, thinking that restoring from backup protects data from being seen, but the key is that the incident involved modification, not disclosure.

Candidates may confuse restoring from backup with ensuring system uptime, mistakenly thinking that any backup restoration primarily supports availability rather than correcting data corruption.

Candidates may confuse integrity (data correctness) with non-repudiation (accountability), thinking that restoring from backup provides proof of original data, but non-repudiation focuses on attribution of actions, not data restoration.

Full explanation →

402

MCQmedium

A small company is moving its public web app to a new network. The front-end server must be reachable from the internet, the application server should only accept traffic from the front end, and the database must never be reachable from the internet or user VLANs. Which design best meets these requirements with the least exposure?

A.Place all three servers in the same server VLAN and use host-based firewalls to separate them.

B.Place the web server in a DMZ, the application server in an internal subnet, and the database in a separate restricted subnet with firewall rules between each tier.

C.Place the database in the DMZ so the web and application servers can access it directly without extra firewall rules.

D.Place the web server on the user VLAN and use NAT to hide the database server from the internet.

AnswerB

This is the strongest design because each tier is isolated according to exposure. The web server is the only internet-facing system, the application tier only receives approved traffic from the web tier, and the database is protected behind internal filtering. That layout limits attack paths and supports least privilege between network zones.

Why this answer

It implements a classic three-tier architecture with network segmentation. The web server in the DMZ is isolated from internal networks but accessible from the internet, the application server in an internal subnet is protected by firewall rules that only allow traffic from the DMZ, and the database in a separate restricted subnet is further isolated with firewall rules that only permit traffic from the application server. This design minimizes exposure by enforcing least privilege and defense in depth, using network-layer segmentation rather than relying solely on host-based controls.

Exam trap

The trap here is that candidates may think host-based firewalls are sufficient for isolation (Option A) or that placing the database in the DMZ simplifies access (Option C), but the exam expects you to recognize that network segmentation with separate subnets and firewall rules is the most secure and least exposure approach for multi-tier applications.

How to eliminate wrong answers

Option A is wrong because placing all three servers in the same VLAN with host-based firewalls violates the principle of network segmentation; a single compromised host could pivot laterally to other servers within the same broadcast domain, and host-based firewalls are more easily misconfigured or bypassed than network-layer ACLs. Option C is wrong because placing the database in the DMZ directly exposes it to the internet, which contradicts the requirement that the database must never be reachable from the internet; this design also increases the attack surface by allowing the web and application servers to access the database without intermediate firewall enforcement.

Full explanation →

403

MCQeasy

A critical patch must be applied to a production server next week. What is the best way to reduce the risk of downtime if the patch causes a problem?

A.Apply the patch during business hours so users can report issues quickly

B.Create a rollback plan before installing the patch

C.Skip testing because critical patches are always safe

D.Disable logging during the patch to improve performance

AnswerB

A rollback plan is a documented series of steps to restore the server to its previous known-good state, including pre-verified backups of data and configuration files, snapshots, and validation checks. It establishes a safe exit strategy so that if the patch causes unforeseen failures—such as application incompatibility or data corruption—the team can rapidly revert, minimizing downtime and data loss. This is a foundational component of change management and is more important than the patch itself in preserving service reliability.

Why this answer

Creating a rollback plan before installing a patch ensures that if the patch causes unexpected issues, the system can be restored to its previous stable state quickly, minimizing downtime. A rollback plan typically includes steps to revert the patch, restore from a backup, or switch to a failover system, which is a fundamental change management practice in security operations.

Exam trap

The trap here is that candidates may assume applying a patch during business hours allows for quick user feedback, but this overlooks the higher risk of widespread disruption and the importance of a controlled maintenance window.

How to eliminate wrong answers

Option A is wrong because applying a patch during business hours increases the risk of disrupting users and operations; patches should be applied during maintenance windows to minimize impact. Option C is wrong because skipping testing is dangerous even for critical patches, as they can still introduce compatibility issues or break existing functionality; testing in a non-production environment is essential. Option D is wrong because disabling logging during a patch removes the ability to audit changes and troubleshoot problems, which could lead to undetected issues and longer downtime.

Full explanation →

404

Multi-Selectmedium

An online retailer is redesigning a network for a public web app. Customers must reach only the web tier from the internet. The web tier must reach the application tier, and the application tier must reach the database tier. Which two design changes best support this zoning model? Select two.

Select 2 answers

A.Place all three server tiers on the same flat VLAN and rely on host firewalls.

B.Put the internet-facing web tier in a DMZ with tightly filtered inbound rules.

C.Give the database server a public IP address so the web tier can connect faster.

D.Place the application and database tiers in separate internal zones with firewall allow-lists between them.

E.Use a single NAT device for all servers and disable interserver filtering.

AnswersB, D

Placing the web tier in a DMZ creates a controlled buffer zone between the public internet and trusted internal networks, with stateful firewalls enforcing tightly scoped forward rules that allow only HTTP/HTTPS inbound and specific outbound calls to the application tier. This minimizes attack surface while isolating the web servers from direct access to databases or internal hosts, so a breach at the edge does not automatically expose backend services. The DMZ sits on its own subnetwork, making it the only segment with a public presence.

Why this answer

Placing the internet-facing web tier in a DMZ (demilitarized zone) with tightly filtered inbound rules ensures that external users can only reach the web servers, while the DMZ network isolates them from internal tiers. This aligns with the principle of defense in depth, where the DMZ acts as a buffer zone, and inbound rules (e.g., allowing only TCP/443 for HTTPS) minimize the attack surface. The web tier can then initiate outbound connections to the application tier through a firewall with specific allow-lists, maintaining strict segmentation.

Exam trap

The trap here is that candidates often confuse a flat VLAN with host firewalls as sufficient segmentation, not realizing that host firewalls can be disabled or bypassed once an attacker gains local access, whereas network-layer segmentation (e.g., DMZ and separate internal zones) provides a more robust security boundary that is harder to circumvent.

Full explanation →

405

MCQeasy

A help desk team needs to update desktops in a call center without interrupting callers during peak hours. What is the best operational approach?

A.Deploy the updates immediately to all desktops at once

B.Schedule the updates during an approved maintenance window

C.Ask each user to install updates whenever they have time

D.Disable update notifications permanently

AnswerB

Scheduling updates during an approved maintenance window is correct because it aligns with ITIL-based change management, giving the help desk a defined, communicated time frame to apply patches, monitor for issues, and roll back if necessary. This approach minimizes user impact, ensures network and application resources are reserved for operations during business hours, and allows for staged deployment (e.g., pilot group first) to validate stability before broader release.

Why this answer

Scheduling updates during an approved maintenance window ensures that desktops are updated during a period of low activity, minimizing disruption to call center operations. This approach aligns with change management best practices, allowing for controlled deployment and rollback if issues arise, and avoids the performance degradation or reboots that could interrupt active calls.

Exam trap

The trap here is that candidates may choose immediate deployment (A) thinking it is the most efficient for security, overlooking the operational requirement to maintain service availability during peak hours.

How to eliminate wrong answers

Option A is wrong because deploying updates immediately to all desktops at once risks simultaneous reboots or performance slowdowns during peak hours, which would directly interrupt callers and violate availability requirements. Option C is wrong because asking each user to install updates whenever they have time lacks coordination and control; users may forget, delay, or apply updates inconsistently, leading to security gaps and unpredictable system behavior.

Full explanation →

406

MCQhard

Based on the exhibit, what is the best governance improvement? Data handling procedure: - Managers may approve external sharing exceptions verbally. - Staff record exceptions in email threads. - No retention period is defined for exception evidence. Audit note: multiple exceptions could not be traced to an approver.

A.Replace verbal and email exceptions with a documented approval workflow and retained exception records.

B.Allow each team to decide its own exception format to increase flexibility.

C.Remove exception handling entirely so no external sharing can ever occur.

D.Keep the procedure unchanged and rely on additional awareness training alone.

AnswerA

A documented approval workflow creates a verifiable audit trail for every exception, capturing who authorized it, why, and for how long. Retained records support regulatory inquiries, internal audits, and periodic reviews to ensure exceptions remain justified. This replaces fragile verbal or email agreements with enforceable accountability and reproducible evidence, making governance measurably stronger.

Why this answer

The current procedure lacks a documented approval workflow and retention policy, which directly caused the audit finding that exceptions could not be traced to an approver. Implementing a formal, auditable process ensures non-repudiation and compliance with data handling governance, addressing the root cause rather than relying on informal verbal or email-based approvals.

Exam trap

The trap here is that candidates may think training alone (Option D) can fix a procedural gap, but the SY0-701 exam emphasizes that governance improvements require enforceable controls, not just awareness, to ensure accountability and auditability.

How to eliminate wrong answers

Option B is wrong because allowing each team to decide its own exception format would increase inconsistency and make auditing even more difficult, violating the principle of standardized governance. Option C is wrong because removing exception handling entirely is an extreme, impractical measure that would disrupt legitimate business needs for external sharing, and it does not address the governance gap in a balanced way. Option D is wrong because additional awareness training alone cannot fix the lack of a documented, auditable workflow; without a formal process, staff will continue using informal methods that fail to provide traceability.

Full explanation →

407

Matchingeasy

Match each access principle to the best description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Give the user only the permissions needed to do the job.

Share only the information required for the assigned task.

Split important steps so one person cannot complete everything alone.

Verify each request instead of trusting a user just because they are internal.

Use multiple protective layers so one failure does not expose everything.

Why these pairings

Least privilege grants minimal permissions, separation of duties splits critical tasks, defense in depth uses multiple security layers, need-to-know restricts data access, RBAC assigns permissions by role, and accountability ensures traceability.

Full explanation →

408

MCQmedium

A branch office needs to send a confidential design document to headquarters over an untrusted network. Headquarters already has the public/private key pair available for document exchange. Which method is most appropriate to keep the file confidential during transit without first sharing a secret key?

A.Encrypt the file with headquarters' public key

B.Publish a hash of the file for comparison

C.Sign the file with the branch office private key only

D.Compress the file before sending it

AnswerA

Encrypting the file with headquarters' public key applies asymmetric encryption (e.g., RSA or ECC) where only the corresponding private key held exclusively by headquarters can decrypt the ciphertext. This directly achieves confidentiality in transit because an eavesdropper who intercepts the file cannot derive the plaintext without that private key. It does not by itself prove that the branch office sent it, but the scenario's requirement is confidentiality, so this is the correct action.

Why this answer

Encrypting the file with headquarters' public key ensures that only headquarters, possessing the corresponding private key, can decrypt and read the file. This method provides confidentiality over an untrusted network without requiring a pre-shared secret key, as the public key can be freely distributed.

Exam trap

The trap here is that candidates confuse digital signatures (which provide authentication and integrity) with encryption (which provides confidentiality), leading them to choose signing the file instead of encrypting it.

How to eliminate wrong answers

Option B is wrong because publishing a hash of the file allows integrity verification but does not provide confidentiality; the file itself remains readable in transit. Option C is wrong because signing with the branch office's private key provides authentication and non-repudiation, not confidentiality; the file is still sent in plaintext. Option D is wrong because compression reduces file size but does not provide any cryptographic protection; the compressed data can still be read by anyone intercepting it.

Full explanation →

409

Multi-Selectmedium

HR needs to share a copy of employee records with a benefits contractor for testing. The contractor only needs names and coverage selections, not Social Security numbers or bank details. Which two actions best satisfy data handling requirements? Select two.

Select 2 answers

A.Redact or mask unnecessary sensitive fields before sharing the file.

B.Send the full employee record set because the contractor is trusted.

C.Restrict access to the file to approved HR and project staff only.

D.Upload the file to a public collaboration site so the contractor can retrieve it easily.

E.Keep an unrestricted copy on multiple shared drives for convenience.

AnswersA, C

Redaction or masking is a foundational data-minimization control that replaces or removes sensitive fields such as SSNs, bank details, and medical information before any external sharing. This reduces the potential impact of unauthorized disclosure because even if the file is leaked, the exposed data is not sensitive. It also aligns with privacy regulations like GDPR and HIPAA, which require using the minimum necessary data for a given purpose.

Why this answer

Redacting or masking sensitive fields like Social Security numbers and bank details ensures that the contractor receives only the necessary data (names and coverage selections) while protecting personally identifiable information (PII). This aligns with the principle of data minimization and compliance with regulations such as GDPR or HIPAA, which require that only the minimum necessary data be shared for a specific purpose. Masking techniques, such as replacing SSNs with placeholders or applying irreversible hashing, prevent unauthorized exposure even if the file is intercepted.

Exam trap

The trap here is that candidates may assume trust (option B) or convenience (option D or E) justifies sharing full data, but the exam emphasizes that data handling requirements always mandate minimizing exposure and enforcing access controls regardless of trust level.

Full explanation →

410

Multi-Selectmedium

A business unit asks for a 30-day exception to use an unsupported browser plug-in on two engineering workstations while a replacement is tested. Which three conditions should be required before approval? Select three.

Select 3 answers

A.A documented business justification for why the plug-in is still needed.

B.A defined expiration date and review point before the exception can be extended.

C.A compensating control such as isolating the workstations from the general user network.

D.An open-ended waiver so the team can continue if testing slips.

E.Verbal approval only, with no written record.

AnswersA, B, C

It demonstrates that the exception is not merely for convenience but addresses a genuine operational need, tying the risk acceptance to a specific business outcome. Without this, the exception lacks context for risk owners to evaluate whether the temporary risk is worth taking, and it fails the requirement for risk acceptance to be an informed decision. This documentation also provides the basis for the review at expiration, showing whether the need still exists.

Why this answer

A documented business justification ensures that the exception is necessary and aligns with organizational risk appetite. Without a clear reason, the exception could be granted for convenience rather than critical need, undermining security governance. This justification also provides an audit trail for why an unsupported, potentially vulnerable plug-in is still in use.

Exam trap

The trap here is that candidates might think only one or two conditions are sufficient, but CompTIA expects all three—justification, expiration, and compensating controls—to be required for a valid exception approval.

Full explanation →

411

MCQeasy

A Linux server starts showing many failed SSH logins from one source IP address. Which log source should the analyst review first?

A.The system authentication log

B.The printer spooler log

C.The browser history log

D.The backup completion log

AnswerA

This is the best choice because authentication logs record login attempts, failures, and success events. For SSH activity, the auth log or equivalent security log is the most direct place to confirm whether the attempts are real, what accounts were targeted, and whether any successful logon followed the failures. It provides the most useful first evidence for triage.

Why this answer

The system authentication log (e.g., /var/log/auth.log or /var/log/secure) records all SSH login attempts, including failed ones, along with source IP addresses. This is the primary log source for investigating authentication failures on Linux systems, as it captures PAM (Pluggable Authentication Module) events and SSH daemon messages.

Exam trap

The trap here is that candidates might confuse system authentication logs with generic system logs (e.g., /var/log/messages) or assume that SSH failures would be recorded in a network-level log, but the exam specifically tests knowledge of Linux authentication logging mechanisms.

How to eliminate wrong answers

Option B is wrong because the printer spooler log (e.g., /var/log/cups/) tracks print jobs and printer errors, not network authentication events like SSH logins. Option C is wrong because browser history logs are client-side records of web browsing activity, unrelated to server-side SSH authentication attempts. Option D is wrong because the backup completion log (e.g., /var/log/backup.log) records backup job statuses, not real-time authentication failures from remote IP addresses.

Full explanation →

412

MCQhard

Based on the exhibit, what is the MOST likely activity taking place on the network? A user opened a spreadsheet shortly before unusual internal connection patterns began. The same account is now authenticating to many hosts in rapid succession.

A.A worm is flooding the network with broadcast traffic and exhausting bandwidth.

B.An attacker is performing lateral movement using stolen credentials and remote administration tools.

C.A malicious insider is exfiltrating data through a cloud sync application.

D.A misconfigured printer is repeatedly scanning the subnet for available services.

AnswerB

This pattern is classic lateral movement: an attacker who has already compromised a domain account (stolen credentials) uses those credentials to authenticate over SMB and WinRM to multiple internal hosts, request Kerberos tickets, and create remote services via PsExec. The sequence of short, authenticated logons from a single workstation to several other systems, combined with service creation, is a well-known technique for moving from one compromised host to others with administrative intent.

Why this answer

The exhibit shows a user opening a spreadsheet (likely a phishing vector) followed by rapid authentication attempts from the same account to many hosts. This pattern matches lateral movement using stolen credentials, where an attacker uses remote administration tools like PsExec, WinRM, or RDP to move across the network after initial compromise.

Exam trap

The trap here is confusing lateral movement with network scanning or data exfiltration; candidates often overlook that the same account authenticating to many hosts is a hallmark of credential-based lateral movement, not a misconfiguration or worm.

How to eliminate wrong answers

Option A is wrong because a worm flooding broadcast traffic would generate excessive broadcast packets (e.g., ARP or ICMP floods), not sequential authentication events to specific hosts. Option C is wrong because data exfiltration via cloud sync would show outbound traffic to cloud storage APIs, not internal authentication bursts. Option D is wrong because a misconfigured printer scanning the subnet would use protocols like SNMP or mDNS discovery, not repeated authentication attempts with the same user account.

Full explanation →

413

MCQeasy

Employees sign in once to the company portal and then can access email, the ticketing system, and the HR site without logging in again. What is this called?

A.Single sign-on

B.Port forwarding

C.Tokenization

D.Network address translation

AnswerA

SSO centralizes authentication: the user authenticates once to an identity provider (IdP), which then issues a signed token or assertion (e.g., via SAML 2.0 or OpenID Connect) that multiple service providers trust. Because the IdP establishes a persistent session, subsequent portal resources or integrated applications accept the established trust without prompting for credentials again. This is exactly the behavior described: one initial login grants access across the company's integrated services.

Why this answer

Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications or systems without re-entering credentials. In this scenario, the company portal acts as the identity provider (IdP), and after initial authentication, it issues a token (e.g., SAML assertion or Kerberos ticket) that is accepted by the email, ticketing, and HR systems as proof of identity. This eliminates the need for repeated logins across these services.

Exam trap

The trap here is that candidates confuse single sign-on with tokenization, because both involve 'tokens,' but tokenization is a data protection method for sensitive data, not an authentication mechanism for accessing multiple applications.

How to eliminate wrong answers

Option B is wrong because port forwarding is a network address translation (NAT) technique that redirects traffic from one IP address and port to another, typically used to expose internal services to the internet, not to manage authentication across multiple applications. Option C is wrong because tokenization replaces sensitive data (like credit card numbers) with a non-sensitive placeholder (token) for security, but it does not provide a mechanism for authenticating a user once and accessing multiple systems. Option D is wrong because network address translation (NAT) modifies IP address information in packet headers to map private addresses to public ones, and has no role in authentication or session management across applications.

Full explanation →

414

MCQmedium

Network engineers need to manage switches in a data center from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. Which approach is best?

A.Telnet to the switches over a router port-forward rule.

B.SSH directly to the switches from the internet using password-only authentication.

C.Use SNMPv2c with restricted source IP addresses.

D.Connect through a VPN to a bastion host, then use SSH to the switches.

AnswerD

This is the correct approach because it layers multiple security controls: the VPN establishes an encrypted tunnel and authenticates users before any traffic enters the data center network, effectively hiding the switch management interfaces from public visibility. The bastion host serves as a controlled jump point, ensuring that only authorized administrators can initiate SSH connections to the switches and providing a centralized point for logging, auditing, and additional authentication factors. Using SSH from the bastion to the switches guarantees encryption and integrity, and it allows key-based or multi-factor authentication, resulting in a robust, traceable, and secure management path.

Why this answer

It combines a VPN (which encrypts all traffic and provides strong authentication) with a bastion host (a hardened jump server) to avoid exposing switch management interfaces directly to the internet. SSH then provides encrypted, authenticated access to the switches from the bastion host, meeting all three requirements: encryption, strong authentication, and no direct internet exposure.

Exam trap

The trap here is that candidates often think SSH alone (Option B) is sufficient because it encrypts traffic, but they overlook the requirement to avoid exposing management ports directly to the internet, which is a critical security design principle tested in SY0-701.

How to eliminate wrong answers

Option A is wrong because Telnet transmits all data, including passwords, in cleartext (no encryption) and port-forwarding exposes the switch management port directly to the internet, violating the requirement to avoid direct exposure. Option B is wrong because SSH does provide encryption, but allowing direct SSH from the internet exposes the switch management port and password-only authentication is not considered strong authentication (lacks multi-factor or key-based methods). Option C is wrong because SNMPv2c uses community strings in cleartext (no encryption) and provides only weak authentication; restricting source IPs does not encrypt traffic or provide strong user authentication.

Full explanation →

415

Multi-Selecthard

An endpoint investigation shows winword.exe launching powershell.exe with -nop -w hidden -enc arguments. The same host also has a newly created WMI permanent event subscription, and no new executable has appeared in Downloads or Program Files. Which two findings are most consistent with a fileless compromise and persistence mechanism? Select two.

Select 2 answers

A.PowerShell was launched with encoded, hidden execution arguments from a document process.

B.A WMI permanent event subscription was created under the root\subscription namespace.

C.A new executable named updater.exe was copied into Program Files by an administrator.

D.The browser cache was cleared after a routine user sign-out.

E.A signed video driver updated successfully through Windows Update.

AnswersA, B

Encoded and hidden PowerShell launched from a document process is a strong fileless malware indicator. The attack uses built-in scripting rather than dropping a traditional executable, which helps evade file-based detections. In combination with a user-facing process like Word, this pattern commonly suggests initial execution through malicious content or macro abuse.

Why this answer

The use of winword.exe to launch powershell.exe with `-nop -w hidden -enc` arguments is a classic fileless execution technique. The encoded command runs entirely in memory without writing a payload to disk, and the launch from a document process (winword.exe) indicates a macro or exploit-based initial access, consistent with a fileless compromise.

Exam trap

The trap here is that candidates may think any persistence mechanism (like a new executable in Program Files) is fileless, but fileless specifically means no executable written to disk, and WMI subscriptions are a common fileless persistence vector.

Full explanation →

416

MCQmedium

Based on the exhibit, what is the best governance action before the sales team uses the legacy portal without MFA?

A.Update the policy immediately to allow password-only access for all legacy systems.

B.Create a formal time-bound exception with compensating controls, approval, and an expiration date.

C.Have the help desk approve the request informally in the ticket and proceed without further documentation.

D.Ignore the MFA requirement because the portal is owned by a trusted partner.

AnswerB

A formal exception preserves the existing policy while allowing a documented, limited deviation for business need. It should include a risk owner approval, compensating controls such as stricter monitoring or network restrictions, and a review or expiration date so the exception does not become permanent.

Why this answer

Governance requires that any exception to a security policy (such as bypassing MFA) must be formally documented, approved by management, time-bound, and include compensating controls to mitigate risk. In this scenario, the legacy portal lacks MFA support, so a formal exception with an expiration date ensures the risk is tracked and re-evaluated, rather than permanently weakening security posture.

Exam trap

CompTIA often tests the distinction between an informal workaround and a formal governance process, trapping candidates who think a quick approval or policy change is sufficient without understanding the need for documented risk acceptance and compensating controls.

How to eliminate wrong answers

Option A is wrong because immediately updating the policy to allow password-only access for all legacy systems would permanently weaken the security baseline and violate the principle of least privilege, rather than addressing the specific legacy portal issue with a controlled exception. Option C is wrong because informal help desk approval without documentation bypasses audit trails and accountability, failing to meet governance requirements for risk acceptance and compliance. Option D is wrong because ignoring the MFA requirement simply because the portal is owned by a trusted partner disregards the principle of defense in depth and assumes trust without verification, which is a common security failure.

Full explanation →

417

Multi-Selectmedium

After a merger, dozens of laptops arrive with inconsistent settings and a history of unsupported utilities installed by the previous owner. The security team wants to establish a known-good configuration, reduce future drift, and accelerate remediation of newly discovered vulnerabilities. Which three actions best support that goal? Select three.

Select 3 answers

A.Build and deploy a secure baseline or gold image for the laptops.

B.Use centralized patch management with staged rollouts and reporting.

C.Enforce configuration management that reapplies approved settings after drift is detected.

D.Allow each user to customize local security settings for productivity.

E.Skip validation after patching because the baseline will always remain correct.

AnswersA, B, C

A secure baseline establishes the approved configuration for the fleet and gives the team a repeatable starting point. A gold image reduces configuration variation from device to device and makes it easier to verify what should be present. It is the most direct way to normalize inherited systems after a merger or acquisition.

Why this answer

A is correct because building and deploying a secure baseline or gold image ensures all laptops start from a known-good configuration, eliminating inconsistencies and unsupported utilities from the previous owner. This directly supports the goal of establishing a trusted state and provides a reference point for detecting future drift.

Exam trap

The trap here is that candidates may think user customization (Option D) is acceptable for productivity, but the scenario explicitly requires a known-good configuration and reduced drift, making any uncontrolled customization counterproductive.

Full explanation →

418

MCQeasy

After a user installs a free PDF converter from an unofficial website, the laptop starts making periodic outbound connections to an unknown server, the browser homepage changes, and a new program launches at logon. What is the most likely malware type?

A.Worm

B.Trojan

C.Rootkit

D.Ransomware

AnswerB

This is the best answer because the malicious software was disguised as a useful free tool. The symptoms include persistence, browser changes, and communication with an unknown server, which are common signs of a trojan payload. Trojans often arrive through deceptive downloads and then install additional harmful behavior after execution.

Why this answer

The user downloaded and installed a program that appears legitimate (a PDF converter) but performs malicious actions: making outbound connections, changing browser settings, and adding a startup program. This is the classic behavior of a Trojan horse, which disguises itself as useful software to trick users into installing it, then executes hidden malicious functions. Unlike worms, Trojans do not self-replicate, and unlike ransomware or rootkits, the described symptoms focus on unauthorized remote access and persistence rather than file encryption or deep OS concealment.

Exam trap

The trap here is that candidates may confuse the self-replicating behavior of a worm with the user-initiated installation of a Trojan, or mistake the visible symptoms (browser change, startup entry) for a rootkit's stealth, when in fact Trojans often exhibit overt persistence mechanisms to maintain access.

How to eliminate wrong answers

Option A is wrong because a worm self-replicates and spreads across networks without user interaction, whereas this infection required the user to manually install a program. Option C is wrong because a rootkit is designed to hide its presence and maintain privileged access by subverting OS-level detection mechanisms, not to change browser homepages or add visible startup entries. Option D is wrong because ransomware typically encrypts files and demands payment, displaying a ransom note, whereas the described symptoms involve outbound connections and browser changes without file encryption or extortion.

Full explanation →

419

MCQmedium

EDR alerts on a remote laptop show a suspicious process attempting to dump browser credentials and then contacting a rare domain. The user is in another time zone and still needs the laptop online for a presentation later today. What containment action is best?

A.Remotely isolate the device through the EDR console while keeping it powered on.

B.Ask the user to uninstall the EDR agent and reboot the laptop.

C.Wait until after the presentation and then begin containment.

D.Email the user asking them to close the browser and log out of their accounts.

AnswerA

EDR isolation is the best containment action because it stops most network communication while preserving the device state for investigation. Keeping the endpoint powered on maintains access to volatile evidence and avoids unnecessary disruption to disk contents or running processes. This is especially useful when the user is remote, because it can contain the threat quickly without requiring physical access or a full shutdown that would erase useful forensic data.

Why this answer

Remotely isolating the device through the EDR console is the best containment action because it immediately blocks all network communication to and from the laptop while keeping it powered on and running. This prevents the suspicious process from exfiltrating browser credentials or communicating with the rare command-and-control domain, yet allows the user to continue using local applications for the presentation later today. EDR isolation typically works by applying a host-based firewall rule that drops all traffic except to the EDR management server, ensuring the threat is contained without disrupting local productivity.

Exam trap

The trap here is that candidates may choose to wait until after the presentation (Option C) due to business continuity concerns, failing to recognize that immediate containment via network isolation can preserve both security and productivity.

How to eliminate wrong answers

Option B is wrong because asking the user to uninstall the EDR agent removes the very tool needed to monitor and contain the threat, leaving the laptop defenseless and potentially allowing the malicious process to continue unchecked. Option C is wrong because waiting until after the presentation gives the attacker time to exfiltrate sensitive credentials and establish persistence, violating the fundamental incident response principle of immediate containment. Option D is wrong because emailing the user to close the browser and log out does not stop the suspicious process from running in the background or prevent it from communicating with the rare domain, and the user may not act promptly or correctly.

Full explanation →

420

MCQmedium

A security analyst reviews a packet capture from a public Wi-Fi network and sees a workstation repeatedly sending gratuitous ARP replies that map the default gateway's IP address to the workstation's own MAC address. Shortly afterward, several clients on the same subnet begin sending their internet-bound traffic through that workstation. Which of the following is the MOST likely explanation for this activity?

A.A VLAN hopping attack using double-tagged 802.1Q frames

B.An on-path attack using ARP cache poisoning

C.A DHCP starvation attack exhausting the address pool

D.A DNS cache poisoning attack against the local resolver

AnswerB

The gratuitous ARP replies falsely bind the gateway's IP to the attacker's MAC, so victim ARP caches are overwritten and traffic is redirected through the attacker. This matches an on-path (man-in-the-middle) attack via ARP cache poisoning, which lets the attacker intercept, relay, or modify traffic. Because the scenario shows traffic flowing through the workstation after the spoofed replies, an on-path attack is the most likely explanation.

Why this answer

The spoofed gratuitous ARP replies overwrite clients' mappings of the gateway IP to the attacker's MAC, which redirects traffic through the attacker's workstation. That is the defining mechanism of an on-path attack via ARP cache poisoning. The subsequent flow of internet-bound traffic through the workstation confirms successful redirection rather than a naming, address-exhaustion, or VLAN-boundary issue.

Exam trap

The trap here is assuming that any traffic redirection on a LAN must involve DNS or routing changes, when ARP cache manipulation alone can silently place an attacker in the path.

Full explanation →

421

MCQmedium

A finance team receives emails that appear to come from the CEO's assistant and ask them to review a document. Several users entered their passwords on a fake login page, and the attackers then signed in from a new country using the same credentials. Which control most directly reduces successful account takeover if a password is stolen?

A.Require password changes every 30 days for all users.

B.Use phishing-resistant MFA such as FIDO2 or WebAuthn.

C.Turn off all external email to eliminate the chance of future messages.

D.Use single sign-on without MFA so users authenticate only once.

AnswerB

Phishing-resistant multifactor authentication is the strongest choice here because it prevents a stolen password from being enough to log in. The attacker already harvested credentials through a fake login page, so a second factor that cannot be easily replayed from another site directly disrupts the attack path. FIDO2 or WebAuthn reduces the value of captured passwords and helps stop account takeover even when users are deceived by convincing impersonation emails. This is a practical defense against credential phishing and replay.

Why this answer

Phishing-resistant MFA, such as FIDO2 or WebAuthn, directly prevents account takeover even when a password is stolen because these methods use public-key cryptography and origin-bound credentials. The fake login page cannot intercept the private key or replay the authentication, so the attacker cannot sign in from a new country despite having the password.

Exam trap

The trap here is that candidates often choose password rotation (Option A) as a security best practice, but the question specifically asks for the control that most directly reduces successful account takeover when a password is already stolen, which is phishing-resistant MFA, not password aging.

How to eliminate wrong answers

Option A is wrong because requiring password changes every 30 days does not prevent an attacker from using a stolen password immediately; it only reduces the window of exposure after the fact, and frequent changes can actually encourage weaker passwords. Option C is wrong because turning off all external email is an impractical and overly restrictive measure that does not address the core issue of credential theft; attackers could still use other vectors like internal phishing or compromised accounts. Option D is wrong because single sign-on without MFA consolidates authentication to a single point of failure; if the password is stolen, the attacker gains access to all linked systems without additional barriers.

Full explanation →

422

Multi-Selecthard

An accounts payable specialist receives an email inside an existing vendor thread that asks for a last-minute bank-account change before a payment run. The wording is professional, the signature matches, and the request is urgent. Which three actions should the specialist take? Select three.

Select 3 answers

A.Verify the request through a known out-of-band contact method for the vendor.

B.Pause the payment and require secondary approval before any bank details are updated.

C.Report the message through the security and vendor-validation process.

D.Reply in the same thread because the address and signature look legitimate.

E.Process the change immediately to avoid delaying the vendor relationship.

AnswersA, B, C

A compromised email thread is fully controlled by the attacker, so any reply or embedded link stays within an untrusted channel. Using a known out-of-band method—such as a phone number previously documented in the vendor master file, or a secure portal that was already established—creates a second, independent channel the attacker cannot intercept or modify. This directly defeats business email compromise (BEC) by verifying the authenticity of the bank detail change before any sensitive update is executed.

Why this answer

Verifying the request through a known out-of-band contact method (e.g., a phone call to a previously documented vendor number) directly mitigates the risk of business email compromise (BEC). Attackers often hijack or spoof legitimate email threads, so in-band verification (replying within the thread) is unreliable. This aligns with the principle of dual control and independent verification for sensitive financial changes.

Exam trap

The trap here is that candidates assume a professional-looking email with a matching signature is sufficient proof of authenticity, overlooking that BEC attacks can perfectly replicate these details within a compromised thread.

Full explanation →

423

MCQmedium

A backup server encrypts large nightly database exports before sending them to an offsite storage system. The organization has already arranged a secure way to share the secret key between the systems, and performance is a concern because the files are very large. Which encryption approach is the best fit?

A.Asymmetric encryption

B.Symmetric encryption

C.Hashing

D.Digital signatures

AnswerB

Symmetric encryption is the best fit for bulk data because it is fast and efficient. When both sides can securely share the same secret key, large backup files can be encrypted and decrypted with much less overhead than with public-key methods. That makes it the standard choice for protecting high-volume data at rest or in transit.

Why this answer

Symmetric encryption (e.g., AES-256) is the best fit because it uses a single shared secret key for both encryption and decryption, offering significantly higher throughput than asymmetric methods. For large files like nightly database exports, symmetric ciphers are hardware-accelerated (e.g., AES-NI) and introduce minimal performance overhead, while the secure key exchange is already handled separately.

Exam trap

The trap here is that candidates often choose asymmetric encryption because they associate it with 'secure key sharing,' forgetting that the scenario explicitly states the key exchange is already handled, so the focus should be on performance for large data volumes.

How to eliminate wrong answers

Option A is wrong because asymmetric encryption (e.g., RSA, ECC) is computationally expensive—typically 100–1000× slower than symmetric encryption—making it impractical for bulk encrypting large files; it is better suited for key exchange or small payloads. Option C is wrong because hashing is a one-way function (e.g., SHA-256) that produces a fixed-size digest and cannot be reversed to recover the original data, so it is used for integrity verification, not confidentiality.

Full explanation →

424

MCQmedium

Based on the exhibit, what is the most likely explanation for the alert?

A.The workstation has been redirected to an approved corporate proxy, so the event is expected.

B.A DNS cache poisoning attack is in progress and the workstation is now using a rogue gateway.

C.The endpoint is infected with malware that is hiding its traffic through encrypted tunnels.

D.The workstation is under a denial-of-service attack because it sent repeated DNS lookups.

AnswerA

The exhibit shows the workstation resolving WPAD, retrieving the proxy auto-configuration file, and then sending traffic to the approved proxy listed in inventory. Those steps match normal browser proxy discovery, not malicious behavior. Because the destination is the known corporate proxy, the alert should be validated as legitimate and then tuned if it repeatedly fires on the same approved sequence.

Why this answer

The alert indicates that the workstation's DNS traffic is being redirected to an internal proxy server (10.0.0.53), which is a common configuration in corporate environments for content filtering and security monitoring. Since the destination IP (10.0.0.53) is within the organization's private IP range and the proxy is explicitly approved, this behavior is expected and not malicious. The event is consistent with a transparent proxy or DNS-based proxy redirection, where the workstation's DNS queries are intercepted and forwarded to the corporate proxy.

Exam trap

The trap here is that candidates often assume any DNS redirection to an internal IP indicates a man-in-the-middle attack or DNS poisoning, but they overlook that corporate proxies legitimately use this technique for security monitoring and content filtering.

How to eliminate wrong answers

Option B is wrong because DNS cache poisoning would involve a rogue DNS server returning forged responses, not a consistent redirection to an internal proxy IP; the exhibit shows the workstation's DNS queries going to 10.0.0.53, which is a private IP, not a spoofed external address. Option C is wrong because malware using encrypted tunnels would typically show traffic to an external C2 server over protocols like HTTPS or DNS over HTTPS, not a consistent pattern of DNS queries to a known internal proxy IP. Option D is wrong because a denial-of-service attack would involve an overwhelming volume of traffic or resource exhaustion, not a single workstation sending DNS lookups to a proxy; repeated DNS lookups alone do not indicate a DoS attack.

Full explanation →

425

MCQmedium

A security analyst at a manufacturing company notices multiple workstations generating high volumes of encrypted outbound traffic and displaying ransom notes. The analyst suspects a ransomware outbreak. According to the incident response process, which of the following should the analyst perform FIRST?

A.Immediately wipe the hard drives of all affected workstations and reinstall the operating system.

B.Isolate the affected workstations from the network by disconnecting their network cables and disabling Wi-Fi.

C.Contact local law enforcement to report the ransomware incident and request a forensic investigation.

D.Conduct a full forensic analysis of one affected workstation to determine the ransomware variant and entry vector.

AnswerB

Disconnecting the network cables and disabling Wi-Fi on affected workstations is the correct immediate step because it performs a logical and physical air-gap, severing all paths for the ransomware to communicate with its command-and-control server or move laterally to other hosts. This containment action stops the active encryption of SMB shares, database servers, and other network devices, while also preserving dynamic evidence such as memory and running processes for later analysis, which would be destroyed if the system were powered off.

Why this answer

The first priority in a suspected ransomware outbreak is containment to prevent lateral spread and further encryption. Disconnecting network cables and disabling Wi-Fi immediately isolates the affected workstations from the network, stopping the ransomware from communicating with its command-and-control (C2) server or encrypting additional systems. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Exam trap

The trap here is that candidates often jump to eradication (wiping drives) or notification (calling law enforcement) first, forgetting that containment is the immediate priority to stop the outbreak from spreading across the network.

Why the other options are wrong

Wiping drives and reinstalling OS destroys volatile evidence and prevents forensic analysis to determine the ransomware variant and entry vector, which is critical for containment and eradication. The first step in incident response is containment, not eradication or recovery.

Contacting law enforcement is not the first step; immediate containment (isolation) is required to prevent further spread of the ransomware across the network.

In the incident response process, the first priority is containment to prevent further spread. Conducting a forensic analysis before containment allows the ransomware to continue encrypting other systems, violating the containment-first principle.

When would these options actually be correct?

This would be correct if the question stated that the organization has already completed containment, eradication, and evidence preservation, and now needs to restore operations quickly to minimize downtime. For example: 'After isolating and analyzing the ransomware, which step should be taken to restore affected workstations?'

This would be correct if the question asked: 'After containing the ransomware outbreak and preserving evidence, which step should the analyst perform next?'

This option would be correct if the question stated that the affected workstations have already been isolated and the incident response team is now in the identification or analysis phase, needing to determine the ransomware variant and entry vector to guide eradication and recovery.

Why candidates pick the wrong answer

Candidates may think immediate eradication stops the ransomware spread, but they overlook the need for containment first and the importance of preserving evidence for investigation and legal action.

Candidates may believe that involving law enforcement early is critical for legal and forensic reasons, but they overlook the priority of containment in incident response.

Candidates may think that understanding the ransomware variant is critical to stopping it, but they overlook that containment must occur first to prevent further damage.

Full explanation →

426

MCQeasy

HR needs to send a benefits contractor a file for testing, but the contractor only needs employee names and plan selections. What is the best action before sharing the file?

A.Send the full file because the contractor is trusted

B.Remove all fields the contractor does not need for the task

C.Post the file to a public collaboration site with a password

D.Rename the file so the contents are harder to identify

AnswerB

Removing fields that are irrelevant to the testing task enforces data minimization and least privilege: the contractor gets only the attributes necessary to validate the file format, calculations, or logic, with no residual PII. This directly reduces the impact of any potential breach and helps satisfy privacy regulations (e.g., HIPAA, GDPR, or state data protection laws) that mandate limiting collection and disclosure. In practice, you might also replace identifiers with synthetic values, but field removal is the minimal, targeted control.

Why this answer

Data minimization is a core security principle: you should only share the minimum necessary data for the task. By removing all fields the contractor does not need (e.g., Social Security numbers, addresses, salary data), you reduce the attack surface and limit exposure of sensitive personally identifiable information (PII) in case of a breach or misuse.

Exam trap

The trap here is that candidates confuse trust with security, assuming a trusted third party eliminates the need for data minimization, when in reality least privilege applies regardless of trust level.

How to eliminate wrong answers

Option A is wrong because trust does not eliminate risk; a trusted contractor could still have a compromised endpoint or accidentally expose the full file, violating the principle of least privilege. Option C is wrong because posting the file to a public collaboration site, even with a password, exposes it to cloud storage risks (e.g., misconfigured permissions, password sharing, or brute-force attacks) and violates data minimization. Option D is wrong because renaming the file does not remove sensitive data; it only obscures the filename, leaving all sensitive fields intact and accessible if the file is opened.

Full explanation →

427

MCQmedium

A development team needs to release a security fix to a customer portal, but the change must not introduce a new outage or bypass review controls. Which practice best supports a secure and repeatable release?

A.Apply the change directly in production so users get the fix immediately

B.Use an approved pipeline with peer review, automated testing, and rollback steps

C.Skip testing because security fixes should always be deployed quickly

D.Let any on-call developer approve and deploy without documentation

AnswerB

An approved pipeline that enforces peer review, automated testing, and rollback steps aligns with secure change and release management: the code is built once into an immutable artifact, tested automatically against unit, integration, and security regression suites, and deployed in a controlled manner with rollback procedures defined in advance. This reduces the probability of introducing new vulnerabilities while ensuring that, if an issue occurs, the team can rapidly restore service. It also provides a full audit trail for compliance and accountability.

Why this answer

An approved pipeline with peer review, automated testing, and rollback steps ensures that the security fix is deployed in a controlled, repeatable manner. This approach prevents unauthorized changes, validates the fix through testing, and provides a safety net via rollback, directly addressing the requirement to avoid new outages and bypass review controls.

Exam trap

The trap here is that candidates may confuse 'speed' with 'security' and choose direct production deployment (Option A) or skipping testing (Option C), failing to recognize that a controlled pipeline with rollback is the only way to meet both the security and reliability requirements simultaneously.

How to eliminate wrong answers

Option A is wrong because applying the change directly in production bypasses all review and testing controls, violating the requirement to avoid outages and maintain oversight. Option C is wrong because skipping testing for security fixes increases the risk of introducing new vulnerabilities or breaking functionality, contradicting the need for a secure and repeatable release. Option D is wrong because allowing any on-call developer to approve and deploy without documentation eliminates peer review and traceability, undermining change management and audit requirements.

Full explanation →

428

MCQmedium

A development team wants to allow users to search orders by customer name and date range. Logs show the team currently concatenates the filter values into SQL strings. Which change best reduces SQL injection risk without removing the search feature?

A.Escape apostrophes in the input before building the SQL statement.

B.Use parameterized queries or prepared statements for the search filters.

C.Disable database error messages so attackers cannot see query details.

D.Place the application behind a VPN so only internal users can run searches.

AnswerB

Parameterized queries separate code from data, so user input is treated as values rather than executable SQL. This allows the search function to remain flexible while dramatically reducing injection risk. Prepared statements are the preferred fix because they address the root cause instead of relying on brittle string handling.

Why this answer

Parameterized queries (also known as prepared statements) separate SQL logic from user data by sending the query structure and parameters independently to the database. This ensures that user-supplied filter values are always treated as data, never as executable SQL code, which completely prevents SQL injection even if the input contains malicious characters like apostrophes or SQL keywords.

Exam trap

The trap here is that candidates often choose input escaping (Option A) because it seems like a direct fix for the apostrophe problem, but they fail to recognize that parameterized queries are the only comprehensive defense that eliminates the entire class of SQL injection vulnerabilities regardless of input format.

How to eliminate wrong answers

Option A is wrong because escaping apostrophes alone does not protect against all SQL injection vectors, such as numeric fields, stacked queries, or time-based blind injection, and escaping can be bypassed if not done consistently or if the database uses a different escape character. Option C is wrong because disabling database error messages only hides error details from attackers; it does not prevent the injection itself, and an attacker can still exploit the vulnerability using blind SQL injection techniques. Option D is wrong because placing the application behind a VPN does not address the root cause of SQL injection; it only restricts network access, and the vulnerability remains exploitable by any authenticated user who can reach the application.

Full explanation →

429

MCQhard

A finance laptop is opened to review an invoice attachment. EDR then shows winword.exe launching powershell.exe with hidden, no-profile, and base64-encoded arguments. No executable is written to disk, network beacons begin from memory, and after a reboot the activity disappears unless the document is opened again. What type of malware behavior is most likely?

A.Worm behavior, because the infection would self-replicate across systems through the network.

B.Fileless attack, because malicious code runs in memory and leaves little or no executable artifact on disk.

C.Rootkit behavior, because the malware is hidden from normal user-mode tools.

D.Ransomware, because the user opened an invoice attachment before the suspicious activity started.

AnswerB

This is a classic fileless attack pattern. The process chain from a trusted Office app to hidden PowerShell, the encoded command line, the lack of a new binary on disk, and the disappearance after reboot all point to code executing primarily in memory. That makes detection harder and often means the initial document or script acts as the launcher rather than a traditional dropper.

Why this answer

The scenario describes malicious code that executes entirely in memory without writing an executable to disk, which is the defining characteristic of a fileless attack. Winword.exe launching PowerShell with hidden, no-profile, and base64-encoded arguments is a classic technique to load and execute payloads directly in memory, bypassing traditional file-based detection. The fact that activity disappears after reboot unless the document is reopened confirms that no persistent artifact remains on disk, further supporting fileless behavior.

Exam trap

The trap here is that candidates may confuse the initial infection vector (opening an invoice) with the malware type (ransomware), but the key behavioral indicator is the in-memory execution and lack of disk artifacts, which points to fileless malware, not ransomware.

How to eliminate wrong answers

Option A is wrong because worm behavior requires self-replication across systems via network propagation, and there is no evidence of lateral movement or self-copying in this scenario. Option C is wrong because rootkit behavior involves hiding processes, files, or registry keys from the operating system, typically by intercepting system calls, whereas this attack runs in user-mode memory without hiding its presence from EDR. Option D is wrong because ransomware would typically encrypt files and demand payment, but the description only shows beaconing and no file encryption or ransom note, so the invoice attachment is merely the initial vector, not the malware type.

Full explanation →

430

MCQmedium

Security receives a company-owned laptop connected to an insider theft investigation. Before the device is transported to the evidence locker, what is the BEST action to support chain of custody?

A.Factory reset the laptop so investigators can start from a clean system

B.Seal the device in an evidence bag and record each handoff with signatures

C.Remove the hard drive and image it without any documentation

D.Leave the laptop unlocked so the next analyst can inspect it quickly

AnswerB

Sealing the laptop in an evidence bag and logging every handoff with signatures creates an unbroken, documented custody record. This directly satisfies the chain-of-custody requirement by proving who held the device at each stage, preventing tampering claims from undermining the insider theft investigation.

Why this answer

Sealing the device in an evidence bag and recording each handoff with signatures establishes a documented, unbroken chain of custody. This ensures the integrity of the evidence by preventing tampering and providing a verifiable record of who handled the device and when, which is critical for admissibility in legal proceedings.

Exam trap

The trap here is that candidates may think a factory reset (Option A) helps investigators start clean, but it actually destroys evidence, while proper sealing and documentation (Option B) is the only method that preserves evidence integrity for legal proceedings.

How to eliminate wrong answers

Option A is wrong because factory resetting the laptop destroys all potential evidence, including files, logs, and metadata, making it impossible for investigators to recover data relevant to the theft. Option C is wrong because removing the hard drive and imaging it without documentation violates chain of custody principles, as there is no record of who performed the action or when, compromising evidence integrity. Option D is wrong because leaving the laptop unlocked risks unauthorized access, alteration, or deletion of evidence, breaking the chain of custody and potentially rendering the evidence inadmissible.

Full explanation →

431

MCQhard

A web portal for customer refunds checks device health at sign-in, then re-checks the device and user context before each refund over a threshold. A session that started on a managed laptop is blocked when the laptop later fails posture checks, even though the password remains valid. Which principle is best illustrated?

A.Defense in depth

B.Zero trust

C.Least privilege

D.Need-to-know

AnswerB

The portal does not trust the session simply because the user authenticated once. It repeatedly evaluates device posture and context before granting sensitive actions, and it can deny access when risk changes. That is the core of zero trust: verify explicitly, assume no persistent trust, and re-evaluate access continuously instead of relying on an initial login event.

Why this answer

The scenario describes a system that continuously verifies trust—checking device health at sign-in and re-evaluating both device and user context before each high-value action—and blocks access even when the password is valid. This is the core of Zero Trust: 'never trust, always verify,' where authentication and authorization are re-assessed at every transaction, not just at session start. The policy enforces access decisions based on real-time posture (e.g., device compliance, user behavior) rather than relying solely on a static credential.

Exam trap

The trap here is that candidates confuse 'Zero Trust' with 'defense in depth' because both involve multiple security layers, but Zero Trust specifically mandates continuous re-validation of trust for each access request, not just layered static controls.

How to eliminate wrong answers

Option A is wrong because defense in depth is a layered security strategy (e.g., firewall + antivirus + IDS) that does not specifically require continuous re-verification of device health within a single session; this scenario is about dynamic trust decisions, not multiple independent controls. Option C is wrong because least privilege limits user permissions to the minimum needed for their role (e.g., read-only access), but it does not address re-checking device posture or blocking a session mid-stream based on health changes. Option D is wrong because need-to-know restricts access to data based on a user's specific job requirement, not on device compliance or continuous authentication; it is about data classification, not session-level trust revocation.

Full explanation →

432

MCQmedium

A records manager learns that emails related to a harassment investigation are scheduled for deletion next week under the retention policy. Legal issues a hold because the case may go to court. What should the records manager do?

A.Delete the emails after creating a summary report

B.Archive the emails permanently in the same mailbox

C.Suspend deletion until the legal hold is lifted

D.Anonymize the sender names and keep the messages

AnswerC

A legal hold overrides the retention schedule, so the records manager must suspend deletion of the relevant emails until the hold is lifted. Destroying them would constitute spoliation of evidence in the pending harassment case.

Why this answer

A legal hold overrides standard retention policies because it preserves electronically stored information (ESI) that may be relevant to litigation. The records manager must immediately suspend deletion to avoid spoliation, which could result in legal sanctions. This aligns with the eDiscovery process and the duty to preserve evidence once litigation is reasonably anticipated.

Exam trap

CompTIA often tests the distinction between retention policies (which automate deletion based on time) and legal holds (which override those policies to preserve evidence), and the trap here is assuming that a summary report or anonymization satisfies legal preservation requirements when only a full suspension of deletion is acceptable.

How to eliminate wrong answers

Option A is wrong because deleting the emails after creating a summary report destroys the original ESI, which may be required as native evidence in court; a summary is not a substitute for the original messages. Option B is wrong because archiving emails permanently in the same mailbox does not prevent them from being overwritten or altered by normal mailbox operations, and it does not implement a proper legal hold that preserves the data in a forensically sound manner. Option D is wrong because anonymizing sender names alters the evidence, potentially destroying metadata and context needed for the investigation and violating the integrity of the ESI under legal hold requirements.

Full explanation →

433

MCQmedium

A security manager at a healthcare organization is responsible for maintaining the information security policy. A project manager requests a policy exception to use a cloud-based analytics platform that stores patient data. The platform currently encrypts data at rest with AES-128 instead of the required AES-256. The security manager assesses the risk and determines that the likelihood of data exposure is low due to other compensating controls already in place, but the impact would be high. The residual risk is within the organization's risk appetite. Which of the following is the most appropriate action for the security manager to take?

A.Deny the exception and require the project to use an approved platform that meets the AES-256 requirement.

B.Approve the exception and document the compensating controls and a review date.

C.Accept the risk and allow the project to proceed without a formal exception.

D.Escalate the request to the chief information officer for a final decision.

AnswerB

This is correct because a formal exception process with documented compensating controls and a scheduled review ensures that the risk is managed, tracked, and reassessed over time. This aligns with security program management best practices.

Why this answer

The security manager has assessed the risk, determined that compensating controls reduce the likelihood of data exposure, and confirmed that the residual risk is within the organization's risk appetite. Formally approving the exception with documented compensating controls and a review date ensures governance, accountability, and a timeline for reassessment, which aligns with the policy exception process in security program management.

Exam trap

The trap here is that candidates may assume any deviation from policy must be denied (Option A) or escalated (Option D), failing to recognize that a formal exception process with compensating controls and a review date is the correct risk-based action when residual risk is within appetite.

Why the other options are wrong

Denying the exception outright ignores the risk assessment showing low likelihood and residual risk within appetite, and fails to leverage compensating controls that reduce risk.

Accepting risk without a formal exception bypasses the required documentation and review process, which is critical for compliance and auditability in a healthcare organization handling patient data.

The security manager has the authority to approve exceptions within the organization's risk appetite, and the scenario does not indicate that escalation is required. Escalating to the CIO would be unnecessary and inefficient when the manager can make the decision themselves.

When would these options actually be correct?

This option would be correct if the risk assessment showed high likelihood or residual risk exceeding the organization's risk appetite, or if no compensating controls existed to mitigate the encryption deficiency.

This option would be correct if the security manager had determined that the risk is within the organization's risk appetite and the policy allows for risk acceptance without formal exceptions, and no compensating controls or review dates are needed.

This option would be correct if the organization's policy mandates that all exceptions involving patient data must be approved by the CIO, or if the risk exceeds the security manager's authority level and requires executive sign-off.

Why candidates pick the wrong answer

Candidates may default to strict compliance with the policy requirement (AES-256) without considering that policy exceptions are a valid risk management tool when compensating controls reduce risk to an acceptable level.

Candidates may confuse 'accepting risk' with 'approving an exception,' not realizing that formal exceptions require documentation and review to maintain policy integrity and compliance.

Candidates may think that any exception involving sensitive data like patient health information must be escalated to higher management, especially when the impact is high, but the scenario explicitly states the residual risk is within the risk appetite, so the manager can decide.

Full explanation →

434

MCQmedium

Based on the exhibit, what vulnerability is the application most likely suffering from?

A.Stored cross-site scripting, because attacker-controlled script is saved and later rendered to other users.

B.Command injection, because the script attempts to send cookies to a remote host.

C.Session fixation, because users saw the same review page after posting.

D.Insecure deserialization, because the payload is embedded in a review field.

AnswerA

Stored cross-site scripting is correct because the malicious script was submitted once, saved by the application, and then executed for other visitors when the review was displayed. The evidence of requests to the attacker domain confirms that the browser executed the injected script and exposed user data.

Why this answer

The application stores user-supplied input in a review field and later renders it to other users without proper sanitization. The exhibit shows a script tag attempting to exfiltrate cookies to a remote host, which is a classic stored cross-site scripting (XSS) payload. Because the malicious script is persisted on the server and executed in the browsers of subsequent visitors, the vulnerability is stored XSS.

Exam trap

CompTIA often tests the distinction between stored XSS and reflected XSS, where candidates may confuse the persistence of the payload (stored) with the immediate reflection of input (reflected), or they may incorrectly associate cookie exfiltration with command injection rather than client-side scripting.

How to eliminate wrong answers

Option B is wrong because command injection involves injecting operating system commands into a server-side process (e.g., via shell metacharacters like `;` or `|`), not sending cookies via JavaScript; the script's behavior of exfiltrating cookies is a client-side action, not server-side command execution. Option C is wrong because session fixation requires an attacker to force a known session ID on a user before login, and the scenario describes a review page being displayed after posting, which is unrelated to session ID manipulation. Option D is wrong because insecure deserialization exploits the deserialization of untrusted data objects (e.g., PHP or Java serialized objects) to execute arbitrary code, whereas the payload here is a simple script tag embedded in a text field, not a serialized object.

Full explanation →

435

MCQeasy

A company is considering a new SaaS vendor that will process customer records. What is the best first action before signing the contract?

A.Perform vendor due diligence and review the vendor's security controls

B.Allow the vendor access immediately and monitor for misuse afterward

C.Ask the vendor to send a marketing brochure and pricing sheet only

D.Wait until a security incident occurs before reviewing the vendor

AnswerA

Vendor due diligence evaluates the SaaS provider's security controls, certifications, data handling and breach history before contractual commitment, exposing risks that contract terms cannot retroactively fix. This satisfies the stem's requirement for the best first action prior to signing, since assessment must precede agreement.

Why this answer

Performing vendor due diligence and reviewing the vendor's security controls is the best first action because it proactively assesses the SaaS vendor's ability to protect customer records before any data is shared. This aligns with the principle of 'trust but verify' and ensures that the vendor's security posture meets the company's compliance requirements (e.g., GDPR, HIPAA) and risk tolerance before signing a legally binding contract.

Exam trap

The trap here is that candidates may think 'allowing access immediately and monitoring' is acceptable due to a false sense of security from logging tools, but CompTIA tests that proactive due diligence is mandatory before any data sharing, as monitoring alone cannot prevent contractual or compliance violations.

How to eliminate wrong answers

Option B is wrong because allowing immediate access without prior security review violates the principle of least privilege and exposes customer records to potential data breaches or unauthorized use, with no contractual safeguards in place. Option C is wrong because a marketing brochure and pricing sheet provide no technical or operational details about the vendor's security controls, encryption standards, or incident response capabilities, making it impossible to assess risk. Option D is wrong because waiting for a security incident before reviewing the vendor is a reactive, high-risk approach that could lead to regulatory fines, reputational damage, and legal liability for compromised customer data.

Full explanation →

436

Multi-Selecteasy

A security team receives a suspicious email attachment and wants to inspect its behavior safely before any user opens it. They also want a tool that can isolate the same threat if it reaches an endpoint. Which two tools or capabilities best fit this need? Select two.

Select 2 answers

A.EDR remote isolation capability on the endpoint.

B.Sandboxing the attachment before release to users.

C.DLP monitoring to prevent accidental data leakage.

D.A WAF filtering web requests to the application.

E.Port mirroring on a switch for traffic review.

AnswersA, B

Endpoint Detection and Response (EDR) agents run on the endpoint and can execute a remote isolation command that quarantines the host from the network while preserving volatile data such as memory, running processes, and open files for forensic analysis. This containment action stops lateral movement and further malicious activity within the enterprise, but it does not analyze the attachment's behavior beforehand. It is an appropriate post-detection response to a confirmed or strongly suspected malicious attachment on that specific machine.

Why this answer

A is correct because EDR remote isolation capability allows the security team to immediately disconnect an endpoint from the network if the suspicious attachment is executed, preventing lateral movement and data exfiltration. B is correct because sandboxing the attachment before release to users provides a safe, isolated environment to analyze the file's behavior without risking the production network. Together, these tools address both proactive analysis (sandbox) and reactive containment (EDR isolation).

Exam trap

The trap here is that candidates may confuse DLP's data loss prevention role with threat analysis or endpoint containment, overlooking that DLP does not execute files or isolate systems.

Full explanation →

437

Multi-Selectmedium

The legal team wants to confirm that customer records are being deleted on schedule after the retention period expires. Which two artifacts best demonstrate compliance? Select two.

Select 2 answers

A.An approved retention schedule or retention policy that defines the deletion period.

B.A folder of employee social media posts about data cleanup.

C.System or audit logs showing the deletion job ran successfully.

D.A list of all printers in the office environment.

E.A draft policy from last year that was never approved.

AnswersA, C

An approved retention schedule or retention policy is the authoritative legal and operational document that specifies how long customer records must be kept before deletion. It defines the deletion period precisely, creating an enforceable rule that the organization must follow. Without an approved, current policy, there is no clear compliance baseline, and auditors cannot validate whether data disposal practices meet regulatory or contractual obligations.

Why this answer

An approved retention schedule or policy is the authoritative document that defines the required deletion period for customer records. It serves as the legal mandate against which compliance is measured. Option C is correct because system or audit logs provide verifiable evidence that the deletion job executed successfully, confirming that the policy was actually followed.

Together, these two artifacts demonstrate both the requirement (policy) and the execution (logs) needed to prove compliance.

Exam trap

The trap here is that candidates may confuse a draft or unapproved policy (Option E) with an approved one, or mistakenly think that informal evidence like social media posts (Option B) can substitute for authoritative documentation and verifiable logs.

Full explanation →

438

Multi-Selecthard

After a phishing simulation, many employees still almost entered credentials into a fake login page. Leadership wants the fastest improvement without creating training fatigue or disrupting daily work. Which three measures are the best balance of security and usability? Select three.

Select 3 answers

A.Provide targeted microtraining only to users who clicked or nearly clicked.

B.Add a one-click report-phish button and acknowledge employee reports quickly.

C.Use just-in-time warning banners or link-check prompts when users follow external login pages.

D.Replace email access with a weekly manual approval queue for all messages.

E.Publicly identify the worst performers in team meetings to discourage mistakes.

AnswersA, B, C

Targeted microtraining is grounded in the principle that learning is most effective when immediately relevant to an individual's observed behavior. By focusing exclusively on employees who clicked or nearly clicked in the simulation, you provide specific, actionable feedback that addresses the actual risk without wasting the time of users who already demonstrated secure decision-making. This proportionate response also respects employee attention and maintains a collaborative security culture, while directly reinforcing the correct behavior for those who need it most.

Why this answer

Targeted microtraining focuses only on the users who demonstrated risky behavior (clicking or nearly clicking), which directly addresses the root cause without wasting time on users who did not engage. This approach avoids training fatigue by keeping content brief and relevant, and it does not disrupt daily work for the majority of employees who already exhibit secure behavior.

Exam trap

The trap here is that candidates may confuse 'fastest improvement' with 'most aggressive technical control' (like option D) or 'public shaming' (like option E), failing to recognize that behavioral change through targeted, low-friction interventions (microtraining, reporting, and just-in-time prompts) yields faster and more sustainable results without alienating users.

Full explanation →

439

MCQmedium

A public website is overwhelmed by a flood of DNS responses arriving from many open resolvers after the attacker sends small forged queries to those resolvers. The target bandwidth is saturated and the source IPs vary widely. What kind of attack is being used?

A.SYN flood

B.DNS amplification DDoS

C.Replay attack

D.Man-in-the-middle attack

AnswerB

The attacker sends small forged queries to many open resolvers, which return much larger responses to the spoofed victim address. This reflection and amplification saturates the target's bandwidth, matching the widely varying source IPs and DNS response flood.

Why this answer

B is correct because this scenario describes a DNS amplification DDoS attack. The attacker sends small forged DNS queries with a spoofed source IP (the victim's IP) to open resolvers, which respond with much larger DNS replies. The flood of amplified responses saturates the victim's bandwidth, and the varying source IPs make mitigation difficult.

This matches the description of a reflection/amplification attack using DNS.

Exam trap

The trap here is confusing a DNS amplification attack with a SYN flood because both involve flooding, but the key differentiator is the use of DNS responses from open resolvers versus incomplete TCP handshakes.

How to eliminate wrong answers

Option A is wrong because a SYN flood targets the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server resources; it does not involve DNS responses or open resolvers. Option C is wrong because a replay attack involves capturing and retransmitting valid data transmissions (e.g., authentication tokens) to trick a system; it does not use DNS queries or bandwidth saturation.

Full explanation →

440

MCQmedium

A company wants all corporate laptops to authenticate to Wi-Fi using device certificates instead of shared passwords. It also wants to deny network access to systems that do not meet the baseline requirement for disk encryption and current endpoint protection. Which approach best satisfies both goals?

A.Use a single WPA2-Personal passphrase and email it to all employees.

B.Deploy 802.1X with certificate-based authentication and network access control posture checks.

C.Allow any device to join and rely on antivirus scans after users log in.

D.Use MAC address filtering and a captive portal for all internal Wi-Fi users.

AnswerB

802.1X using EAP-TLS or a similar certificate-based protocol provides mutual authentication: the corporate laptop presents a client certificate stored in its machine store, and the RADIUS/AAA server validates it against the CA, ensuring only authorized corporate devices connect. Network Access Control (NAC) posture checks then assess compliance criteria such as OS patch level, antivirus status, and disk encryption, automatically quarantining noncompliant devices until they are remediated.

Why this answer

802.1X with certificate-based authentication ensures that only devices with valid certificates can authenticate to the Wi-Fi network, eliminating reliance on shared passwords. Network access control (NAC) posture checks then evaluate each device against baseline requirements (e.g., disk encryption, current endpoint protection) and deny access to non-compliant systems. This combination directly satisfies both goals of certificate-only authentication and conditional access based on security posture.

Exam trap

The trap here is that candidates often confuse 802.1X with simple certificate authentication and overlook the NAC posture check component, assuming that certificate-based authentication alone meets the baseline requirement, but the question explicitly requires denying access to non-compliant systems, which only NAC can enforce.

How to eliminate wrong answers

Option A is wrong because WPA2-Personal uses a single shared passphrase, which does not enforce device-specific authentication or posture checks, and emailing the passphrase to all employees introduces a security risk. Option C is wrong because allowing any device to join and relying on post-login antivirus scans does not prevent non-compliant devices from accessing the network initially, violating the requirement to deny access to systems that do not meet baseline requirements. Option D is wrong because MAC address filtering can be spoofed and does not verify device certificates or security posture, and a captive portal typically only controls web access after connection, not the initial network authentication or compliance checks.

Full explanation →

441

MCQmedium

A security administrator at a financial institution is reviewing the organization's encryption strategy. The company wants to protect data stored on backup tapes that are transported to an off-site facility. Which of the following BEST describes the type of encryption that should be applied to the data on the tapes?

A.Tokenization

B.Encryption in use

C.Encryption in transit

D.Encryption at rest

AnswerD

Encryption at rest protects data stored on media such as backup tapes, hard drives, or cloud storage. Since the tapes are stored off-site and could be lost or stolen, encrypting the data at rest ensures that even if the physical media is compromised, the data remains unreadable without the proper keys. This directly addresses the risk of unauthorized access to stored backup data.

Why this answer

The data on backup tapes is stored data, not data moving across a network or being processed. The primary threat is physical theft or loss of the tapes during transport or off-site storage. Encryption at rest ensures that the data remains confidential even if the media is compromised.

Encryption in transit and in use address different states of data and do not protect stored backup media.

Exam trap

The trap here is confusing the physical transport of tapes with encryption in transit, which actually protects data moving over a network.

Full explanation →

442

MCQeasy

Based on the exhibit, what should the security team recommend before sharing the report?

A.Share the report exactly as requested, because the vendor signed a nondisclosure agreement.

B.Remove unnecessary personal fields and share only the minimum data needed for the analysis.

C.Keep all fields and encrypt the file before sending it to the vendor.

D.Store the report in a shared folder so the vendor can access it later if needed.

AnswerB

This is the correct privacy-by-design response because the vendor only needs department-level trends. The organization should minimize the data shared, especially sensitive or unnecessary fields like home addresses and medical leave codes. Limiting the dataset reduces privacy risk, supports compliance, and follows the principle of collecting and disclosing only what is needed for the stated business purpose.

Why this answer

The principle of data minimization requires that only the minimum necessary data be shared to fulfill the analysis purpose. Removing unnecessary personal fields reduces the risk of exposing PII and aligns with privacy regulations such as GDPR and HIPAA, even when a nondisclosure agreement (NDA) is in place.

Exam trap

CompTIA often tests the misconception that a signed NDA or encryption alone is sufficient to share sensitive data, when in fact data minimization and least privilege are the primary security controls required.

How to eliminate wrong answers

Option A is wrong because an NDA does not justify sharing all data fields; it only provides a legal framework for confidentiality, not a technical safeguard against data exposure or misuse. Option C is wrong because encrypting the file protects data in transit but does not address the core issue of sharing unnecessary personal fields; encryption alone does not comply with data minimization principles. Option D is wrong because storing the report in a shared folder introduces additional access control risks and does not limit the data shared to only what is needed for analysis, violating the principle of least privilege.

Full explanation →

443

MCQmedium

An online ticketing system must survive a single server failure and continue operating after a primary site outage. The business wants the lowest-cost design that still improves availability. Which architecture is best?

A.Deploy active-active servers across multiple regions with load balancing.

B.Use an active-passive design with replicated data and automatic failover to a secondary site.

C.Schedule nightly backups and restore only after the outage is confirmed.

D.Add RAID to the server to protect against all availability failures.

AnswerB

An active-passive design keeps a secondary site on standby with continuously replicated data (synchronous or asynchronous). When the primary server fails, automatic failover triggers the standby to become active, typically within seconds or minutes, and clients are redirected via a DNS change or virtual IP. This directly addresses a single server failure while limiting standby costs because the passive site runs at reduced capacity until needed.

Why this answer

An active-passive design with replicated data and automatic failover (Option B) meets the requirement of surviving a single server failure and a primary site outage while minimizing cost. Unlike active-active, it uses standby resources that only activate during failover, reducing operational expense. This architecture improves availability without the complexity and cost of multi-region active-active deployment.

Exam trap

The trap here is that candidates often choose active-active (Option A) because it offers the highest availability, but they overlook the explicit 'lowest-cost' constraint, which makes the cheaper active-passive design the correct answer despite its slightly longer failover time.

How to eliminate wrong answers

Option A is wrong because deploying active-active servers across multiple regions with load balancing provides high availability but at significantly higher cost due to redundant active infrastructure in multiple geographic locations, which exceeds the 'lowest-cost' requirement. Option C is wrong because nightly backups with restore only after outage confirmation does not provide continuous availability; it results in significant downtime (potentially hours or days) and data loss (up to 24 hours of transactions), failing the 'continue operating' requirement. Option D is wrong because RAID protects only against local disk failures, not against server failure (e.g., motherboard, power supply) or site outage (e.g., power loss, network cut), so it does not meet the survivability requirement.

Full explanation →

444

MCQmedium

A hospital is redesigning its wireless network. Guest devices must reach only the internet. Staff laptops need access to internal applications. Medical devices must communicate with a monitoring server but never with guest devices or the broader employee LAN. What design best meets these goals with the least operational complexity?

A.Place all devices on one flat network and rely on endpoint antivirus for protection.

B.Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.

C.Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.

D.Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.

AnswerB

This approach provides clean segmentation while keeping administration manageable. Separate VLANs define distinct trust zones, and firewall policies or ACLs control exactly which services can cross boundaries. That lets guest traffic stay internet-only, staff reach approved internal apps, and medical devices communicate only with the monitoring server.

Why this answer

VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.

Exam trap

The trap here is that candidates may choose client isolation (Option C) thinking it provides security, but it breaks required device-to-server communication and does not enforce role-based access, whereas VLANs with firewall policies offer precise, scalable segmentation.

How to eliminate wrong answers

Option A is wrong because a flat network with only endpoint antivirus provides no network-level segmentation, allowing guest devices to potentially access staff or medical systems, violating isolation requirements. Option C is wrong because a single SSID with client isolation prevents all device-to-device communication, which would block legitimate traffic between medical devices and the monitoring server, and NAT alone does not enforce access controls between device groups. Option D is wrong because network access control only at login time (e.g., 802.1X authentication) does not enforce ongoing traffic restrictions; after authentication, all devices share the same subnet, allowing unauthorized communication between guest, staff, and medical devices.

Full explanation →

445

MCQmedium

A security analyst detects an encrypted outbound connection from a web server to an unknown IP address. The connection is persistent and occurs every 5 minutes. What is the MOST appropriate first step for the analyst to take?

A.Disconnect the server from the network immediately.

B.Block the IP address at the perimeter firewall.

C.Review the server's process list and logs to identify the source.

D.Escalate the incident to the incident response team.

AnswerC

This is the correct first step. By examining the process list and logs (e.g., system, firewall, and application logs), the analyst can determine the specific process or service responsible for the outbound connection, assess whether it is malicious, and gather evidence for further investigation or escalation.

Why this answer

The first step in investigating an unknown encrypted outbound connection is to identify the process or service responsible for initiating it. Reviewing the server's process list and logs allows the analyst to determine whether the connection is legitimate (e.g., a scheduled update or backup) or malicious (e.g., a beacon from implanted malware). Without this visibility, actions like blocking or disconnecting could disrupt legitimate services or alert an attacker prematurely.

Exam trap

The trap here is that candidates often jump to containment (disconnect or block) without first performing local analysis, failing to recognize that the initial step in incident response is always identification and scoping before containment.

Why the other options are wrong

Disconnecting the server immediately could destroy volatile evidence (e.g., running processes, memory contents) needed to identify the source of the encrypted connection, and may cause unnecessary service disruption without understanding the threat.

Blocking the IP address at the perimeter firewall is premature without first identifying the source and nature of the connection. The connection could be legitimate (e.g., a scheduled update or backup), and blocking it might disrupt operations or alert an attacker without gathering evidence.

In this scenario, the analyst has not yet identified the source of the encrypted connection. Escalating without initial investigation would bypass necessary evidence gathering and could delay containment.

When would these options actually be correct?

If the encrypted outbound connection is confirmed as active data exfiltration of sensitive data and the server is isolated from critical systems, immediate disconnection may be justified to prevent further data loss, especially when containment is prioritized over forensic preservation.

This option would be correct if the question stated that the analyst has already confirmed the connection is malicious (e.g., via threat intelligence or sandbox analysis) and the immediate priority is to contain the threat by blocking communication with a known command-and-control server.

This would be correct if the analyst had already identified malicious activity (e.g., confirmed malware or data exfiltration) and the incident exceeded their authority or required specialized response resources.

Why candidates pick the wrong answer

Candidates may believe that stopping the connection immediately is the safest action, not realizing that preserving evidence for analysis is typically the first step in incident response unless there is an immediate threat to life or critical data loss.

Candidates may think blocking the IP is a quick and effective containment step, but they overlook the need for investigation first to avoid false positives and preserve forensic evidence.

Candidates may believe that any suspicious encrypted outbound connection warrants immediate escalation to incident response, overlooking the need for initial triage and evidence collection.

Full explanation →

446

MCQmedium

A company can patch only one of two internet-facing systems this week. System 1 has a critical vulnerability but is reachable only through the corporate VPN during maintenance windows. System 2 has a medium vulnerability and supports the public payment site, which shows active attack traffic every day. Which system should be prioritized first?

A.System 1, because the vulnerability is rated critical

B.System 2, because it is exposed to the public and directly supports a business-critical service

C.Neither system, because both are internet-facing and must wait for the next maintenance cycle

D.System 1, because VPN access always makes a vulnerability more dangerous than a public application issue

AnswerB

System 2 should be patched first because risk depends on both exposure and business impact. A medium issue on a public payment site with active attacks presents a higher real-world risk than a critical issue on a system with narrower access. The payment service is also directly tied to revenue and customer trust, so delaying its remediation would create greater business exposure.

Why this answer

System 2 should be prioritized because it is directly exposed to the public internet and supports a business-critical payment service that is under active attack daily. Even though System 1 has a critical vulnerability, it is only reachable through the corporate VPN during maintenance windows, which significantly reduces its attack surface and exploitability. In risk management, the likelihood of exploitation and business impact often outweigh the CVSS base score alone, making System 2 the higher priority.

Exam trap

The trap here is that candidates fixate on the CVSS critical rating (System 1) and ignore the crucial context of attack surface and active threat, leading them to choose A instead of applying risk-based prioritization.

How to eliminate wrong answers

Option A is wrong because it focuses solely on the CVSS severity rating (critical) without considering the reduced attack surface due to VPN-only access, which lowers the actual risk. Option C is wrong because delaying patching for both systems ignores the immediate threat to the public-facing payment service under active attack, violating the principle of prioritizing based on risk and business impact. Option D is wrong because VPN access does not inherently make a vulnerability more dangerous; in fact, it restricts the attack vector to authenticated users, whereas a public-facing system is exposed to the entire internet, including automated attack traffic.

Full explanation →

447

MCQmedium

An organization is redesigning its office network. Guest Wi-Fi must reach the internet only, employee laptops need access to internal apps, and a payment-processing system must be separated from general user traffic but still reach one database server. Which design best meets these requirements?

A.Place all devices on one flat network and rely on host firewalls for isolation.

B.Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.

C.Put the payment system in a DMZ and allow direct internet access for database synchronization.

D.Use NAT on every endpoint so internal devices cannot be individually identified on the network.

AnswerB

This approach creates separate Layer 2 segments (VLANs or subnets) for guest, user, and payment zones, and then applies firewall or ACL rules between them. By enforcing least-privilege connectivity—allowing only the specific ports and protocols needed for business purposes—it prevents lateral movement from compromised guest or user devices into the payment environment. This is the standard segmentation practice required for compliance frameworks like PCI DSS.

Why this answer

It uses VLANs or subnets to segment guest, employee, and payment-processing traffic into separate broadcast domains, then applies firewall rules or ACLs to control inter-zone traffic. This allows guest Wi-Fi to be restricted to internet-only access, employee laptops to reach internal apps, and the payment system to communicate only with its specific database server while being isolated from general user traffic.

Exam trap

The trap here is that candidates often think a DMZ is always the correct answer for any sensitive system, but in this scenario, the payment system needs controlled access to an internal database, not internet exposure, making VLAN segmentation with firewalls the proper design.

How to eliminate wrong answers

Option A is wrong because a single flat network provides no segmentation; host firewalls alone cannot enforce network-level isolation between guest, employee, and payment traffic, leaving the payment system exposed to all other devices. Option C is wrong because placing the payment system in a DMZ with direct internet access for database synchronization violates the requirement to separate it from general user traffic and introduces unnecessary exposure to the internet, whereas the database should be accessed only via controlled internal paths. Option D is wrong because NAT on every endpoint does not provide network segmentation or access control; it only hides internal IP addresses, failing to isolate guest, employee, and payment traffic or restrict their communication paths.

Full explanation →

448

MCQmedium

Based on the exhibit, which architecture best meets the goal of keeping the order service running if one application server fails?

A.Use one active server with a warm standby server that is started manually during outages.

B.Run the application servers active-active behind the load balancer.

C.Store the application binaries on RAID 1 disks to prevent service interruption.

D.Take nightly backups of the application servers and restore them after a failure.

AnswerB

This architecture keeps multiple application servers online simultaneously, with the load balancer distributing incoming requests and performing health checks. If one server fails, the load balancer stops sending traffic to it and the surviving servers continue handling the load, so service remains uninterrupted. This automatic failover and redundancy directly satisfies the goal of high availability.

Why this answer

An active-active architecture behind a load balancer ensures that if one application server fails, the load balancer automatically redirects traffic to the remaining healthy server(s). This provides high availability and fault tolerance without manual intervention, keeping the order service running continuously.

Exam trap

The trap here is that candidates often confuse data redundancy (RAID 1) with server-level fault tolerance, or they mistake backup strategies (nightly backups) for high-availability solutions, failing to recognize that only active-active or active-passive clustering with automatic failover meets the requirement of uninterrupted service during a server failure.

How to eliminate wrong answers

Option A is wrong because a warm standby server that is started manually introduces significant downtime (minutes to hours) while an administrator detects the failure and brings the standby online, failing the goal of keeping the service running during a failure. Option C is wrong because RAID 1 (mirroring) protects against disk failure but does not address application server failure; if the server itself crashes or its OS/application becomes unresponsive, the mirrored disks are still inaccessible. Option D is wrong because nightly backups are a disaster recovery measure, not a high-availability solution; restoring from backup can take hours and results in data loss from the last backup point, so the service would be interrupted for an extended period.

Full explanation →

449

MCQmedium

A system administrator must run a weekly patch-and-restart job on 80 Linux servers without logging in interactively. The job should be repeatable, auditable, and limited to only the required maintenance commands. What is the best approach?

A.Share a root SSH key with the operations team so anyone can run the job.

B.Use a configuration management tool with a dedicated service account and restricted sudo permissions.

C.Have each administrator log in manually and run the commands from an interactive shell.

D.Create a local root account on every server for maintenance tasks.

AnswerB

Using a configuration management tool like Ansible or Puppet with a dedicated service account is ideal because it enforces least privilege: the account can be restricted via sudoers to only execute the specific patching and reboot commands (e.g., yum, apt, systemctl reboot), not a full root shell. The tool provides centralized execution, idempotent playbooks, and immutable audit logs showing exactly which commands ran on which hosts, eliminating human variability. A dedicated service account also supports credential rotation and integration with enterprise secret management, without exposing interactive root access.

Why this answer

B is correct because configuration management tools (e.g., Ansible, Puppet, or SaltStack) allow you to define a repeatable, auditable patch-and-restart job using a dedicated service account with restricted sudo permissions. This approach enforces the principle of least privilege, logs all actions via the tool's job history, and eliminates the need for interactive login, meeting all requirements for automation, auditability, and command restriction.

Exam trap

The trap here is that candidates may choose Option A (shared root SSH key) because it seems convenient for automation, but they overlook the critical security and auditability requirements that make configuration management with a restricted service account the only correct choice.

How to eliminate wrong answers

Option A is wrong because sharing a root SSH key violates the principle of least privilege and non-repudiation — anyone with the key can execute arbitrary commands as root without an audit trail of who ran what. Option C is wrong because manual interactive login on 80 servers is not repeatable, introduces human error, and fails to provide a centralized audit log; it also violates the requirement to avoid interactive login. Option D is wrong because creating a local root account on every server increases the attack surface, makes key management and auditing nearly impossible, and directly contradicts the need for a restricted, auditable process.

Full explanation →

450

MCQmedium

Based on the exhibit, what is the best cloud identity control to ensure terminated users lose access to the SaaS application quickly and consistently?

A.Keep the SaaS local user accounts and require the help desk to disable them manually after each termination.

B.Enable federated authentication with the corporate IdP and automate provisioning and deprovisioning with SCIM.

C.Create a shared emergency administrator account so access can be revoked by changing one password.

D.Require users to clear browser cookies after termination so the SaaS session expires sooner.

AnswerB

Federation centralizes authentication in the corporate identity provider, and SCIM automates account lifecycle changes based on HR events. That means terminations, transfers, and new hires can be reflected quickly in the SaaS application without relying on manual email tickets. This reduces orphaned accounts and improves consistency across the cloud environment.

Why this answer

Federated authentication with a corporate identity provider (IdP) combined with SCIM (System for Cross-domain Identity Management) ensures that when a user is terminated in the IdP (e.g., Active Directory or Azure AD), the SaaS application is automatically notified via SCIM to deprovision the user account. This eliminates manual intervention and guarantees consistent, near-instant revocation of access across all federated SaaS applications.

Exam trap

The trap here is that candidates often confuse session management (clearing cookies) with account deprovisioning, or they assume manual processes are acceptable for security, when the exam emphasizes automation and centralized identity management for consistency and speed.

How to eliminate wrong answers

Option A is wrong because keeping local SaaS accounts and manually disabling them via the help desk introduces human delay and inconsistency, violating the principle of automated, timely deprovisioning. Option C is wrong because a shared emergency administrator account does not address individual user termination; changing one password would affect all administrators, not just the terminated user, and violates non-repudiation and least privilege. Option D is wrong because clearing browser cookies only ends the current session on that specific browser; it does not revoke the user's underlying account or prevent re-authentication from other devices, and the user could simply log in again.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 376–450