Security+ SY0-701 SY0-701 Questions 526–600 | Page 8/14

526

MCQmedium

A project team needs to use an unapproved file-sharing application for two weeks because the approved platform cannot support an external client collaboration feature. What is the best security action?

A.Deny the request permanently and avoid discussing the business need

B.Approve a documented temporary exception with compensating controls and a review date

C.Immediately rewrite the policy so all users may use the unapproved application

D.Ask the team to create a detailed step-by-step procedure for using the application

AnswerB

A temporary exception is the best choice when a business need exists and the risk can be managed. Document the reason, identify compensating controls such as encryption or restricted access, assign an owner, and set an expiration date. That approach preserves governance, keeps the risk visible, and avoids turning a temporary deviation into an indefinite shadow process.

Why this answer

It follows the principle of risk acceptance through a formal exception process. By documenting a temporary exception with compensating controls (e.g., data encryption, access logging, and usage monitoring) and setting a review date, the organization maintains security oversight while addressing the legitimate business need. This approach aligns with the SY0-701 domain of Security Program Management, which emphasizes balancing security with operational requirements through managed risk.

Exam trap

The trap here is that candidates may choose Option D, thinking that a detailed procedure mitigates risk, but CompTIA tests the understanding that procedures without compensating controls do not reduce the inherent risk of using an unapproved application.

How to eliminate wrong answers

Option A is wrong because it ignores the business need entirely, which can lead to shadow IT or unauthorized workarounds that bypass security controls entirely. Option C is wrong because immediately rewriting policy for a temporary, isolated need creates unnecessary risk exposure for all users and violates change management principles. Option D is wrong because a detailed procedure does not address the underlying security risk of using an unapproved application; it only documents how to use it unsafely.

Full explanation →

527

MCQmedium

A developer reports that a search field returns all customer records when they enter a single quote followed by OR 1=1. Security confirms the web app concatenates user input directly into SQL statements. Which remediation is best?

A.Deploy only a web application firewall and keep the code unchanged.

B.Use parameterized queries or prepared statements in the application code.

C.Store the database password as a salted hash in the application configuration.

D.Disable HTTPS so the request body is easier to inspect by network tools.

AnswerB

Parameterized queries separate code from user-supplied data, which prevents injected input from being interpreted as SQL instructions. That directly addresses the flaw described in the scenario and is the most reliable long-term fix. It also scales better than trying to block every malicious pattern with filtering or a perimeter tool. In secure development, fixing the query construction is preferred because it removes the root cause instead of only reducing symptoms at the edge.

Why this answer

Parameterized queries or prepared statements separate SQL logic from user input, preventing the concatenation that allows SQL injection. By using placeholders (e.g., `?` or `:param`) and binding user input as data, the database engine treats the single quote and `OR 1=1` as literal string values, not executable SQL code. This directly remediates the root cause—dynamic SQL construction—without relying on external filters or insecure workarounds.

Exam trap

The trap here is that candidates may think a WAF (Option A) is sufficient because it blocks common payloads like `' OR 1=1`, but the exam emphasizes that security must be implemented at the code level, not just at the network perimeter.

How to eliminate wrong answers

Option A is wrong because a web application firewall (WAF) only filters known attack patterns and can be bypassed with obfuscation or novel payloads; it does not fix the insecure code, leaving the application vulnerable to SQL injection variants. Option C is wrong because storing the database password as a salted hash in the configuration is irrelevant—passwords are used for authentication, not for preventing SQL injection, and hashing a password would make it unusable for database login. Option D is wrong because disabling HTTPS exposes the entire request body in plaintext, increasing the risk of eavesdropping and session hijacking, and does nothing to prevent SQL injection.

Full explanation →

528

MCQmedium

A hospital has clinical workstations, badge readers, and building cameras all connected to the same switching infrastructure. After a workstation infection, the security team wants to prevent those endpoints from laterally reaching the badge readers while still allowing the cameras to report to a recording server. What should be implemented first?

A.Create separate VLANs and apply ACLs between device groups based on business need.

B.Increase the DHCP lease time so devices keep the same IP addresses longer.

C.Replace the switches with unmanaged models to simplify configuration.

D.Disable the cameras' encryption so the recording server can process traffic faster.

AnswerA

Separate VLANs place clinical workstations, badge readers and cameras into distinct Layer 2 broadcast domains, then ACLs on the Layer 3 boundary filter traffic between them. This directly satisfies the requirement to block workstation-to-badge-reader lateral movement while permitting camera traffic to the recording server.

Why this answer

Creating separate VLANs segments the network into distinct broadcast domains, preventing workstations from directly reaching badge readers at Layer 2. Applying ACLs between VLANs then enforces granular access control, allowing only the cameras to communicate with the recording server while blocking lateral movement from infected endpoints. This aligns with the principle of least privilege and is the foundational step for network segmentation.

Exam trap

The trap here is that candidates often overlook the need for Layer 2 segmentation (VLANs) as a prerequisite for Layer 3/4 ACLs, mistakenly thinking ACLs alone on a flat network can block lateral movement between devices in the same subnet.

How to eliminate wrong answers

Option B is wrong because increasing DHCP lease time does not provide any security controls; it only reduces IP address churn and does not prevent lateral movement between devices. Option C is wrong because replacing managed switches with unmanaged models removes the ability to configure VLANs, ACLs, or any traffic filtering, making segmentation impossible. Option D is wrong because disabling encryption on cameras would expose video traffic to eavesdropping and does not address the need to restrict workstation-to-badge-reader access; it also violates security best practices.

Full explanation →

529

MCQmedium

A help desk receives an email from an employee asking to urgently reset MFA because they are traveling and locked out. The sender address matches the employee's name but uses a slightly different domain. What is the best action for the help desk agent?

A.Reset MFA immediately because the request appears to come from the employee.

B.Reply to the email and ask the employee to confirm the request in writing.

C.Use a separate, known-good contact method to verify the request before making any change.

D.Forward the message to everyone in IT so another technician can decide what to do.

AnswerC

The safest response is to verify the request through a trusted channel that is independent of the suspicious email, such as a known phone number or established ticketing workflow. This helps prevent account takeover through impersonation or domain spoofing. After verification, the help desk can follow normal reset procedures and record the event for accountability. This is a practical anti-social-engineering habit.

Why this answer

The email's domain mismatch is a classic indicator of a phishing or social engineering attempt. The help desk must verify the request through a separate, known-good communication channel (e.g., a phone call to the employee's official number or an in-person verification) before resetting MFA, as MFA reset bypasses a critical authentication control. This aligns with the principle of out-of-band verification to prevent unauthorized account takeover.

Exam trap

The trap here is that candidates assume a matching display name and a plausible story (urgent travel) are sufficient for trust, overlooking the domain mismatch as the primary red flag that demands out-of-band verification.

How to eliminate wrong answers

Option A is wrong because resetting MFA immediately based on an email with a mismatched domain ignores the clear red flag of domain spoofing, which could allow an attacker to gain unauthorized access. Option B is wrong because replying to the same email thread does not provide independent verification; the attacker may control the compromised email account and could simply confirm the request, defeating the purpose of verification. Option D is wrong because forwarding the message to everyone in IT wastes time, creates confusion, and does not follow a proper verification procedure; it also risks spreading potentially malicious content or causing unnecessary panic.

Full explanation →

530

MCQmedium

Several employees reported a text message that looked like it came from the VPN support team and linked to a fake sign-in page. Management wants to reduce future success of these attacks and improve how quickly users report suspicious messages. What should the security team implement?

A.Send one annual lecture to all staff and close the ticket

B.Run role-based smishing simulations and provide a simple reporting workflow

C.Disable text messaging for every employee mobile device

D.Require managers to approve every external message before users open it

AnswerB

Role-based smishing simulations tailor realistic phishing scenarios to the user's job function, such as a fake expense report for finance or a fraudulent wire-transfer request for executives, which makes the training relevant and memorable. Combining these with a simple reporting workflow—for example, a 'Report Phish' button in the email client or a shared SMS inbox—enables users to report suspicious texts quickly and helps the security team collect threat intelligence and respond faster. This combination changes user behavior, reinforces secure habits, and produces measurable metrics like click rate and report rate.

Why this answer

Smishing simulations train users to recognize phishing SMS attacks in a controlled environment, directly reducing susceptibility. A simple reporting workflow (e.g., a dedicated email address or button in the messaging app) lowers the friction for users to report suspicious messages, enabling faster incident response. This combination addresses both the reduction of attack success and the improvement of reporting speed.

Exam trap

The trap here is that candidates may choose Option C (disable text messaging) because it seems like a definitive technical control, but the question specifically asks to reduce future success and improve reporting speed, which requires user training and a streamlined reporting process, not a blanket ban that breaks business functionality.

How to eliminate wrong answers

Option A is wrong because a single annual lecture provides no ongoing reinforcement or practical testing, and closing the ticket without further action leaves the organization vulnerable to evolving smishing tactics. Option C is wrong because disabling text messaging for all employees is impractical and would disrupt legitimate business communications, violating the principle of least privilege and operational continuity. Option D is wrong because requiring managers to approve every external message before users open it creates an unsustainable bottleneck, delays response, and does not scale; it also fails to address the root cause of user susceptibility to social engineering.

Full explanation →

531

MCQmedium

After a ransomware event, management wants proof that last night's backups can actually support business operations before they declare recovery complete. What is the best action?

A.Perform a test restore into an isolated environment and validate the files or application work correctly.

B.Increase the backup retention period without testing the backups.

C.Copy the backup set to a new storage bucket and assume it is usable.

D.Run a vulnerability scan against the backup server.

AnswerA

A test restore is the only option that proves the backup can actually be recovered and used. By restoring into an isolated environment, the team avoids contaminating production while still confirming that data, permissions, and the application behave as expected. This also helps validate recovery objectives and exposes problems such as corrupted backups, missing dependencies, or failed restore procedures before a real outage occurs.

Why this answer

Performing a test restore into an isolated environment directly validates that the backup data is intact, the restore process works, and the restored files or applications function as expected. This provides management with the proof they need to confirm business operations can resume, which is the core requirement after a ransomware event.

Exam trap

The trap here is that candidates may confuse backup management tasks (like retention or copying) with actual recovery validation, or think that security scanning proves backup usability, when only a functional test restore provides the required proof of operability.

How to eliminate wrong answers

Option B is wrong because merely increasing the backup retention period does not verify the usability or integrity of the backups; it only stores more data without any validation. Option C is wrong because copying the backup set to a new storage bucket and assuming it is usable ignores the need to test the restore process and verify data integrity; backups are useless if they cannot be restored correctly. Option D is wrong because running a vulnerability scan against the backup server checks for security weaknesses but does not test whether the backup data can be restored and support business operations.

Full explanation →

532

MCQmedium

A vulnerability scan identifies a critical patch for a fleet of internet-facing servers. The operations lead wants to apply it immediately during peak business hours because the exploit is public. What is the BEST next step?

A.Install the patch on all servers immediately without testing

B.Use the emergency change process with testing, approval, and a rollback plan

C.Wait until the next quarterly maintenance window to avoid any risk

D.Patch only one production server and assume the rest will be fine

AnswerB

The emergency change process is the correct path because it preserves the essential safeguards of testing, stakeholder approval, and a defined rollback plan while compressing the timeline for a critical vulnerability. This process typically involves a CAB (Change Advisory Board) or emergency CAB, where the risk of not patching is weighed against the potential impact of the patch itself. Testing on a representative non-production system, even in abbreviated form, validates compatibility and reduces the chance of introducing an outage. A documented rollback procedure ensures that if the patch fails in production, the organization can quickly revert to a known-good state without prolonged downtime.

Why this answer

An emergency change process allows the critical patch to be applied quickly while still incorporating essential steps like testing, approval, and a rollback plan. This balances the urgency of a public exploit with the need to avoid unintended service disruptions during peak business hours, aligning with change management best practices in Security Operations.

Exam trap

The trap here is that candidates may choose option A, thinking speed is the only priority, but the exam tests the balance between urgency and risk management through formal change control processes.

How to eliminate wrong answers

Option A is wrong because installing the patch on all servers immediately without testing risks introducing compatibility issues or system instability, which could cause widespread outages during peak hours. Option C is wrong because waiting until the next quarterly maintenance window ignores the critical nature of a public exploit, leaving systems vulnerable to active attacks in the interim. Option D is wrong because patching only one production server and assuming the rest will be fine does not address the fleet-wide vulnerability and provides a false sense of security, as the unpatched servers remain exposed.

Full explanation →

533

MCQmedium

A defense contractor is deploying a new document management system that will store classified military intelligence. The security policy requires that user access to each document is strictly determined by the document's classification label (e.g., Confidential, Secret, Top Secret) and the user's verified security clearance level. Furthermore, system administrators must not be able to change these access rules or grant themselves access to documents above their clearance. Which access control model is best suited for this requirement?

A.Discretionary Access Control (DAC)

B.Role-Based Access Control (RBAC)

C.Mandatory Access Control (MAC)

D.Attribute-Based Access Control (ABAC)

AnswerC

Mandatory Access Control (MAC) enforces access decisions through system-wide security labels, such as user clearances and document classifications, that are centrally administered. Unlike other models, these rules cannot be overridden by the document owner or even a system administrator, ensuring that a user lacking the required clearance can never access classified documents. This aligns with the policy's requirement for non-discretionary, clearance-based enforcement, making MAC the correct choice.

Why this answer

Mandatory Access Control (MAC) is the correct choice because it enforces access decisions based on security labels (e.g., classification levels) and user clearances, which are centrally managed and cannot be overridden by users or administrators. In this scenario, the system must strictly enforce that a user's clearance level matches or exceeds the document's classification label, and administrators cannot modify these rules or elevate their own access—a core property of MAC systems like SELinux or those implementing Bell-LaPadula.

Exam trap

The trap here is that candidates often confuse RBAC with MAC because both use roles or labels, but RBAC lacks the mandatory, non-overridable enforcement of classification labels and administrator restrictions that MAC provides.

Why the other options are wrong

DAC allows users to control access to their own objects, which violates the requirement that system administrators cannot change access rules or grant themselves access. The policy demands centralized, non-discretionary control based on classification labels and clearance levels.

RBAC assigns permissions based on roles (e.g., manager, analyst), not on document classification labels and user security clearances. The requirement for strict, non-overridable access based on classification labels and clearances is a defining feature of MAC, not RBAC.

ABAC allows access decisions based on attributes like document classification and user clearance, but it does not inherently prevent administrators from modifying access rules or granting themselves elevated access, which violates the strict policy requirement that administrators cannot change rules or bypass clearance.

When would these options actually be correct?

A small business wants to allow document owners to decide who can read or edit their files, with no central security policy overriding those decisions. DAC would be correct because it gives users discretion over their own resources.

A company wants to grant access to a financial system based on job roles (e.g., accountant, auditor) and allows role managers to define permissions. RBAC would be correct because it focuses on role-based permissions, not mandatory labels.

A question where access decisions must be based on multiple dynamic attributes (e.g., time, location, device health) and the policy requires fine-grained, context-aware control without central rule enforcement, such as 'Which model supports access based on user role, time of day, and device security posture?'

Why candidates pick the wrong answer

Candidates may confuse DAC with MAC because both involve labels, but DAC's owner-controlled permissions are fundamentally different from the system-enforced, label-based rules required here.

Candidates may think RBAC can enforce classification by creating roles like 'Secret-clearance user', but RBAC lacks the mandatory, system-enforced label-based control that MAC provides.

Candidates may think ABAC is the most flexible and modern model, and they might assume it can enforce any policy, including mandatory controls, but they overlook that ABAC does not inherently prevent administrators from altering policies or granting themselves access.

Full explanation →

534

MCQmedium

A SIEM alert shows a successful VPN login for an executive account from an unusual country, followed 3 minutes later by large downloads from a file share the user rarely accesses. Which log source should the analyst review next to determine whether the session came from the user's assigned laptop or an unmanaged device?

A.VPN concentrator logs

B.Endpoint detection and response telemetry from the user's laptop

C.DNS query logs from the internal resolver

D.Email gateway logs for the executive mailbox

AnswerB

Endpoint detection and response (EDR) telemetry from the user's laptop provides the highest-fidelity evidence for validating a VPN login. It can confirm the device's unique hardware ID, hostname, and EDR agent status, while also showing whether the laptop was trusted, healthy, and free of active compromises at the time of login. By correlating process execution, network connections, and user activity, EDR can tie the VPN authentication to the exact endpoint and rule out a stolen token or a forged client.

Why this answer

B is correct because endpoint detection and response (EDR) telemetry from the user's laptop provides granular process-level and network-level data, including the source IP of the VPN session, the device's hostname, and whether the VPN client software was initiated from the managed laptop's operating system. This allows the analyst to confirm if the VPN session originated from the assigned corporate device or from an unmanaged device using stolen credentials.

Exam trap

The SY0-701 exam often tests the misconception that VPN concentrator logs alone can identify the device type, but they only show authentication and external IP, not whether the session originated from the assigned managed laptop.

How to eliminate wrong answers

Option A is wrong because VPN concentrator logs only show the external IP address and authentication details, not whether the session came from the user's assigned laptop or an unmanaged device—they lack device-level identifiers like hostname or EDR agent presence. Option C is wrong because DNS query logs from the internal resolver only show domain name resolution requests, not the source device identity or VPN client origin, so they cannot differentiate between a managed and unmanaged device.

Full explanation →

535

MCQmedium

A VPN concentrator shows that an authentication request from a user was accepted twice, even though the user insists they approved only one login. Packet analysis reveals that the second successful attempt reused the same authentication blob and arrived shortly after the first. Which attack is the best fit?

A.Replay attack, because a captured valid authentication message was resent to gain access again.

B.ARP poisoning, because the attacker redirected traffic by altering local address resolution.

C.Phishing, because the user was tricked into entering credentials on a fake page.

D.Denial of service, because the attacker is overwhelming the VPN gateway with requests.

AnswerA

A replay attack succeeds because the attacker intercepts a legitimate authentication message—such as a RADIUS Access-Request or an IKEv2 authentication payload—and later retransmits the exact same datagram to the VPN concentrator. Since the message is cryptographically valid and the server did not enforce a fresh nonce, timestamp, or one-time challenge, the expected behavior is to accept it and establish a session. The attacker never needs to decrypt or forge anything; the captured blob is simply replayed, which directly explains the observed repeated acceptance of the same authentication request.

Why this answer

The scenario describes a captured authentication blob being reused to gain a second successful authentication. This is the hallmark of a replay attack, where an attacker intercepts a valid authentication message (e.g., a Kerberos TGT, RADIUS Access-Accept, or a VPN pre-shared key hash) and retransmits it to the VPN concentrator to impersonate the user. The VPN concentrator accepted the duplicate because it lacked proper replay protection mechanisms such as timestamps, sequence numbers, or one-time-use nonces.

Exam trap

The trap here is confusing a replay attack with a phishing attack, because both involve capturing authentication data, but replay attacks reuse the captured blob directly without tricking the user, while phishing requires the user to voluntarily submit credentials.

How to eliminate wrong answers

Option B is wrong because ARP poisoning involves manipulating ARP tables to redirect traffic on a local network, not reusing an authentication blob to bypass VPN authentication. Option C is wrong because phishing tricks a user into revealing credentials on a fake page, but here the attacker reused a captured authentication blob without needing the user's credentials. Option D is wrong because a denial of service attack aims to overwhelm the VPN gateway with requests to disrupt service, not to gain unauthorized access by replaying a single authentication message.

Full explanation →

536

Multi-Selectmedium

A SOC analyst reviews an EDR alert on a finance workstation. The alert shows powershell.exe launched with an encoded command, downloaded a payload into memory, and then spawned rundll32.exe. No new executable was written to disk, but the process later created a scheduled task for persistence. Which two findings most strongly support a fileless attack? Select two.

Select 2 answers

A.powershell.exe launched with an encoded command and executed the payload in memory

B.rundll32.exe was spawned by a script-based process during the attack chain

C.a new portable executable was written to the user's temporary folder before being run

D.the endpoint antivirus quarantined the payload after a signature match

E.a USB storage device was inserted shortly before the alert fired

AnswersA, B

Encoded PowerShell is a common fileless technique because the malicious instructions can be hidden inside a command line and run directly in memory. This reduces obvious disk artifacts and can bypass simple file-based detection. In a Security+ scenario, that combination strongly suggests living-off-the-land abuse rather than a traditional dropped executable.

Why this answer

Executing a PowerShell encoded command that downloads and runs a payload entirely in memory, without writing to disk, is a hallmark of fileless malware. This technique avoids traditional file-based detection by leveraging PowerShell's ability to load and execute scripts directly in memory, bypassing disk-based antivirus scans.

Exam trap

The trap here is that candidates may confuse fileless attacks with any attack that uses PowerShell or scripting, but the key distinction is the absence of writing any executable to disk, which is why options involving disk writes or signature-based quarantine are distractors.

Full explanation →

537

MCQmedium

A security team downloads a software update package signed by the vendor. The team verifies the signature using the vendor's public key before approving deployment. What does this verification primarily confirm?

A.The package can only be decrypted by the vendor's private key

B.The package was likely created by the vendor and was not altered after signing

C.The package is encrypted with the vendor's public key

D.The vendor's certificate has not expired

AnswerB

Digital signature verification checks that the signed data matches what the signer produced and that the signer controlled the corresponding private key. This gives the team confidence in authenticity and integrity. If the file had been modified after signing, verification would fail. That is why signatures are commonly used for software updates and trusted releases.

Why this answer

Digital signature verification using the vendor's public key confirms that the package was signed with the vendor's private key, which only the vendor possesses. This provides authentication of the signer's identity and integrity of the data, ensuring the package has not been modified since signing. It does not provide confidentiality, as the package itself is not encrypted.

Exam trap

The trap here is confusing digital signatures with encryption: candidates often think the public key decrypts the package itself, when in fact it only decrypts the hash, and the package remains unencrypted.

How to eliminate wrong answers

Option A is wrong because digital signatures do not involve decryption of the package; the signature is verified, not the package content. The vendor's private key is used to create the signature, not to decrypt the package. Option C is wrong because the package is not encrypted with the vendor's public key; the signature is created with the vendor's private key, and verification uses the vendor's public key.

Encryption with a public key would provide confidentiality, which is not the purpose of a digital signature.

Full explanation →

538

MCQeasy

A user's laptop suddenly starts renaming many files and showing a ransom note. The laptop is still connected to Wi-Fi. What is the best immediate action?

A.Reboot the laptop to stop the malicious process.

B.Disconnect the laptop from the network immediately.

C.Delete the ransom note and continue working.

D.Change the user's password and wait for more details.

AnswerB

Disconnecting the laptop from the network is the correct immediate action because most ransomware variants actively scan for and encrypt network shares, mapped drives, and adjacent hosts the moment they execute. Cutting the Ethernet cable or disabling Wi-Fi halts lateral movement, prevents the encryption of remote files, and helps preserve the integrity of the evidence for later analysis. This containment step also stops any command-and-control communication that might allow the attacker to escalate access or exfiltrate data.

Why this answer

Ransomware actively encrypts files and may communicate with a command-and-control (C2) server over the network to exfiltrate data or receive encryption keys. Disconnecting the Wi-Fi immediately stops further C2 communication, prevents lateral movement to other devices, and halts any ongoing data exfiltration. This containment step is critical before any remediation like system imaging or forensic analysis.

Exam trap

The trap here is that candidates may think rebooting (Option A) will stop the malicious process, but ransomware often persists across reboots via registry run keys or scheduled tasks, and the immediate priority is containment by disconnecting the network.

How to eliminate wrong answers

Option A is wrong because rebooting the laptop may allow the ransomware to continue its encryption process on startup or trigger additional payloads, and it does not stop network-based propagation or C2 communication. Option C is wrong because deleting the ransom note does not reverse file encryption or stop the malicious process; the ransomware remains active and can continue encrypting or spreading. Option D is wrong because changing the user's password does not affect the running ransomware process, and waiting for more details allows the attack to progress, potentially encrypting more files or spreading to other systems.

Full explanation →

539

MCQhard

A software development company is moving its CI/CD pipeline to a cloud environment. The security team wants to ensure that only authorized code can be deployed to production. They require that each build artifact be cryptographically signed, and that the signature be verified before deployment. Which of the following should be implemented to achieve this?

A.Static application security testing (SAST) integrated into the build process.

B.Multi-factor authentication (MFA) for developers accessing the CI/CD system.

C.Role-based access control (RBAC) for the artifact repository.

D.Code signing with a hardware security module (HSM) and signature verification in the deployment pipeline.

AnswerD

Code signing with an HSM ensures that build artifacts are signed with a protected private key, and signature verification in the deployment pipeline confirms authenticity and integrity before deployment. This directly meets the requirement that only authorized code can be deployed. The HSM protects the signing key from compromise, and verification prevents tampered or unauthorized artifacts from reaching production.

Why this answer

The correct answer is code signing with an HSM and signature verification in the deployment pipeline. This ensures that only artifacts signed with the protected private key are deployed, providing cryptographic assurance of authenticity and integrity. The other options improve security but do not implement the required signing and verification mechanism.

Exam trap

The trap here is assuming that access controls or code analysis alone can ensure only authorized code is deployed, when cryptographic signing and verification are specifically required.

Full explanation →

540

MCQmedium

A security analyst is reviewing the source code of a custom web application. The application receives JSON data from users, which includes a 'type' field. The application uses the 'type' field to determine which Java class to instantiate, and then calls a method on that object. The application does not validate or sanitize the 'type' field. An attacker sends a crafted JSON payload that causes the application to instantiate an unexpected class, leading to remote code execution. Which type of vulnerability does this example describe?

A.SQL injection

B.Cross-site scripting (XSS)

C.Insecure deserialization

D.Directory traversal

AnswerC

Correct. Insecure deserialization occurs when an application deserializes untrusted data, allowing an attacker to control serialized objects or, as in this case, the class name to be instantiated. This can lead to remote code execution, denial of service, or privilege escalation.

Why this answer

The application deserializes untrusted JSON data and uses the 'type' field to dynamically instantiate a Java class without validation. This is a classic insecure deserialization vulnerability, where an attacker can supply a malicious class name (e.g., a gadget class like `Runtime` or a custom class) that, when instantiated and its method called, executes arbitrary code on the server. The lack of input sanitization on the 'type' field directly enables remote code execution via object instantiation.

Exam trap

The trap here is that candidates may confuse insecure deserialization with injection attacks (SQLi or XSS) because the attacker is 'injecting' a class name, but the core mechanism is the unsafe deserialization of untrusted data to instantiate objects, not injecting code into a query or script context.

Why the other options are wrong

The vulnerability involves instantiating arbitrary Java classes from user-controlled JSON data, which is a classic insecure deserialization flaw, not SQL injection, as no database queries are involved.

The vulnerability involves instantiation of arbitrary Java classes from user-supplied type field, leading to remote code execution, which is classic insecure deserialization. Cross-site scripting (XSS) involves injecting malicious scripts into web pages viewed by other users, not server-side object instantiation.

Directory traversal involves manipulating file paths to access unauthorized files, not instantiating arbitrary classes from user input. The vulnerability here is about insecure deserialization, where untrusted data controls object instantiation.

When would these options actually be correct?

A web application takes user input and directly concatenates it into a SQL query without sanitization, allowing an attacker to manipulate the query to access or modify database data.

A web application reflects user input in HTML output without proper encoding. An attacker submits a script in a comment field, and when other users view the comment, the script executes in their browsers, stealing session cookies. This is a stored XSS vulnerability.

A web application takes a filename parameter from user input and uses it to read a file without proper validation, allowing an attacker to use '../' sequences to read files outside the intended directory, such as /etc/passwd.

Why candidates pick the wrong answer

Candidates may confuse any injection-style vulnerability with SQL injection, especially when the attack involves crafted input leading to unintended behavior.

Candidates may confuse any input-based attack with XSS, especially when the description involves user-supplied data leading to code execution, but XSS is client-side script execution, not server-side code execution via object instantiation.

Candidates may confuse the concept of 'type' field controlling class instantiation with file path manipulation, or they might think any injection that leads to code execution is a directory traversal.

Full explanation →

541

MCQmedium

An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domain the company does not use. The pattern repeats every 60 seconds, even when normal web traffic is idle. What is the best interpretation and next step?

A.This is normal DNS behavior, so no action is needed unless users report an outage.

B.Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.

C.Rotate the DNS server’s administrator password and leave the web server online.

D.Assume the web server is performing routine certificate renewal checks and ignore the alert.

AnswerB

Regular outbound DNS queries to random subdomains can indicate tunneling or command-and-control traffic. The fact that it repeats at a fixed interval strengthens that suspicion. The best next step is to contain the host so the activity cannot continue, while preserving logs and packet captures for investigation. This lets the team determine whether malware, a rogue process, or a misconfiguration is responsible without losing evidence.

Why this answer

The small, periodic DNS queries to random-looking subdomains under an unused domain are a classic indicator of DNS-based command-and-control (C2) communication. Attackers often use DNS tunneling to exfiltrate data or send commands, as DNS traffic is typically allowed through firewalls. The fact that the pattern persists even during idle web traffic confirms it is not related to normal server operations, making isolation and forensic collection the appropriate next step.

Exam trap

The trap here is that candidates may mistake periodic DNS queries for legitimate maintenance traffic (like certificate renewal or NTP sync) and overlook the key indicator of random-looking subdomains under an unused domain, which is a hallmark of DNS tunneling for C2.

How to eliminate wrong answers

Option A is wrong because periodic DNS queries to random subdomains under an unused domain are not normal DNS behavior; legitimate DNS queries are typically for known, resolvable domains and do not exhibit a consistent 60-second pattern during idle periods. Option C is wrong because rotating the DNS server's administrator password does not address the compromised web server's outbound C2 traffic; the server itself must be isolated and investigated. Option D is wrong because certificate renewal checks use well-known domains (e.g., from a Certificate Authority) and do not involve random-looking subdomains under an unused domain; ignoring the alert could allow persistent C2 activity to continue.

Full explanation →

542

MCQmedium

A remote user's laptop begins launching a legitimate-looking "System Update" application at login. After the update window appears, the browser homepage changes, outbound traffic increases, and the user later reports that saved passwords are being used in unauthorized logins. Which malware type is the most likely primary infection?

A.Worm, because it is spreading automatically to nearby systems on the network.

B.Trojan, because it is disguised as a harmless utility while delivering malicious payloads.

C.Ransomware, because files would be encrypted and a payment demand would appear.

D.Rootkit, because the malware is hiding its own presence by modifying kernel behavior.

AnswerB

A trojan is malicious software that disguises itself as a legitimate program, such as a software update or utility, to trick a user into installing it. Once executed, it can carry out hidden actions like credential theft, establishing persistence, or downloading additional payloads, which aligns with the observed fake updater and browser modifications. The user's voluntary execution of the seemingly harmless file is the key vector, distinguishing it from other malware types.

Why this answer

The malware is disguised as a legitimate 'System Update' application, which is the classic behavior of a Trojan. Trojans rely on social engineering to trick users into executing them, and once activated, they can deliver secondary payloads such as password stealers, browser hijackers, or backdoors. In this scenario, the Trojan likely installed a keylogger or credential harvester to exfiltrate saved passwords, changed browser settings via registry or configuration file manipulation, and increased outbound traffic to a command-and-control (C2) server.

Exam trap

The trap here is that candidates may confuse the visible symptoms (browser change, increased traffic) with a worm's network propagation or a rootkit's stealth, but the key indicator is the social engineering disguise of the 'System Update' application, which is the hallmark of a Trojan.

How to eliminate wrong answers

Option A is wrong because a worm spreads autonomously across networks without user interaction, often exploiting vulnerabilities like SMB or RDP, whereas this infection required the user to execute the fake update at login. Option C is wrong because ransomware typically encrypts files and displays a ransom note, but the symptoms here (browser homepage change, increased traffic, stolen passwords) indicate data theft and persistence, not file encryption. Option D is wrong because a rootkit hides its presence by modifying kernel or system call tables (e.g., SSDT hooking), but the described behavior involves visible changes (homepage alteration, password theft) and no mention of stealth or kernel-level concealment.

Full explanation →

543

MCQmedium

EDR detects encoded PowerShell launched from a word processor, a process attempt to read LSASS memory, and an outbound HTTPS connection to a rare domain. What should the analyst do first?

A.Isolate the endpoint from the network while keeping it powered on for investigation.

B.Delete the user's profile to stop the malicious process immediately.

C.Patch the word processor before reviewing any alerts or logs.

D.Reboot the system immediately to clear anything running in memory.

AnswerA

This is the correct first action because the host shows clear signs of active compromise and possible credential theft. Network isolation limits further spread and command-and-control activity, while leaving the system powered on preserves volatile evidence for later analysis. That balance supports both containment and investigation, which is the right sequence when EDR indicates live malicious behavior.

Why this answer

The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the endpoint preserves forensic evidence in memory and disk while preventing further data exfiltration or lateral movement, which is the immediate containment priority per incident response best practices.

Exam trap

The trap here is that candidates may choose reboot (D) thinking it clears malware, but CompTIA emphasizes preserving evidence and containing the threat first, as rebooting destroys volatile data needed for forensic analysis.

How to eliminate wrong answers

Option B is wrong because deleting the user profile destroys volatile evidence (e.g., process memory, registry artifacts) and may not stop a process running in system context. Option C is wrong because patching the word processor is a long-term remediation step, not an immediate response to an active compromise. Option D is wrong because rebooting clears memory-resident malware and forensic artifacts, potentially losing critical evidence of the attack chain.

Full explanation →

544

Matchingmedium

Match each business scenario to the most appropriate risk treatment. 1. A legacy reporting server is expensive to replace, and leadership is willing to monitor the low expected loss for now. 2. A public web portal is being hit by credential stuffing, so the team adds MFA and rate limiting. 3. The organization wants protection from a costly third-party outage by purchasing cyber insurance. 4. A proposed project would collect regulated data that the business has decided not to process at all.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Mitigate

Transfer

Avoid

Why these pairings

Risk acceptance acknowledges the risk without action; mitigation reduces risk via controls; transfer shifts risk to insurance; avoidance eliminates the risk activity; reduction and sharing are related but less direct matches to the scenarios.

Full explanation →

545

Multi-Selecthard

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Select 2 answers

A.Require administrators to connect to a bastion host or jump server before reaching the Linux servers.

B.Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

C.Restrict management interfaces so only the bastion host can reach them and log each session.

D.Expose SSH to the internet because key-based authentication is already strong.

E.Use split tunneling for admin traffic so management packets can bypass the VPN.

AnswersA, C

A bastion host is a hardened choke point for privileged access, so all administrative sessions can be concentrated, filtered, and monitored. It prevents direct SSH exposure from general user systems and gives the security team a single place to enforce logging and session control. This is a common hardened management-path pattern.

Why this answer

A bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.

Exam trap

The trap here is that candidates often think MFA alone (Option B) is sufficient to secure direct access, but the question specifically requires reducing lateral movement and logging sessions, which only a bastion host with restricted access (Option A and C) can fully achieve.

Full explanation →

546

MCQeasy

A company runs a Linux virtual machine in an IaaS cloud service. The provider secures the physical datacenter and hypervisor. Which task remains the company's responsibility?

A.Patching the guest operating system on the virtual machine.

B.Replacing failed physical storage drives in the provider's data center.

C.Hardening the hypervisor that hosts the cloud tenant.

D.Controlling badge access to the cloud vendor's server room.

AnswerA

In an IaaS model, the organization still manages what runs inside the VM, including the guest operating system, patches, applications, and configuration. The cloud provider secures the underlying facility, hardware, and hypervisor, but it does not maintain the customer's OS or application stack. Keeping the guest OS patched is essential to reduce exposure to known vulnerabilities and aligns with the shared responsibility model.

Why this answer

In an IaaS cloud model, the provider is responsible for the physical infrastructure, including the datacenter, network, storage, and hypervisor. The customer retains responsibility for securing the guest operating system, including applying patches and updates. Patching the guest OS is a shared responsibility that falls squarely on the company operating the virtual machine.

Exam trap

The trap here is that candidates often confuse the shared responsibility model and assume the cloud provider handles all security tasks, including guest OS patching, when in fact the customer is responsible for anything above the hypervisor.

How to eliminate wrong answers

Option B is wrong because replacing failed physical storage drives is the responsibility of the cloud provider, who manages the underlying hardware in the datacenter. Option C is wrong because hardening the hypervisor is also the provider's responsibility, as the hypervisor is part of the virtualization layer that the customer does not have administrative access to.

Full explanation →

547

MCQeasy

A company launches a new HTTPS portal. Users should be able to confirm the site is really the company's portal and not a fake copy. Which control provides that trust?

A.A self-signed certificate installed only on user laptops

B.A TLS certificate issued by a trusted certificate authority

C.A SHA-256 checksum posted on the login page

D.A shared password embedded in the page source

AnswerB

A TLS certificate from a trusted certificate authority binds the portal's public key to its hostname, letting browsers verify authenticity and detect impostor copies. This satisfies the requirement that users confirm the site genuinely belongs to the company.

Why this answer

A TLS certificate issued by a trusted certificate authority (CA) provides the trust needed because browsers and operating systems maintain a root store of trusted CAs. When a user visits the HTTPS portal, the server presents a certificate signed by that CA, and the browser cryptographically verifies the signature chain back to a trusted root. This ensures the public key belongs to the claimed domain, authenticating the server and preventing impersonation by a fake copy.

Exam trap

The trap here is that candidates confuse integrity checks (like SHA-256 checksums) with authentication mechanisms, or they think a self-signed certificate can be trusted if installed locally, but in practice, self-signed certificates lack the third-party validation needed to prevent man-in-the-middle attacks on a public-facing portal.

How to eliminate wrong answers

Option A is wrong because a self-signed certificate is not trusted by default by browsers or operating systems; it would generate a security warning and does not provide any third-party validation of the server's identity, so users cannot reliably confirm the site is genuine. Option C is wrong because a SHA-256 checksum posted on the login page can be easily modified by an attacker who controls the fake site, and it provides no cryptographic binding to the server's identity or domain; checksums are used for file integrity, not server authentication.

Full explanation →

548

MCQhard

Based on the exhibit, what is the best next step before the hotfix is released?

A.Deploy immediately because the issue is customer-facing and urgent.

B.Close the ticket after deployment and create a postmortem if users complain.

C.Ask support to warn users that sign-in may fail during the next hour.

D.Pause release until the change is formally approved, tested, and has a documented rollback path.

AnswerD

The exhibit shows multiple process gaps: skipped tests, unresolved integration test failure, no documented rollback plan, and only verbal approval. Even an emergency fix should follow an emergency change process with documented authorization and enough validation to reduce the chance of making the outage worse. The safest next step is to complete the required change controls before production deployment.

Why this answer

Releasing a hotfix without formal approval, testing, and a documented rollback path violates the change management policy required by security program management. Even for urgent customer-facing issues, skipping these steps risks introducing new vulnerabilities or breaking other systems, which could lead to a larger outage. The exhibit indicates a need for controlled change processes, so pausing until the change is properly vetted ensures stability and security.

Exam trap

The trap here is that candidates may prioritize speed over security, assuming that a customer-facing issue justifies skipping change management, but the exam emphasizes that formal approval and testing are non-negotiable even for urgent fixes.

How to eliminate wrong answers

Option A is wrong because deploying immediately without testing or approval bypasses change management controls, potentially causing unintended side effects or security gaps. Option B is wrong because closing the ticket after deployment and only creating a postmortem if users complain ignores proactive risk management and fails to document the change properly, which is a key oversight in security program management. Option C is wrong because asking support to warn users is a temporary workaround that does not address the root cause or ensure the fix is safe; it also lacks the formal approval and testing required for a hotfix.

Full explanation →

549

MCQmedium

A customer portal must keep operating if one application server fails. Management wants the simplest and lowest-cost design that still improves availability. What should the team implement?

A.Add more backups and schedule them every hour.

B.Use a second data center with synchronous replication and active-active clustering.

C.Deploy a hot standby application server with automatic failover.

D.Restart the failed server manually after the help desk is notified.

AnswerC

A hot standby provides a ready replacement if the primary application server fails, and automatic failover restores service without waiting for manual intervention. This design improves availability while staying simpler and less costly than a full active-active architecture across multiple sites. It matches the business need for continuity after one server failure without overengineering the solution.

Why this answer

A hot standby (active/passive) application server with automatic failover provides the simplest and lowest-cost improvement to availability. It eliminates the single point of failure by having a standby server ready to take over if the primary fails, without requiring complex load balancing or synchronous replication. This design directly addresses the requirement of keeping the portal operational during a single server failure while minimizing cost and complexity.

Exam trap

The trap here is that candidates often confuse high availability with disaster recovery, choosing synchronous replication and a second data center (Option B) when a simpler active/passive failover within the same site meets the requirement at lower cost.

How to eliminate wrong answers

Option A is wrong because increasing backup frequency does not improve availability; backups protect against data loss, not server failure, and the portal would still be unavailable until restored from backup. Option B is wrong because a second data center with synchronous replication and active-active clustering is significantly more complex and expensive, involving geographic redundancy, network latency management, and load balancing, which exceeds the 'simplest and lowest-cost' requirement.

Full explanation →

550

MCQhard

Based on the exhibit, what best describes the additional measures applied to the legacy system?

A.Preventive controls, because they stop every possible compromise completely.

B.Compensating controls, because they reduce risk when the preferred security controls are not possible.

C.Corrective controls, because they repair the controller after an incident occurs.

D.Deterrent controls, because they mainly scare attackers away from trying.

AnswerB

Compensating controls are the best description because the system cannot support MFA or modern encryption, yet the organization still needs to reduce risk until replacement. The VLAN, ACLs, jump host, and session recording provide alternate safeguards that help offset the missing native controls.

Why this answer

The exhibit shows a legacy system that cannot support modern authentication protocols like Kerberos or NTLMv2. The additional measures—such as network segmentation, strict firewall rules, and an application-layer gateway—are compensating controls. They reduce risk by enforcing security in the network layer since the preferred control (upgrading the OS or application to support strong authentication) is not feasible.

Exam trap

CompTIA often tests the distinction between compensating controls and preventive controls by describing a scenario where the ideal control is impossible, and candidates mistakenly choose 'preventive' because the compensating control still blocks some attacks.

How to eliminate wrong answers

Option A is wrong because preventive controls aim to stop threats, but no control can 'stop every possible compromise completely'; the measures described are not absolute and are applied because the ideal preventive control (e.g., patching the legacy system) is unavailable. Option C is wrong because corrective controls operate after an incident to restore operations (e.g., restoring from backup), whereas the measures here are proactive and in place before any incident occurs. Option D is wrong because deterrent controls rely on psychological discouragement (e.g., warning banners), not on technical enforcement like segmentation and firewalls; the described measures actively block or restrict traffic, not merely scare attackers.

Full explanation →

551

MCQmedium

A system administrator downloads a vendor patch package and a separate checksum file. After the download completes, the administrator runs a command that produces a SHA-256 value for the package and compares it to the vendor's published value. Which cryptographic primitive is being used for the comparison?

A.Hashing

B.Symmetric encryption

C.Digital signatures

D.Asymmetric encryption

AnswerA

Hashing creates a fixed-length digest from data so the receiver can compare values and detect changes. In this scenario, the administrator is generating a SHA-256 result and comparing it to the vendor's published value to confirm the package has not changed. That use case is about integrity verification rather than encryption or identity proof.

Why this answer

The administrator is using SHA-256 to compute a fixed-length digest of the downloaded package and comparing it to the vendor's published checksum. This is a classic application of a cryptographic hash function (hashing), which produces a unique, irreversible fingerprint of data. The comparison verifies integrity—ensuring the package has not been altered during transit—but does not provide authentication or non-repudiation.

Exam trap

The trap here is that candidates confuse integrity verification via hashing with authentication provided by digital signatures, especially when the question mentions a 'vendor' and 'comparison'—leading them to incorrectly choose digital signatures (Option C) even though no signature verification is performed.

How to eliminate wrong answers

Option B (Symmetric encryption) is wrong because it uses a shared secret key to encrypt and decrypt data, not to produce a fixed-length digest for integrity verification. Option C (Digital signatures) is wrong because they combine hashing with asymmetric encryption to provide authentication and non-repudiation, but the scenario only describes comparing a hash value, not verifying a signature with a public key. Option D (Asymmetric encryption) is wrong because it uses a public/private key pair for encryption or key exchange, not for generating a checksum to compare against a published value.

Full explanation →

552

MCQhard

Based on the exhibit, what is the BEST remediation for the application flaw shown? A user-controlled parameter is being passed to a shell command on the server. The application is intended to test connectivity to approved internal hosts only.

A.Keep the current shell command, but add HTML encoding to the response page.

B.Replace the shell call with a safe library function and strictly allowlist approved host values.

C.Increase the web server timeout so the ping utility has more time to complete.

D.Require users to authenticate before they can access the page.

AnswerB

Substituting the raw shell call with a safe library function, such as using subprocess.run() with a list argument and shell=False, ensures the input is passed as data rather than interpreted by a shell. An allowlist of approved host values then blocks any string that does not match an expected pattern, so an attacker cannot inject metacharacters like ';', '|', or '&&' into the command. This directly eliminates both the injection vector and the attack surface by combining parameterized execution with strict input validation.

Why this answer

The application flaw is command injection: a user-controlled parameter is passed directly to a shell command (e.g., `ping`). The best remediation is to replace the shell call with a safe library function (e.g., `InetAddress.isReachable()` in Java or a dedicated ICMP library) and strictly allowlist approved internal host values, eliminating the possibility of injecting arbitrary commands like `; rm -rf /`.

Exam trap

The trap here is that candidates often confuse command injection with cross-site scripting (XSS) and choose HTML encoding (Option A), or they mistakenly think authentication (Option D) or timeout adjustments (Option C) can fix a code-level injection vulnerability.

How to eliminate wrong answers

Option A is wrong because HTML encoding the response does not prevent the shell command from executing with malicious input; it only mitigates reflected XSS, not command injection. Option C is wrong because increasing the web server timeout does not address the injection vulnerability; it only changes the execution window for the ping utility, leaving the flaw exploitable. Option D is wrong because requiring authentication does not prevent an authenticated user from injecting commands; it only adds a login gate, not input validation or safe execution.

Full explanation →

553

MCQeasy

A small company wants all employees to lock their screens after 10 minutes of inactivity, and the rule is included in the formal security policy. What type of control is this?

A.Detective control, because it discovers misuse after it happens.

B.Directive control, because it tells users what behavior is required.

C.Corrective control, because it repairs damage after an incident.

D.Compensating control, because it replaces a missing technical safeguard.

AnswerB

A directive control is an authoritative instruction that defines required behavior, often implemented through corporate policy, standards, or acceptable-use agreements. Mandating that all employees lock their screens when leaving workstations is exactly this type of guidance, as it establishes a behavioral expectation and provides the basis for accountability. It does not physically enforce the action, but it directs users and management on the required practice.

Why this answer

A directive control is designed to guide or mandate user behavior through policies or procedures. In this case, the security policy explicitly requires employees to lock their screens after 10 minutes of inactivity, which is a directive that tells users what they must do. This is a procedural control, not a technical enforcement mechanism, so it falls under directive controls.

Exam trap

The trap here is confusing a directive control (policy-based) with a preventive control (technical enforcement); candidates often pick a wrong option because they assume the policy itself enforces the lock, but the question states the rule is 'included in the formal security policy,' not implemented via a technical mechanism.

How to eliminate wrong answers

Option A is wrong because a detective control identifies or logs misuse after it occurs (e.g., audit logs or intrusion detection), but the policy itself does not detect anything—it only states a required behavior. Option C is wrong because a corrective control is applied after an incident to restore normal operations (e.g., backup restoration or patching), not to prevent or mandate behavior. Option D is wrong because a compensating control is an alternative safeguard used when a primary control cannot be implemented (e.g., using multi-factor authentication when smart cards are unavailable), but here the policy is the primary control, not a replacement for a missing technical safeguard.

Full explanation →

554

Drag & Dropmedium

Drag and drop the steps to perform a password reset for a user in Active Directory into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Password reset in AD is done via ADUC; the admin must have appropriate permissions, and it's good practice to enforce change at next logon.

Full explanation →

555

MCQmedium

A SaaS vendor supports both browser access and a mobile app. The company wants employees to sign in with corporate credentials, avoid separate passwords for each app, and use token-based authentication that works well with modern APIs. Which integration should the architect choose?

A.SAML federation to the SaaS vendor using browser assertions only.

B.OpenID Connect federation with the corporate identity provider.

C.LDAP bind authentication directly against each SaaS application.

D.Kerberos tickets issued directly by the SaaS vendor.

AnswerB

OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that returns a signed JWT ID token and an access token, enabling both user authentication and API authorization. It works natively across browsers via authorization code flow and mobile apps via PKCE, so it cleanly covers the SaaS vendor's dual access modes. Since OIDC federates with a corporate identity provider, users get seamless SSO while the mobile app securely obtains tokens without exposing passwords.

Why this answer

OpenID Connect (OIDC) is the correct choice because it is an identity layer built on top of OAuth 2.0, designed for token-based authentication that works seamlessly with modern REST APIs and mobile apps. It allows employees to sign in with corporate credentials via the corporate identity provider (IdP), eliminates separate app passwords, and issues ID tokens (JWT) and access tokens that the SaaS vendor can validate without browser redirects.

Exam trap

The trap here is that candidates often confuse SAML (which is browser-based) with OpenID Connect, assuming SAML can handle mobile apps and API tokens just as easily, but SAML lacks native support for token-based API authentication without complex extensions.

How to eliminate wrong answers

Option A is wrong because SAML federation using browser assertions only works well for web-based access but does not natively support mobile apps or token-based API authentication without additional extensions like SAML Bearer Assertion for OAuth 2.0, making it less suitable for modern API-driven scenarios. Option C is wrong because LDAP bind authentication requires direct network connectivity to the corporate directory, exposes credentials to each SaaS application, and does not provide token-based authentication or single sign-on across apps. Option D is wrong because Kerberos tickets are designed for on-premises Windows environments and require the SaaS vendor to be part of the same Kerberos realm, which is impractical for cloud-based SaaS; they also do not integrate with modern REST APIs or token-based flows.

Full explanation →

556

MCQeasy

A company uses an encryption key for a database backup process. The key is being replaced because the old one is near the end of its approved use period. What is this action called?

A.Key rotation, because an older key is replaced with a new one on schedule.

B.Key compression, because the key is made smaller before use.

C.Key translation, because the key is converted into another language.

D.Key formatting, because the key is stored in a different file type.

AnswerA

Key rotation is the planned replacement of cryptographic keys over time. Rotating keys reduces exposure if a key is mishandled, limits the amount of data protected by any one key, and supports good key lifecycle management.

Why this answer

Key rotation is the scheduled replacement of an older encryption key with a new one, typically performed before the end of the key's cryptoperiod to maintain security and compliance. In this scenario, the database backup key is being replaced because it is near the end of its approved use period, which directly matches the definition of key rotation. This practice limits the amount of data encrypted with a single key and reduces the impact of a potential key compromise.

Exam trap

The trap here is that candidates may confuse key rotation with other key management terms like key escrow or key archival, or incorrectly assume that 'rotation' implies a physical or mechanical action rather than a cryptographic lifecycle process.

How to eliminate wrong answers

Option B is wrong because key compression is not a standard cryptographic operation; keys are not compressed before use, and compression would not address the end of a key's approved use period. Option C is wrong because key translation refers to converting a key from one format or domain to another (e.g., in a key management system or HSM), not replacing an expiring key. Option D is wrong because key formatting is not a recognized term for key lifecycle management; changing a key's file type does not constitute a scheduled replacement.

Full explanation →

557

MCQhard

Based on the exhibit, which issue should be remediated first by the operations team? A small company has limited maintenance windows and can address only one of several findings this week.

A.db-lab02, because high-severity findings always outrank medium and critical findings.

B.printsrv03, because it is internet-facing and has no vendor patch available.

C.vpn-gw01, because it is internet-facing, exploitable now, and a fix is available.

D.None of these, because the team should wait for the next quarterly review before changing anything.

AnswerC

The VPN gateway is the most urgent issue because it is externally reachable, has a critical remote code execution flaw, and a vendor patch already exists. That combination creates high likelihood and high impact. The reboot requirement is inconvenient, but it is still the most actionable and dangerous finding. The other issues are either isolated from production or partially mitigated by compensating controls.

Why this answer

Vpn-gw01 is internet-facing, has an active exploit (CVSS score indicating current exploitation), and a vendor patch is available. In risk management, the highest priority is given to assets that are exposed to the internet, currently exploitable, and have a known fix, as this combination presents the most urgent threat to the organization's security posture.

Exam trap

The trap here is that candidates often assume severity (e.g., critical vs. high) is the sole determinant of remediation priority, ignoring the critical factors of internet exposure, exploitability, and patch availability that CompTIA emphasizes in risk management scenarios.

How to eliminate wrong answers

Option A is wrong because it incorrectly states that high-severity findings always outrank medium and critical findings; severity is only one factor in prioritization, and internet exposure, exploitability, and patch availability are equally important. Option B is wrong because printsrv03, while internet-facing with no vendor patch, does not have an active exploit, making it less urgent than an asset that is currently exploitable. Option D is wrong because waiting for the next quarterly review would leave a known, exploitable vulnerability unpatched, violating the principle of timely remediation for critical risks.

Full explanation →

558

MCQmedium

A security analyst is reviewing web server logs after a user reports that the company website displayed an error message containing raw database queries. The log shows repeated requests to the product search page with the following parameter: `?id=1 OR 1=1`. Which of the following should the analyst do FIRST to confirm the nature of the suspected attack?

A.Run a vulnerability scan against the web server.

B.Block the source IP address in the firewall.

C.Verify the request details against the web application firewall logs.

D.Isolate the web server from the network immediately.

AnswerC

Checking the WAF logs is the authoritative first step because they contain the full HTTP transaction metadata, including headers, request body, and the WAF's decision (e.g., rule match, blocked, or allowed). By correlating the web server access log timestamps and request IDs with WAF events, the analyst can definitively confirm whether the SQLi payload was actually blocked or reached the application. This evidence-based verification determines the incident scope and prevents wasting time on false positives. Without this correlation, any further action—including containment or scanning—could be based on an unverified assumption that the attack succeeded.

Why this answer

The analyst should first verify the request details against the web application firewall (WAF) logs to confirm whether the WAF detected and blocked the SQL injection attempt. The parameter `?id=1 OR 1=1` is a classic SQL injection payload, and WAF logs provide immediate evidence of whether the request was flagged, allowed, or blocked, enabling the analyst to correlate the user's report with actual security controls before taking further action.

Exam trap

The trap here is that candidates may jump to containment (blocking or isolating) or scanning without first using existing logs to confirm the attack, failing to follow the incident response principle of 'verify before act'.

Why the other options are wrong

Running a vulnerability scan is a secondary step after confirming the attack; the analyst first needs to verify the request details in the WAF logs to determine if the attack was blocked or reached the server.

Blocking the source IP address in the firewall is a reactive measure that does not confirm the nature of the attack; it only prevents further requests from that IP. The analyst needs to first verify the attack type by correlating logs with the WAF.

Isolating the web server immediately is premature because the analyst has not yet confirmed the nature of the attack. The log entry suggests a SQL injection attempt, but the first step should be to verify the attack using WAF logs, not to take drastic containment actions that could disrupt services.

When would these options actually be correct?

A vulnerability scan would be the correct first step when the question states that the analyst needs to proactively identify all potential vulnerabilities in the web application before any attack is reported, such as during a routine security assessment.

A question where the analyst has already confirmed a SQL injection attack and needs to immediately stop the attack from a specific IP while preserving evidence. For example: 'After confirming a SQL injection attack in progress, which action should the analyst take FIRST to mitigate the immediate threat?'

A question where the web server is actively being exploited (e.g., showing signs of data exfiltration or ransomware) and the analyst must contain the threat immediately to prevent further damage. For example: 'An IDS alerts on outbound database traffic from the web server; what should the analyst do FIRST?'

Why candidates pick the wrong answer

Candidates may think a vulnerability scan is the standard first step for any security issue, but in this incident response scenario, confirming the attack details takes precedence over scanning.

Candidates may think blocking the IP is a quick first step to stop the attack, but the question asks to 'confirm the nature' of the attack, not to mitigate it.

Candidates may think that any suspicious activity requires immediate isolation to prevent harm, but they overlook the need for confirmation before taking disruptive actions. The urgency of the error message (raw database queries) can trigger a 'contain first, ask later' mindset.

Full explanation →

559

MCQmedium

An HR department hires contractors for fixed 60-day engagements. Accounts should stop working automatically when the engagement ends, and any rehire should require fresh approval rather than restoring old access. What IAM control is the best fit?

A.Use one shared contractor account and rotate the password when people leave.

B.Configure an account expiration date and automatic deprovisioning tied to the approved role.

C.Disable the account after the contract ends but keep all group memberships unchanged.

D.Create a local workstation account so the contractor does not need centralized identity services.

AnswerB

Correct. Time-bound accounts with automatic deprovisioning are designed for contractors and other temporary users. They enforce least privilege over time, remove access when the engagement ends, and force a new approval process for any future engagement. This reduces the risk of forgotten accounts and prevents accidental restoration of access without review.

Why this answer

Configuring an account expiration date and automatic deprovisioning tied to the approved role directly enforces the 60-day limit and ensures that when the engagement ends, the account is automatically disabled or removed. This approach also supports the requirement that rehire requires fresh approval, as the old account is deprovisioned and cannot be simply re-enabled without going through the provisioning process again.

Exam trap

The trap here is that candidates may choose Option C thinking that disabling the account is sufficient, but they overlook the requirement that rehire must require fresh approval, which is violated if group memberships remain intact and could be restored without re-provisioning.

How to eliminate wrong answers

Option A is wrong because using a shared contractor account violates the principle of individual accountability and non-repudiation, and rotating the password when someone leaves does not automatically disable access at the end of the 60-day engagement. Option C is wrong because disabling the account after the contract ends but keeping all group memberships unchanged means that if the account is ever re-enabled (even accidentally), the contractor would immediately regain all previous permissions without fresh approval, violating the requirement for rehire requiring fresh approval. Option D is wrong because creating a local workstation account bypasses centralized identity management, making it impossible to enforce automatic expiration, deprovisioning, or role-based access control across the organization.

Full explanation →

560

MCQmedium

A legacy payroll server contains a critical vulnerability. The vendor says a patch is 45 days away, and the system must remain available for payroll processing. Which risk treatment is the best short-term choice?

A.Accept the risk until the patch arrives because the server is needed for payroll processing.

B.Mitigate the risk with compensating controls such as segmentation, restricted access, and monitoring.

C.Avoid the risk by permanently decommissioning the server this week.

D.Transfer the risk by purchasing support coverage and waiting for the patch.

AnswerB

Mitigation is the best short-term treatment because the server must remain available and the vendor cannot patch it yet. Compensating controls can reduce exposure by limiting who can reach the system, narrowing network paths, and improving detection. This lowers likelihood without shutting down payroll operations. It is the most practical choice when full remediation is delayed.

Why this answer

Compensating controls like network segmentation, strict access controls, and enhanced monitoring can reduce the risk of exploitation while keeping the legacy payroll server operational. This approach directly addresses the need for availability during the 45-day patch window, aligning with the principle of defense-in-depth for unpatched systems.

Exam trap

The trap here is that candidates may confuse 'accepting the risk' (Option A) as a valid short-term strategy, but CompTIA expects you to recognize that acceptance without active monitoring or controls is not appropriate when the vulnerability is critical and the system handles sensitive data.

How to eliminate wrong answers

Option A is wrong because accepting the risk without any active countermeasures leaves the critical vulnerability exposed, which could lead to a breach of sensitive payroll data; acceptance is only appropriate when the impact is negligible, which is not the case here. Option C is wrong because permanently decommissioning the server avoids the risk but violates the requirement that the system must remain available for payroll processing, making it an impractical short-term choice. Option D is wrong because purchasing support coverage does not transfer the technical risk of exploitation; it only provides vendor support, and waiting for the patch still leaves the vulnerability unmitigated during the 45-day period.

Full explanation →

561

MCQeasy

NetFlow shows one workstation opening SMB connections to a dozen internal servers and then attempting many WinRM connections. What is the most likely explanation?

A.The host is likely being used for lateral movement or internal reconnaissance.

B.The workstation is probably downloading a routine operating system update.

C.The network is likely suffering from a wireless interference problem.

D.The user is likely printing documents to multiple shared printers.

AnswerA

Sequential SMB connections from a single workstation to many internal hosts are a classic lateral movement indicator. Protocols like SMB and WinRM are commonly abused by tools such as PsExec, WMI, or PowerShell remoting to execute commands on remote systems and move throughout the network. This pattern reflects an attacker enumerating accessible shares and testing credentials rather than normal user behavior.

Why this answer

SMB connections to many internal servers followed by WinRM attempts is a classic pattern of lateral movement or internal reconnaissance. An attacker or compromised host uses SMB to probe for accessible shares and then leverages WinRM for remote command execution, which is a common technique in post-exploitation frameworks like PsExec or CrackMapExec.

Exam trap

The trap here is that candidates may mistake the SMB traffic for normal file sharing or printing, overlooking that WinRM is a remote execution protocol, not a file or print service, and thus the combination signals active reconnaissance or lateral movement.

How to eliminate wrong answers

Option B is wrong because routine OS updates use Windows Update (HTTP/S to Microsoft servers), not SMB connections to internal servers followed by WinRM. Option C is wrong because wireless interference would cause connectivity issues, not a specific pattern of SMB then WinRM traffic. Option D is wrong because printing to shared printers uses SMB for print spooling but does not involve WinRM connections, which are for remote management and command execution.

Full explanation →

562

MCQhard

A vulnerability scan of a Linux application server reports these findings: OpenSSL 3.0.7 is flagged with a critical CVE, but the distribution vendor note says the fix was backported. Port 8443 is bound to all interfaces, yet a firewall blocks it from the internet. The internal admin console on that port still uses the default admin/admin credentials and is reachable from the corporate VLAN. Which issue should be remediated first?

A.Upgrade OpenSSL immediately, because the reported CVE proves the package is exploitable as installed.

B.Ignore the 8443 service, because the internet firewall already prevents external exposure.

C.Change the default credentials on the internal admin console and restrict access to only approved management hosts.

D.Leave the console as-is and focus only on changing the bind address to 127.0.0.1.

AnswerC

Default credentials on a reachable administrative interface are the highest-risk issue in the list. The console is accessible from the corporate VLAN, so an internal attacker or compromised endpoint could log in immediately without needing a vulnerability exploit. The OpenSSL finding may be a false positive due to backporting, and the firewall already limits internet reach, but default admin/admin credentials create direct compromise risk.

Why this answer

The most immediate risk is that an attacker on the corporate VLAN can access the internal admin console using default credentials (admin/admin). This bypasses the firewall and allows full control of the application server. Even though OpenSSL has a backported fix, the default credentials represent an active, easily exploitable vulnerability that requires no additional exploit development.

Exam trap

The trap here is that candidates focus on the critical CVE and the firewall rule, overlooking that default credentials on an internally reachable service pose a more immediate and easily exploitable risk than a patched vulnerability or a network control that does not protect against internal threats.

How to eliminate wrong answers

Option A is wrong because the distribution vendor has backported the fix, meaning the installed OpenSSL 3.0.7 is patched against the CVE despite the version number; upgrading is unnecessary and could break dependencies. Option B is wrong because the firewall only blocks internet traffic, but the admin console is reachable from the corporate VLAN, which is a trusted network that may still contain compromised hosts or insider threats. Option D is wrong because changing the bind address to 127.0.0.1 alone does not address the default credentials; an attacker on the local host could still exploit them, and the console would remain accessible to anyone who gains local access.

Full explanation →

563

MCQmedium

Network engineers need to administer internal switches from home. The company wants encrypted management traffic, strong user verification, and no management ports exposed directly to the internet. Which approach is best?

A.Require a VPN or ZTNA connection with MFA, then allow SSH or HTTPS management only through that protected tunnel.

B.Expose SSH on the internet and rely on key-based authentication alone.

C.Use RDP with port forwarding because it is simpler for remote support.

D.Allow split tunneling without MFA so engineers can reduce latency while working remotely.

AnswerA

A VPN or ZTNA tunnel creates a cryptographically protected path from the engineer's workstation to the internal network, keeping SSH/HTTPS management virtual interfaces off the public internet where they can be targeted by scanners. Enforcing MFA at this boundary adds a strong identity check beyond just the device's own password or key, so a compromised credential alone isn't sufficient. This reduces the attack surface to a single hardened access point and ensures all administrative traffic for the switches traverses an encrypted, authenticated session.

Why this answer

It enforces encryption (via VPN or ZTNA tunnel), strong user verification (MFA), and network segmentation (no direct internet exposure). SSH or HTTPS management traffic is then allowed only through the protected tunnel, ensuring confidentiality, integrity, and access control. This aligns with the principle of defense in depth for remote network device administration.

Exam trap

The trap here is that candidates may think SSH key-based authentication alone is sufficient for remote access, overlooking the requirement to avoid direct internet exposure and the need for strong user verification like MFA.

How to eliminate wrong answers

Option B is wrong because exposing SSH directly to the internet violates the requirement of no management ports exposed to the internet, and key-based authentication alone does not provide strong user verification (e.g., no MFA). Option C is wrong because RDP is not designed for switch management (switches typically lack RDP support) and port forwarding still exposes the management port to the internet, violating the exposure restriction. Option D is wrong because split tunneling without MFA bypasses the encrypted tunnel requirement and weakens user verification, leaving management traffic potentially exposed and vulnerable to interception.

Full explanation →

564

MCQmedium

A help desk technician reviews a voicemail in which the caller claims to be from the security team, says the user will be locked out unless they read back a one-time passcode, and leaves a callback number. What type of attack is this?

A.Smishing, because the attacker is using a text message with a link.

B.Vishing, because the attacker is using voice communication to pressure the user.

C.Baiting, because the attacker is offering a reward to entice the user.

D.Pretexting, because the attacker invented a role and story.

AnswerB

Vishing is voice-based social engineering, including phone calls and voicemail messages that try to pressure the target into revealing information. Requesting a one-time passcode is especially dangerous because it can let an attacker bypass MFA protections. The callback number is often used to appear legitimate and keep the victim engaged long enough to disclose sensitive data.

Why this answer

Vishing (voice phishing) uses voice communication—such as phone calls or voicemails—to trick victims into revealing sensitive information. In this scenario, the attacker leaves a voicemail claiming to be from the security team and pressures the user to read back a one-time passcode, which is a classic vishing tactic that exploits trust and urgency over voice channels.

Exam trap

The trap here is that candidates may confuse vishing with smishing because both involve social engineering over digital communication, but the key differentiator is the medium: voice (voicemail/call) versus text message (SMS).

How to eliminate wrong answers

Option A is wrong because smishing specifically involves SMS text messages, often containing a malicious link, not a voicemail or callback number. Option C is wrong because baiting relies on offering a reward (e.g., free download or USB drive) to entice the victim into an action, not on impersonating authority and creating urgency to extract a passcode.

Full explanation →

565

MCQeasy

An employee receives an email that appears to come from the HR team. It says their payroll account will be suspended unless they click a link and sign in within 30 minutes. What type of attack is this most likely?

A.Smishing

B.Phishing

C.Vishing

D.Pretexting

AnswerB

Phishing uses deceptive messages to trick a user into clicking a link, entering credentials, or taking another unsafe action. This email pretends to be from HR, creates urgency, and tries to push the user into signing in on a fake page.

Why this answer

This is a classic phishing attack because the threat actor uses a deceptive email message to trick the recipient into clicking a malicious link and providing sensitive credentials. Phishing specifically refers to social engineering attacks delivered via email, often leveraging urgency and impersonation of a trusted entity like HR to bypass the victim's critical thinking.

Exam trap

The trap here is that candidates often confuse phishing with vishing or smishing because all three involve impersonation and urgency, but the specific delivery vector (email vs. SMS vs. voice call) is the key differentiator the exam expects you to identify.

How to eliminate wrong answers

Option A is wrong because smishing is a social engineering attack delivered via SMS (Short Message Service) text messages, not email. Option C is wrong because vishing (voice phishing) is conducted over voice calls or VoIP, not through an email message. Option D is wrong because pretexting is a social engineering technique where the attacker fabricates a scenario (pretext) to steal information, but it does not inherently involve a phishing link or email; the attack described specifically uses an email with a link, which is the hallmark of phishing.

Full explanation →

566

MCQmedium

A company suspects the master encryption key used by a cloud storage service may have been exposed. The data must remain protected if someone later obtains a copy of the old key. What is the best next step?

A.Delete the stored files so the exposed key can no longer be used.

B.Rotate the key and re-encrypt or rewrap the protected data under the new key.

C.Change every user's password because that will also invalidate the exposed encryption key.

D.Increase file compression so the data becomes harder to read.

AnswerB

If a key may be compromised, the secure response is to replace it and move protected data to fresh key material. Rotating the key prevents the old key from being useful going forward, and re-encrypting or rewrapping ensures the data is actually protected by the new key. This reduces the risk that a future attacker can use the leaked key to access stored content.

Why this answer

Key rotation is the correct response because it invalidates the old master encryption key by generating a new one and re-encrypting or rewrapping the protected data under the new key. This ensures that even if an attacker later obtains a copy of the old key, the data remains protected because it is no longer encrypted with that key. In cloud storage services like AWS KMS or Azure Key Vault, this process is typically automated and does not require re-uploading the data.

Exam trap

The trap here is that candidates often confuse key rotation with password changes or data deletion, failing to recognize that encryption key management requires cryptographic operations to re-protect the data, not just administrative actions like deleting files or changing user credentials.

How to eliminate wrong answers

Option A is wrong because deleting the stored files does not address the exposure of the key itself; the data is lost, but the key exposure remains a risk for any future data encrypted with that key, and it is an extreme measure that disrupts business operations. Option C is wrong because user passwords are unrelated to the master encryption key; changing passwords affects authentication but does not change the cryptographic key used to encrypt the data. Option D is wrong because file compression does not alter the encryption key or the ciphertext; it only reduces file size and does not provide any security against an attacker who possesses the old key.

Full explanation →

567

MCQmedium

A user reports receiving repeated MFA push requests even though they are not logging in. Later, someone calls and claims to be IT, asking the user to approve one prompt so support can finish a password reset. Which control would best reduce the success of this attack?

A.Increase password complexity requirements

B.Use phishing-resistant MFA with number matching or hardware security keys

C.Shorten the screen-lock timeout on user devices

D.Allow users to approve any MFA prompt sent during business hours

AnswerB

Phishing-resistant MFA with number matching (e.g., conditional access policies that require entering the displayed number in the authenticator) or hardware security keys (FIDO2/WebAuthn) makes blind push approvals impossible. Number matching forces the user to compare an out-of-band code on the device against the one on the login screen, so an attacker spamming prompts cannot receive an approval without that matching code. Hardware keys cryptographically bind authentication to the exact origin and require user presence, preventing relay and prompt fatigue entirely, because the key simply will not sign a request the user does not physically tap for that specific site.

Why this answer

Phishing-resistant MFA, such as number matching or hardware security keys (e.g., FIDO2/WebAuthn), prevents an attacker from tricking the user into approving a fraudulent push request. Number matching requires the user to enter a number displayed on the login screen into the MFA prompt, ensuring the approval is tied to an actual authentication attempt. Hardware security keys use cryptographic challenge-response, making it impossible for an attacker to replay or intercept the authentication factor.

Exam trap

The trap here is that candidates often confuse MFA fatigue with password-based attacks and incorrectly choose password complexity (A) or screen-lock timeout (C), failing to recognize that the core vulnerability is the user's ability to approve a push without verifying the context.

How to eliminate wrong answers

Option A is wrong because increasing password complexity does not address MFA fatigue or social engineering; the attacker is already bypassing the password by exploiting the MFA approval process. Option C is wrong because shortening the screen-lock timeout only reduces the risk of unauthorized physical access to an unlocked device, but does not prevent the user from approving a fraudulent MFA prompt on their own device. Option D is wrong because allowing users to approve any MFA prompt during business hours directly enables the attack; it removes the user's discretion and encourages blind approval, which is exactly what the attacker is exploiting.

Full explanation →

568

MCQmedium

During an incident, a server administrator needs elevated access to production logs for exactly two hours after manager approval. The organization does not want standing privileged accounts. Which solution is the best fit?

A.Add the administrator to a permanent domain admin group so access is always available.

B.Use just-in-time privileged access through a privileged access management workflow.

C.Create a shared administrator account for the incident team and change the password afterward.

D.Grant access by sending the administrator a VPN profile with broader network reach.

AnswerB

Just-in-time access is ideal when elevation should be temporary, approved, and tightly controlled. A privileged access management workflow can grant the needed permissions for a limited window, automatically revoke them when time expires, and preserve logs for accountability. This reduces the attack surface compared with always-on admin rights while still letting the team respond quickly during an incident.

Why this answer

Just-in-time (JIT) privileged access through a Privileged Access Management (PAM) workflow is the best fit because it grants the administrator elevated permissions for exactly two hours, then automatically revokes them. This aligns with the requirement for time-limited access without maintaining standing privileged accounts, reducing the attack surface and ensuring compliance with the principle of least privilege.

Exam trap

The trap here is that candidates may confuse network-level access (VPN) with privileged access management, or assume a shared account with password rotation is sufficient, overlooking the need for time-bound, auditable, and non-repudiable elevation without standing privileges.

How to eliminate wrong answers

Option A is wrong because adding the administrator to a permanent domain admin group creates a standing privileged account, which the organization explicitly wants to avoid, and provides continuous elevated access rather than time-limited access. Option C is wrong because creating a shared administrator account violates the principle of non-repudiation and auditability, as actions cannot be attributed to a specific individual, and changing the password afterward does not enforce a precise two-hour access window. Option D is wrong because sending a VPN profile with broader network reach only expands network-level access, not privileged access to production logs, and does not provide time-bound elevation or granular control over log permissions.

Full explanation →

569

MCQhard

Based on the exhibit, which document type should be updated to make the approval and retention requirements mandatory across the organization?

A.Guideline, because it provides flexible advice without requiring enforcement.

B.Procedure, because it lists the exact steps the help desk follows.

C.Policy, because it sets mandatory rules that apply organization-wide.

D.Architecture diagram, because it shows where documents are stored.

AnswerC

A policy is the right choice because leadership wants the approval and retention expectations to be mandatory, consistent, and auditable across departments. The exhibit shows informal language such as 'should' and 'if time allows,' which is too weak for a control that must be enforced. Policy language establishes the required rule before procedures document how to follow it.

Why this answer

A policy document is the correct choice because it establishes mandatory rules that apply organization-wide, making approval and retention requirements enforceable across all departments. Unlike guidelines or procedures, policies are authoritative and require compliance, which is essential for standardizing security controls like data retention periods.

Exam trap

The trap here is confusing a policy (mandatory, organization-wide) with a guideline (advisory) or procedure (task-specific), leading candidates to pick a document type that lacks enforcement authority.

How to eliminate wrong answers

Option A is wrong because a guideline provides flexible advice or recommendations, not mandatory rules, so it cannot enforce approval or retention requirements. Option B is wrong because a procedure lists specific step-by-step instructions for a task (e.g., help desk ticket handling), but it does not set organization-wide mandatory policies. Option D is wrong because an architecture diagram visually represents system components and data flow, not enforceable rules or retention mandates.

Full explanation →

570

MCQhard

A user database is stolen from a SaaS portal. Investigators discover the password column contains the same value for every user who chose "Summer2026!", and an attacker could use precomputed tables to crack weak passwords quickly. Which change best addresses both the repeated-value issue and rainbow-table risk?

A.Encrypt all stored passwords with AES and keep one shared key

B.Use SHA-256 without a salt

C.Store each password with a unique salt and an adaptive hash such as bcrypt or Argon2

D.Add a digital signature to each password record

AnswerC

A unique salt prevents two users with the same password from producing the same stored value, which makes identical passwords harder to spot. Salting also defeats rainbow-table attacks because precomputed hashes no longer match. An adaptive hash adds deliberate computational cost, slowing offline cracking after a breach. Together, these are the standard protections for password storage.

Why this answer

Using a unique salt per password ensures that even if two users choose the same password (e.g., 'Summer2026!'), their stored hashes will differ, eliminating the repeated-value issue. Additionally, adaptive hash functions like bcrypt or Argon2 are computationally expensive, making precomputed rainbow tables infeasible even if the salts were known, as each guess requires re-hashing with the specific salt.

Exam trap

CompTIA often tests the misconception that encryption (A) or a stronger hash like SHA-256 (B) is sufficient for password storage, but the trap is that encryption is reversible and unsalted hashes are still vulnerable to rainbow tables, whereas the correct answer requires both salting and an adaptive, slow hash function.

How to eliminate wrong answers

Option A is wrong because encrypting passwords with AES and a shared key does not prevent identical passwords from producing identical ciphertexts (the repeated-value issue remains), and if the key is compromised, all passwords are exposed; encryption is reversible, unlike hashing. Option B is wrong because SHA-256 without a salt produces the same hash for the same password, directly causing the repeated-value issue, and unsalted hashes are trivially vulnerable to rainbow-table attacks. Option D is wrong because adding a digital signature to each password record does nothing to address identical password hashes or rainbow-table risks; signatures verify integrity/authenticity, not protect against precomputation attacks.

Full explanation →

571

MCQmedium

An organization is redesigning access for its HR portal. HR staff need to update employee records, managers need to approve leave requests, and payroll staff need access to salary data, but no single user should receive all of those permissions by default. What is the best access model?

A.Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.

B.Assign everyone the same portal permissions to simplify administration.

C.Give every manager full HR and payroll access so approvals are faster.

D.Use one shared administrator account for all HR actions to keep audits simple.

AnswerA

This is correct because it applies role-based access control (RBAC) and the principle of least privilege. By creating distinct roles for HR, managers, and payroll, each job function receives only the permissions required for its operational duties, preventing unnecessary access to sensitive records such as salary or disciplinary data. This role separation also enforces segregation of duties, so no single role can control an entire HR process, reducing the risk of fraud or accidental modification of critical records.

Why this answer

Role-Based Access Control (RBAC) assigns permissions based on job functions, ensuring that HR staff, managers, and payroll personnel receive only the privileges necessary for their roles. This enforces the principle of least privilege and prevents any single user from inheriting all permissions by default, which aligns with the organization's security requirement.

Exam trap

The trap here is that candidates may confuse RBAC with simpler models like DAC or MAC, or assume that convenience (e.g., faster approvals) justifies overriding least privilege, but the exam emphasizes that role separation and minimal permissions are mandatory for secure access design.

How to eliminate wrong answers

Option B is wrong because assigning everyone the same portal permissions violates the principle of least privilege, granting excessive access to users who do not need it and increasing the risk of unauthorized data exposure or modification. Option C is wrong because giving every manager full HR and payroll access bypasses role separation, allowing managers to view salary data and update employee records without need, which could lead to privilege escalation and compliance violations. Option D is wrong because using one shared administrator account eliminates accountability and audit trails, making it impossible to attribute actions to specific users and violating non-repudiation principles.

Full explanation →

572

MCQmedium

EDR flags a workstation after a word processor launches encoded PowerShell and the host begins contacting a rare domain over HTTPS. The user is still active. What is the best containment action from the EDR console?

A.Isolate the endpoint from the network while keeping it powered on.

B.Delete the suspicious PowerShell process from the console and close the alert.

C.Reimage the workstation immediately to return it to a clean state.

D.Power the workstation off and disconnect the SSD to preserve data.

AnswerA

This is the best containment step because it stops the suspected malware from communicating outward or moving laterally, while preserving the live system for follow-up investigation. Keeping the machine powered on protects volatile evidence such as memory, processes, and active connections. EDR isolation is especially useful when the user is still logged in and the host may still contain useful artifacts that would be lost by immediate shutdown.

Why this answer

Isolating the endpoint from the network while keeping it powered on is the best containment action because it immediately cuts off the command-and-control (C2) communication over HTTPS to the rare domain, preventing further data exfiltration or lateral movement, while preserving volatile memory and running processes for forensic analysis. This aligns with incident response best practices where containment must prioritize stopping the threat without destroying evidence.

Exam trap

The trap here is that candidates often choose to kill the process or power off the system, mistakenly believing that stopping the immediate malicious activity is sufficient, without understanding that containment must preserve forensic evidence and prevent re-infection or lateral movement.

How to eliminate wrong answers

Option B is wrong because deleting the suspicious PowerShell process from the console does not remove the underlying malware or persistence mechanism, and the endpoint remains connected to the network, allowing the attacker to re-establish C2 or execute additional payloads. Option C is wrong because reimaging the workstation destroys all forensic evidence, including volatile memory, logs, and artifacts that could reveal the attack vector, scope, and indicators of compromise, which is premature before a proper investigation. Option D is wrong because powering the workstation off and disconnecting the SSD destroys volatile memory (e.g., running processes, network connections, encryption keys) that are critical for understanding the attack, and it prevents live response actions such as memory acquisition or process analysis.

Full explanation →

573

MCQeasy

During testing, a login form returns all user records when the tester enters ' OR '1'='1 in a username field. What is the best fix for this issue?

A.Hide database error messages from the login page only

B.Use parameterized queries or prepared statements

C.Require users to change passwords more often

D.Move the login page to a different URL

AnswerB

Parameterized queries (prepared statements) separate an SQL statement’s structure from its data by sending a query template with placeholders to the database engine before binding input as values. Because the database compiles the template once and treats every subsequent input strictly as a literal value, a payload such as ' OR '1'='1 is treated as a string, not as SQL syntax, rendering the injection attempt ineffective. This defense neutralizes the root cause of the vulnerability: unsanitized string concatenation in the query builder.

Why this answer

The SQL injection attack ' OR '1'='1 bypasses authentication by always evaluating to true, returning all user records. Parameterized queries (prepared statements) separate SQL logic from user input, preventing the injected string from altering the query structure. This is the industry-standard mitigation for SQL injection vulnerabilities.

Exam trap

The trap here is that candidates often choose hiding error messages (Option A) because they confuse symptom masking with root-cause remediation, but the exam tests the principle that input validation and parameterized queries are the only reliable fix for SQL injection.

How to eliminate wrong answers

Option A is wrong because hiding error messages is a defense-in-depth measure that does not prevent the SQL injection itself; the attack still succeeds even if errors are hidden. Option C is wrong because password rotation policies do not address the root cause of SQL injection; they only reduce the window of compromised credentials. Option D is wrong because moving the login page to a different URL does not fix the vulnerability; the same injection would work on the new URL if the code remains unchanged.

Full explanation →

574

MCQhard

Based on the exhibit, which improvement best addresses the biggest cryptographic risk? TLS inventory: - edge-vpn01 and edge-vpn02 present the same certificate and private key - private key file stored in a shared SMB folder - admins copy the key manually during maintenance - compromise of either gateway would expose the file path to the same share

A.Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.

B.Increase the certificate expiration to five years to reduce renewal work.

C.Keep copying the same key everywhere so failover is easier to manage.

D.Disable certificate validation to avoid user-facing outages.

AnswerA

Placing the private key in an HSM or cloud key vault ensures the key material never exists in plaintext outside a tamper-resistant boundary, so even a compromised gateway cannot extract it. Issuing unique keys or certificates per gateway additionally limits the blast radius: if one gateway is breached, only its certificate can be revoked and re-issued, while other gateways remain trusted. This directly addresses the root problem of shared static keys and aligns with least-privilege and crypto-agility best practices.

Why this answer

The biggest cryptographic risk is the shared private key stored in an SMB share, which violates the principle of least privilege and creates a single point of compromise. Using a Hardware Security Module (HSM) or cloud key vault ensures the private key is never exposed in plaintext, and issuing unique keys per gateway eliminates the risk that compromising one gateway exposes the key for all others. This directly addresses the core issue of key confidentiality and isolation.

Exam trap

The trap here is that candidates may think certificate expiration or failover convenience are the primary concerns, when the real risk is the shared private key's exposure and lack of isolation, which undermines the entire TLS trust model.

How to eliminate wrong answers

Option B is wrong because increasing certificate expiration to five years does not address the fundamental risk of a shared, exposed private key; it actually increases the window of exposure if the key is compromised. Option C is wrong because continuing to copy the same key everywhere perpetuates the insecure practice of key sharing, making failover easier at the cost of catastrophic security failure if any gateway is breached. Option D is wrong because disabling certificate validation removes the entire security benefit of TLS, allowing man-in-the-middle attacks and completely undermining confidentiality and integrity.

Full explanation →

575

MCQeasy

A file server suddenly renames documents, creates ransom notes, and users can no longer open their files. Which malware type is most likely involved?

A.Spyware

B.Ransomware

C.Rootkit

D.Worm

AnswerB

Ransomware is a type of extortion-based malware that encrypts files using a strong cryptographic algorithm, then presents a ransom note demanding payment—typically in cryptocurrency—for the decryption key. The rapid renaming of documents (often to a .encrypted or attacker-specific extension) and the appearance of ransom notes on a file server are hallmark indicators of a ransomware infection, especially when legitimate users can no longer open their shared files.

Why this answer

Ransomware is the correct answer because it specifically encrypts files and demands payment for decryption. The symptoms—documents being renamed, ransom notes appearing, and users losing access to their files—are classic indicators of ransomware activity, which typically uses strong encryption algorithms like AES or RSA to lock files.

Exam trap

The trap here is that candidates may confuse the file-renaming and note-creation behavior with a logic bomb or virus, but the core differentiator is the extortion demand and encryption-based access loss, which is unique to ransomware.

How to eliminate wrong answers

Option A is wrong because spyware is designed to covertly gather information (e.g., keystrokes, browsing habits) without altering or encrypting files; it does not rename documents or create ransom notes. Option C is wrong because a rootkit provides persistent, stealthy access to a system by hiding its presence (e.g., hooking system calls or modifying kernel data structures), but it does not directly rename files or demand ransoms.

Full explanation →

576

Multi-Selectmedium

An EDR alert shows suspicious PowerShell activity on a remote employee laptop, and the user is still logged in to cloud applications. Which two response actions are best if the device is believed to be actively compromised? Select two.

Select 2 answers

A.Isolate the endpoint through the EDR tool or quarantine its network access.

B.Collect a live response package or volatile data before cleanup begins.

C.Power off the laptop immediately to stop the activity as fast as possible.

D.Wait until the user returns the laptop to the office for physical inspection.

E.Remove the EDR agent so the attacker cannot detect the investigation.

AnswersA, B

Network isolation is the fastest way to stop additional attacker communication, lateral movement, and command execution from the compromised laptop. It contains the incident while preserving the system state for investigation. EDR quarantine is particularly useful for remote devices because it can be applied without physical access to the endpoint.

Why this answer

Isolating the endpoint via the EDR tool or quarantining its network access immediately stops the attacker's ability to communicate with command-and-control servers, preventing lateral movement and further data exfiltration. This containment action is a critical first step in incident response for an actively compromised device, as it preserves the integrity of the investigation while halting malicious activity.

Exam trap

The trap here is that candidates confuse 'stopping the activity' with 'powering off the device,' failing to recognize that volatile data collection must precede any shutdown to preserve forensic evidence.

Full explanation →

577

MCQeasy

A help desk team wants guest Wi-Fi users to access only the internet and nothing on the internal corporate network. Which control should the network team implement at the wireless edge?

A.A single shared password for all guest users

B.An ACL or firewall rule set that blocks guest network access to internal subnets

C.A stronger DNS server

D.A longer Wi-Fi passphrase rotated monthly

AnswerB

An ACL or firewall rule set is the correct control because it operates at the network layer, where routing and reachability are decided. By placing guest traffic into a separate VLAN and applying rules on the guest default gateway or firewall, the help desk can permit internet-bound traffic while explicitly denying traffic destined to internal RFC 1918 subnets. This is exactly the kind of destination-based restriction that meets the requirement that guest users access only the internet.

Why this answer

To prevent guest Wi-Fi users from accessing the internal corporate network while allowing internet access, the network team must implement an ACL or firewall rule set at the wireless edge. This control explicitly blocks traffic from the guest VLAN/subnet to internal subnets (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) while permitting outbound traffic to the internet. This is a fundamental network segmentation technique that enforces the principle of least privilege at Layer 3/4.

Exam trap

The trap here is that candidates confuse authentication controls (passwords, passphrase rotation) with network access controls (ACLs, firewall rules), assuming that a strong password or DNS server can prevent lateral movement, when in fact only explicit Layer 3/4 filtering at the edge can enforce network segmentation.

How to eliminate wrong answers

Option A is wrong because a single shared password for all guest users does not restrict network access; it only provides authentication to the SSID, and without ACLs, guests could still reach internal resources. Option C is wrong because a stronger DNS server (e.g., using DNSSEC or a public resolver) does not block traffic to internal subnets; it only improves name resolution security and does not enforce network segmentation. Option D is wrong because a longer Wi-Fi passphrase rotated monthly improves authentication strength but does not control which networks a guest can reach once connected; it is a credential policy, not an access control mechanism.

Full explanation →

578

MCQeasy

A small company is publishing an internal website to the internet. The security team wants the web server reachable from the internet while keeping the database and file share isolated from direct internet access. Which design is best?

A.Place the web server and database on the same flat internal network behind the firewall.

B.Place the web server in a DMZ and keep the database and file share on a private internal subnet.

C.Place the database in the DMZ and keep the web server on the internal user VLAN.

D.Use a VPN for all users and keep every server on the same subnet.

AnswerB

This is the best design because the internet-facing system is isolated in a DMZ, while sensitive back-end systems stay off the public path. Traffic can be tightly filtered so only the required web-to-database communication is allowed. That reduces exposure if the web server is compromised.

Why this answer

It implements a DMZ architecture where the web server is placed in a publicly accessible network segment, while the database and file share reside on a private internal subnet. This design ensures that even if the web server is compromised, an attacker cannot directly access the internal resources because firewall rules restrict inbound traffic to only the DMZ and block any initiated connections from the DMZ to the internal network. This follows the principle of defense in depth and network segmentation as recommended by CompTIA for securing multi-tier applications.

Exam trap

The trap here is that candidates often confuse a DMZ as a place to put all servers that need internet access, but the correct design isolates only the front-end web server in the DMZ while keeping backend services like databases and file shares on a separate internal subnet to prevent direct exposure.

How to eliminate wrong answers

Option A is wrong because placing the web server and database on the same flat internal network behind the firewall exposes the database to direct internet traffic if the web server is compromised, violating the principle of least privilege and network segmentation. Option C is wrong because placing the database in the DMZ exposes it directly to the internet, which defeats the purpose of isolating sensitive data; the web server should be the only component reachable from the internet, with the database kept on a private subnet. Option D is wrong because using a VPN for all users and keeping every server on the same subnet eliminates network segmentation entirely, meaning that if any server is breached, all resources including the database and file share are immediately accessible, and VPN access does not prevent lateral movement within the same subnet.

Full explanation →

579

MCQmedium

An EDR console shows PowerShell launching from a scheduled task, decoding a command from memory, and spawning rundll32.exe. No suspicious executable is written to disk, and the activity stops when the process ends. Which threat best fits this behavior?

A.Trojan downloader

B.Fileless malware

C.Rootkit

D.Worm

AnswerB

Fileless malware is the correct classification because it operates without writing a malicious executable to disk, instead living in memory and abusing built-in administrative tools. Evidenced by the EDR console, the scheduled task directly invokes PowerShell, which can execute arbitrary scripts in memory through encoded commands or remote download cradles. This approach bypasses traditional file-scanning antivirus and uses trusted Windows processes to carry out the attack, matching the observed indicators perfectly.

Why this answer

The behavior describes PowerShell decoding a command from memory and spawning rundll32.exe without writing any executable to disk, which is the hallmark of fileless malware. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and rundll32) to execute malicious code, and it leaves no persistent file on the filesystem, so activity ceases when the process ends.

Exam trap

CompTIA often tests the misconception that any malware using PowerShell must be a Trojan downloader, but the key differentiator here is the absence of a file written to disk and the memory-only execution, which points directly to fileless malware.

How to eliminate wrong answers

Option A is wrong because a Trojan downloader typically writes a malicious executable to disk and then downloads additional payloads, but here no executable is written to disk. Option C is wrong because a rootkit is designed to hide its presence and maintain persistent kernel-level access, often by modifying system files or drivers, whereas this threat is ephemeral and runs only in user-mode memory without persistence. Option D is wrong because a worm self-replicates across networks to infect other systems, usually by copying itself to remote locations, but this threat does not exhibit self-propagation or network-based replication.

Full explanation →

580

Multi-Selectmedium

A company is implementing a defense-in-depth strategy for its internal network. The security team wants to detect and respond to malicious activities that might bypass perimeter defenses. Which two controls should be implemented to provide continuous monitoring and analysis of network traffic and endpoint activities? (Choose two.)

Select 2 answers

A.Intrusion detection system (IDS) sensors placed on critical network segments.

B.Host-based firewall on each employee workstation.

C.Security information and event management (SIEM) system aggregating logs from multiple sources.

D.Uninterruptible power supply (UPS) for network devices.

E.Data loss prevention (DLP) endpoint agent.

AnswersA, C

IDS sensors monitor network traffic for suspicious patterns and known attack signatures, providing visibility into potential intrusions that bypass perimeter defenses. Placing them on critical segments ensures that internal malicious activities are detected. This directly supports continuous monitoring and analysis of network traffic, making it a correct choice for defense-in-depth.

Why this answer

The correct answers are IDS sensors and a SIEM system. IDS sensors detect suspicious network traffic, while a SIEM aggregates and correlates logs for comprehensive analysis. Together, they provide continuous monitoring and detection of malicious activities that bypass perimeter defenses.

The other options are preventive or availability controls, not detection and analysis tools.

Exam trap

The trap here is selecting preventive controls like host-based firewalls or DLP, which do not provide the continuous monitoring and analysis required for detecting bypassed threats.

Full explanation →

581

MCQmedium

A Linux operations team needs to run a nightly script that restarts one service and archives its logs on 60 servers. Security does not want an administrator to log in interactively, and the script should have only the permissions needed for that job. What is the best approach?

A.Use the root account so the job never fails.

B.Create a dedicated service account with only the delegated rights needed, and run the script as a scheduled job.

C.Store an administrator's SSH key inside the script.

D.Have an operator log in and run the commands manually each night.

AnswerB

A dedicated noninteractive account supports automation while keeping permissions tightly scoped to the task. The account can be granted only the ability to restart the specific service and write the required log archive location, rather than full administrator access. Scheduling the job also makes the activity repeatable and auditable. This approach supports least privilege, reduces human error, and avoids interactive logons on every server.

Why this answer

It follows the principle of least privilege by creating a dedicated service account with only the specific rights needed to restart the service and archive logs. Running the script as a scheduled job (e.g., via cron) eliminates the need for interactive login, satisfying the security requirement. This approach minimizes the attack surface and ensures the job runs automatically without exposing administrative credentials.

Exam trap

The trap here is that candidates often assume root is necessary for system service management, but SY0-701 tests the principle of least privilege and the ability to delegate specific rights via service accounts and sudoers policies.

How to eliminate wrong answers

Option A is wrong because using the root account grants unrestricted superuser privileges, violating the principle of least privilege and increasing the risk of catastrophic errors or compromise. Option C is wrong because storing an administrator's SSH key inside the script exposes the private key to anyone who can read the script, creating a credential theft vulnerability and violating secure key management practices. Option D is wrong because requiring an operator to log in manually each night introduces human error, inconsistency, and violates the security policy that prohibits interactive login.

Full explanation →

582

MCQmedium

A vulnerability dashboard shows four new findings. Which one should be remediated first by the operations team? - A low-severity issue on an offline lab VM - A medium-severity issue on a payroll server with no known exploit - A critical issue on an internet-facing web server with an available exploit - A high-severity issue on a test workstation that is not domain joined

A.The low-severity issue on the offline lab VM.

B.The medium-severity issue on the payroll server with no known exploit.

C.The critical issue on the internet-facing web server with an available exploit.

D.The high-severity issue on the test workstation that is not domain joined.

AnswerC

This finding combines maximum exploitability with maximum exposure: an available exploit means attackers can weaponise it immediately, and internet-facing placement removes the network boundary that would otherwise contain it. The other findings lack either a known exploit or external reachability.

Why this answer

The critical issue on the internet-facing web server with an available exploit should be remediated first because it combines the highest severity (critical) with an active, exploitable vulnerability on an asset exposed to the public internet. In vulnerability management, remediation priority is determined by risk, which is a function of severity, exploitability, and asset exposure. An internet-facing web server with a known exploit represents an immediate threat that can be remotely compromised, unlike the other findings which are on isolated or less critical systems.

Exam trap

CompTIA often tests the principle that severity alone does not determine priority; candidates must consider exploitability and asset exposure, and the trap here is assuming a high-severity issue on any asset (like a test workstation) should be fixed before a critical issue on an internet-facing server, ignoring that the test workstation is isolated and not domain-joined, reducing its risk profile.

How to eliminate wrong answers

Option A is wrong because a low-severity issue on an offline lab VM poses minimal risk; the VM is not connected to the network, so exploitation is virtually impossible and remediation can be deferred. Option B is wrong because a medium-severity issue on a payroll server with no known exploit is less urgent; without an available exploit, the likelihood of successful attack is low, and the server, while sensitive, is not directly exposed to the internet. Option D is wrong because a high-severity issue on a test workstation that is not domain joined is isolated from the production domain and likely not accessible from the internet, reducing the attack surface and urgency compared to a critical, exploitable internet-facing server.

Full explanation →

583

MCQhard

After a suspected compromise, a server's local tools report sshd listening on port 22, but netstat and the EDR console fail to show the process that owns the socket. A reboot does not remove the issue, and firmware integrity checks pass. Which malware type is most likely installed?

A.Spyware, because hidden software is often used to collect credentials and data.

B.Rootkit, because it is designed to hide processes, drivers, or sockets from normal security tools.

C.Ransomware, because the server remains operational while still hiding evidence.

D.Logic bomb, because the issue persists after reboot and could trigger later.

AnswerB

Rootkit is the best answer because the core clue is stealth: the service exists, but common tools cannot attribute the socket to a process. That suggests kernel- or driver-level concealment rather than a normal user-space infection. The persistence after reboot further supports a deeply embedded implant that survives simple cleanup attempts.

Why this answer

A rootkit is specifically designed to hide its presence from the operating system and security tools by intercepting system calls (e.g., those used by netstat and EDR) to conceal processes, drivers, and network sockets. The persistence after reboot and clean firmware integrity checks indicate the rootkit is installed at the kernel or boot level, bypassing user-mode detection.

Exam trap

The trap here is that candidates may confuse persistence with logic bombs or assume that any hidden software is spyware, but the key technical indicator is the ability to hide a socket from netstat and EDR while surviving reboot, which is a hallmark of kernel-level rootkits.

How to eliminate wrong answers

Option A is wrong because spyware typically focuses on data collection and does not inherently possess the capability to hide processes or sockets from netstat and EDR; its stealth is usually limited to user-level concealment, not kernel-level hooking. Option C is wrong because ransomware is designed to encrypt files and demand payment, not to persistently hide processes or sockets; its primary goal is disruption, not stealthy persistence. Option D is wrong because a logic bomb is a dormant piece of code triggered by a specific condition (e.g., date or event), not a persistent, actively hiding malware that survives reboot and evades process enumeration.

Full explanation →

584

MCQhard

Based on the exhibit, what is the best eradication decision after containment? A quarantined endpoint was found to have a malicious startup item and a scheduled task. The team has already isolated it from the network and preserved memory for analysis.

A.Delete only the update.exe file and reconnect the host once the user confirms it is working.

B.Remove persistence artifacts and rebuild the endpoint from a known-good image before returning it to service.

C.Restore network connectivity now because no encryption was observed.

D.Change the DNS servers for the entire enterprise to block the malware domain.

AnswerB

The host contains a malicious executable plus two persistence mechanisms, so cleanup must remove more than the payload file. Reimaging from trusted media provides the most reliable eradication path, especially when the malware family is already identified and the machine has been quarantined. This reduces the chance of hidden remnants, registry persistence, or tampered system components surviving the response effort.

Why this answer

After containment (network isolation and memory preservation), the best eradication step is to remove all persistence mechanisms (startup item and scheduled task) and rebuild the endpoint from a known-good image. This ensures that any undetected malware remnants, rootkits, or hidden artifacts are eliminated, preventing reinfection. Simply deleting files or changing DNS does not guarantee the system is clean, and reconnecting without a full rebuild risks lateral movement or data exfiltration.

Exam trap

The trap here is that candidates may choose Option A, thinking that deleting the malicious file is sufficient, but CompTIA emphasizes that persistence artifacts must be removed and a system should be rebuilt from a trusted image to ensure complete eradication.

How to eliminate wrong answers

Option A is wrong because deleting only the update.exe file leaves the scheduled task and startup item intact, and the user's confirmation of functionality does not verify security; the host could still have hidden persistence or other malware. Option C is wrong because restoring network connectivity without eradication ignores the possibility of dormant malware or backdoors, and the absence of encryption does not indicate the system is safe. Option D is wrong because changing enterprise DNS servers is a containment or mitigation step, not an eradication decision; it does not clean the compromised endpoint and may disrupt legitimate traffic.

Full explanation →

585

MCQeasy

A support portal searches customer records by last name. When a tester enters a single quote into the search field, the application returns a database syntax error. Which attack is most likely possible?

A.SQL injection, because the input may be altering the database query

B.Cross-site scripting, because the page is executing malicious JavaScript in the browser

C.Server-side request forgery, because the server is making internal network calls

D.Cross-site request forgery, because the user is being tricked into submitting a form

AnswerA

A single quote in the last-name search field terminates the string literal and changes the query's syntax, allowing an attacker to modify the WHERE clause or append UNION-based logic. The database engine then throws a syntax error that reveals the injection point. This directly demonstrates that user input is concatenated into the SQL statement without parameterization, a hallmark of SQL injection.

Why this answer

The single quote character is a common SQL injection test payload. When it triggers a database syntax error, it confirms that the input is being directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to break out of the intended query structure and execute arbitrary SQL commands, making SQL injection the most likely attack.

Exam trap

The trap here is that candidates may confuse a database syntax error with a client-side script error, leading them to choose cross-site scripting, but the error message originates from the database server, not the browser.

How to eliminate wrong answers

Option B is wrong because cross-site scripting (XSS) requires the application to reflect or store user input as executable JavaScript in the browser, not cause a server-side database syntax error. Option C is wrong because server-side request forgery (SSRF) involves the server making unintended HTTP requests to internal resources, not manipulating database queries. Option D is wrong because cross-site request forgery (CSRF) tricks an authenticated user into submitting a malicious request, but the error here is a direct database syntax error from input, not a forged request from another site.

Full explanation →

586

MCQeasy

A user reports a ransomware note on one department file share, but other departments are still working normally. What is the best first containment action?

A.Shut down the entire company network immediately.

B.Disconnect the affected file share or server from the network.

C.Delete the ransom note and wait to see whether the problem returns.

D.Restore the share immediately before checking what caused the incident.

AnswerB

Isolating the affected system is the best first containment step because it helps stop the malware from spreading while preserving the rest of the environment. The goal in early incident response is to reduce impact quickly without causing unnecessary downtime. Once contained, responders can investigate scope, preserve evidence, and begin eradication and recovery.

Why this answer

The immediate priority in a ransomware incident is to contain the threat by isolating the affected system to prevent lateral movement. Disconnecting the file share or server from the network stops the ransomware from encrypting additional files or spreading to other departments via SMB or other protocols. This aligns with the NIST SP 800-61 containment strategy, which emphasizes rapid isolation without disrupting unaffected systems.

Exam trap

The trap here is that candidates may choose Option A (full network shutdown) because they think it is the safest action, but the exam emphasizes precise, least-disruptive containment that preserves evidence and limits business impact.

How to eliminate wrong answers

Option A is wrong because shutting down the entire company network is overly disruptive, may destroy volatile evidence (e.g., memory-resident malware), and is unnecessary when only one department is affected. Option C is wrong because deleting the ransom note does not remove the ransomware executable or prevent further encryption; it ignores the active threat and wastes critical response time. Option D is wrong because restoring the share without first containing the incident risks immediate re-infection, as the ransomware may still be active on the network or the restored files could be re-encrypted.

Full explanation →

587

MCQmedium

A business owner asks whether to proceed with a medium-risk issue on an internal reporting system. The vulnerability is unlikely to be exploited because the system is reachable only from a segmented admin network, and no sensitive data is stored there. The owner wants to postpone remediation until the next planned upgrade window. Which risk treatment is being chosen?

A.Risk avoidance, because the system will be upgraded later.

B.Risk acceptance, because the business is choosing to live with the remaining risk for now.

C.Risk transfer, because the upgrade window shifts responsibility to the vendor.

D.Risk escalation, because the issue is being sent to the help desk for tracking.

AnswerB

Risk acceptance is a formal treatment decision in which leadership acknowledges the residual risk and chooses to tolerate it without implementing additional controls at this time. When a business knowingly proceeds with a medium risk because a planned upgrade will later address the vulnerability, it is actively accepting the current level of risk. This decision should be documented in the risk register, assigned to a risk owner, and revisited when the upgrade is delivered.

Why this answer

Risk acceptance is the deliberate decision to acknowledge and tolerate a risk without immediate remediation. In this scenario, the business owner understands the vulnerability is low-likelihood (segmented admin network, no sensitive data) and chooses to postpone fixing it until the next planned upgrade, thereby accepting the residual risk for that period.

Exam trap

The SY0-701 exam often tests the distinction between risk acceptance and risk avoidance, where candidates mistakenly think postponing remediation equals avoidance rather than a conscious decision to live with the risk temporarily.

How to eliminate wrong answers

Option A is wrong because risk avoidance would mean eliminating the risk entirely (e.g., removing the system or blocking all access), not merely postponing remediation to a later upgrade. Option C is wrong because risk transfer shifts financial liability to a third party (e.g., purchasing cyber insurance or outsourcing), not delaying an internal fix. Option D is wrong because risk escalation involves formally notifying higher management or a risk committee to decide on a response, not simply sending a ticket to the help desk for tracking.

Full explanation →

588

MCQmedium

A SIEM correlates three failed MFA prompts for a payroll admin account from one IP, a successful login two minutes later from the same IP, and a new mailbox forwarding rule to an external address. What is the best immediate action?

A.Reset the password and leave the account enabled so the user can keep working.

B.Disable the account and revoke active sessions and tokens.

C.Delete the forwarding rule and monitor the account for a few hours.

D.Wait for the user to confirm the login before taking any action.

AnswerB

This is the best immediate containment step because the signs strongly indicate account compromise. Disabling the account stops new authentication, while revoking sessions and tokens cuts off any already-established access that could continue to act as the user. That combination contains the incident quickly and limits further mailbox manipulation, data theft, or privilege misuse while the team investigates logs and confirms scope.

Why this answer

The combination of failed MFA prompts followed by a successful login and immediate creation of an external mailbox forwarding rule is a classic indicator of account compromise (e.g., adversary-in-the-middle or token theft). Disabling the account and revoking active sessions and tokens stops the attacker from maintaining access and prevents further data exfiltration via the forwarding rule, which is the most urgent containment step in incident response.

Exam trap

CompTIA often tests the misconception that deleting the malicious artifact (forwarding rule) is sufficient, when in reality the priority is to contain the compromised account by disabling it and revoking all sessions.

How to eliminate wrong answers

Option A is wrong because resetting the password alone does not invalidate active sessions or tokens, allowing the attacker to continue using existing authenticated sessions. Option C is wrong because deleting only the forwarding rule without disabling the account leaves the attacker with continued access to the mailbox and the ability to recreate the rule or perform other malicious actions. Option D is wrong because waiting for user confirmation delays containment, giving the attacker more time to exfiltrate data or establish persistence, and the user may not be aware of the compromise.

Full explanation →

589

MCQmedium

A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?

A.Application control using an allowlist for approved executables and publishers.

B.Full-disk encryption on every laptop before deployment.

C.A stronger screen-lock timeout and automatic logoff policy.

D.A firmware password for the BIOS without any other endpoint restrictions.

AnswerA

Application control via an allowlist is a default-deny security control that only permits executables and publishers explicitly approved by the organization. It blocks unauthorized tools by verifying cryptographic hashes, publisher signatures, or full path rules before execution. This directly prevents users from running unapproved software, even if the user downloads it, because the endpoint refuses to launch anything not on the list.

Why this answer

Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.

Exam trap

The trap here is that candidates often confuse data-at-rest protection (encryption) or session management (screen lock) with application execution control, mistakenly thinking they can prevent unauthorized software from running, when in fact they address entirely different security domains.

How to eliminate wrong answers

Option B is wrong because full-disk encryption (e.g., BitLocker) protects data at rest from unauthorized access if the laptop is lost or stolen, but it does not control which applications can run on the device; it has no mechanism to block execution of unauthorized tools. Option C is wrong because a stronger screen-lock timeout and automatic logoff policy addresses session security and unauthorized physical access, but it does not prevent a user from running downloaded executables while logged in; it has no application execution control capability.

Full explanation →

590

MCQmedium

Employees authenticate once to a corporate portal and then open the help desk, payroll, and documentation apps without logging in again. The apps rely on tokens from the company's identity provider instead of storing separate passwords. What is being implemented?

A.Password synchronization between every application in the suite.

B.Federated single sign-on using the corporate identity provider.

C.Shared guest accounts for all employees on the portal.

D.Split tunneling through a VPN to speed up application access.

AnswerB

Correct. Federated SSO lets the identity provider authenticate the user once and then issue tokens or assertions that other trusted applications accept. This improves usability while reducing password sprawl and lowering the number of credentials stored by individual services. It is a standard enterprise pattern for accessing multiple apps with one login session.

Why this answer

The scenario describes single sign-on (SSO) where the corporate identity provider (IdP) issues tokens (e.g., SAML assertions, OIDC ID tokens) after initial authentication. The help desk, payroll, and documentation apps are configured as service providers that trust the IdP, so they accept the token instead of requiring separate credentials. This is federated SSO because the apps rely on a central identity provider rather than sharing password databases or synchronizing passwords.

Exam trap

The trap here is that candidates confuse 'federated single sign-on' with 'password synchronization' (Option A), because both reduce the number of logins, but federation uses tokens and trust relationships, not shared or synced passwords.

How to eliminate wrong answers

Option A is wrong because password synchronization would replicate the same password across each application's local credential store, which is not what occurs—the apps never receive or store the user's password; they rely on tokens from the IdP. Option C is wrong because shared guest accounts would violate individual accountability and audit trails, and the scenario describes employees authenticating individually, not using a common account. Option D is wrong because split tunneling is a VPN routing technique that allows some traffic to bypass the VPN tunnel for performance; it has nothing to do with authentication or token-based access to applications.

Full explanation →

591

MCQmedium

NetFlow shows one user workstation making authenticated SMB and WinRM connections to more than 40 internal hosts within 15 minutes, starting shortly after the user opened a spreadsheet attachment. No approved admin tool was running on the device. What is the best initial response?

A.Treat the traffic as normal because the workstation used valid credentials

B.Isolate the workstation and begin investigating for credential compromise or lateral movement

C.Increase the DHCP lease time to reduce network noise

D.Block all SMB and WinRM traffic across the entire enterprise

AnswerB

Isolating the workstation is the correct immediate containment step because it stops the suspicious east-west traffic from reaching other internal hosts and preserves volatile evidence. After containment, investigate for credential theft, token abuse, or malware persistence by reviewing authentication logs, process execution, scheduled tasks, and network connections. This approach aligns with incident response best practices and the Security+ emphasis on minimizing scope before remediation.

Why this answer

The sudden burst of authenticated SMB and WinRM connections from a single workstation to over 40 internal hosts immediately after opening a spreadsheet attachment is a classic indicator of lateral movement using stolen credentials. Since no approved admin tool was running, this behavior strongly suggests the user's credentials have been compromised, likely via a macro or exploit in the attachment, and an attacker is using those protocols to move laterally. Isolating the workstation stops the attack in progress and preserves evidence for forensic investigation.

Exam trap

The trap here is that candidates see 'authenticated' and assume the traffic is legitimate, missing that attackers use valid stolen credentials to authenticate, making authentication alone an unreliable indicator of safety.

How to eliminate wrong answers

Option A is wrong because valid credentials do not make the traffic normal; attackers commonly use stolen credentials to authenticate and move laterally, so authentication alone does not indicate legitimate activity. Option C is wrong because increasing the DHCP lease time does not address the security incident; it would only extend IP address assignments and has no effect on SMB/WinRM lateral movement. Option D is wrong because blocking all SMB and WinRM traffic enterprise-wide would disrupt legitimate administrative and file-sharing operations, and is an overly broad, reactive measure that does not isolate the specific compromised host or investigate the root cause.

Full explanation →

592

MCQhard

Based on the exhibit, what is the best fix so role changes take effect promptly without waiting for token expiration?

A.Increase the token lifetime so users reauthenticate less often during the workday.

B.Perform authorization checks against current directory data on each privileged request.

C.Store the JWT in a browser cookie so it refreshes automatically when roles change.

D.Disable MFA and rely only on the role claim inside the token.

AnswerB

This is the best fix because the problem is stale authorization, not failed authentication. The app is trusting a role claim that was correct at sign-in but became outdated after the HR change. Checking current directory data, or re-evaluating authorization on each sensitive action, ensures access follows the user's current status instead of an old token snapshot.

Why this answer

Performing authorization checks against current directory data (e.g., via LDAP or a policy decision point) on each privileged request ensures that role changes are enforced immediately, regardless of JWT token lifetime. This decouples authentication (token validity) from authorization (current role membership), allowing dynamic updates without waiting for token expiration or reauthentication.

Exam trap

The trap here is that candidates assume storing a JWT in a cookie or increasing token lifetime will somehow make role changes take effect, when in fact neither alters the static nature of the token's claims without a reissue or runtime authorization check.

How to eliminate wrong answers

Option A is wrong because increasing token lifetime would delay the effect of role changes even further, as users would hold stale tokens for longer periods. Option C is wrong because storing a JWT in a browser cookie does not automatically refresh its claims when roles change; the token itself remains unchanged until a new one is issued, and cookies do not trigger reauthorization. Option D is wrong because disabling MFA weakens security and does not address the core issue of stale role claims; the role claim inside the token would still be static until the token expires or is refreshed.

Full explanation →

593

MCQmedium

A SOC analyst confirms that a critical Linux virtual machine is making outbound connections to a known malicious IP address. The application owner says the VM hosts a revenue system that cannot be powered off without causing a major outage. What is the best containment action?

A.Shut down the VM immediately to stop all malicious activity.

B.Isolate the VM at the network layer while keeping it powered on.

C.Wait for the next maintenance window before taking action.

D.Reimage the VM from a known-good template immediately.

AnswerB

Isolating the VM at the network layer—for example, by applying a firewall ACL, moving the virtual NIC to a quarantine VLAN, or using vNIC-level security groups—denies the attacker further command-and-control and lateral movement while leaving the operating system, processes, and memory intact for live acquisition. This approach minimizes disruption to a critical revenue system, is reversible, and gives the SOC time to collect volatile evidence like open sockets and process lists from a Linux environment. It is the preferred initial containment action because it cuts off attacker communication without destroying the forensic state.

Why this answer

Network isolation (e.g., applying a firewall ACL or moving the VM to a quarantine VLAN) stops outbound malicious traffic while keeping the revenue-critical system powered on and available for forensic analysis. This balances security containment with business continuity, as shutting down the VM (Option A) would cause a major outage, and waiting (Option C) would allow continued data exfiltration or lateral movement.

Exam trap

The trap here is that candidates may assume immediate shutdown is always the best containment action, but the exam tests the ability to prioritize business continuity while still containing the threat through network-layer isolation.

How to eliminate wrong answers

Option A is wrong because immediately shutting down the VM would cause a major outage for the revenue system, violating the requirement to avoid disruption, and it would destroy volatile forensic evidence (e.g., memory, active connections). Option C is wrong because waiting for the next maintenance window allows the malicious outbound connections to continue, risking data exfiltration, further compromise, or lateral movement to other systems.

Full explanation →

594

MCQmedium

Based on the exhibit, which finding is the best candidate for immediate remediation or emergency mitigation?

A.VPN-EDGE01, because a critical internet-facing RCE with public exploit code has the highest risk.

B.FILE-02, because file servers often affect many users and should always come before perimeter systems.

C.TEST-VM-17, because any high-severity issue deserves the fastest response regardless of exposure.

D.PRINTER-3F, because default credentials are the easiest issue to exploit and therefore the most dangerous.

AnswerA

VPN-EDGE01 combines severity, exposure, and exploit availability. A critical remote code execution flaw on an internet-facing device is the most urgent because attackers can reach it directly from outside the organization. Public proof-of-concept code further lowers the effort needed to exploit it. When prioritizing vulnerabilities, this combination usually receives immediate remediation or emergency mitigation.

Why this answer

VPN-EDGE01 is an internet-facing device with a critical remote code execution (RCE) vulnerability that has public exploit code available. This combination of high severity, network exposure, and weaponized exploit makes it the highest risk and most urgent for immediate remediation or emergency mitigation.

Exam trap

The trap here is that candidates may prioritize by severity alone (high vs. critical) or by ease of exploitation (default credentials), ignoring the critical factor of network exposure and the presence of public exploit code, which together create the highest immediate risk.

How to eliminate wrong answers

Option B is wrong because file servers, while affecting many users, do not inherently present a higher risk than an internet-facing device with a critical RCE; prioritizing by user count over exposure and exploitability is a common prioritization error. Option C is wrong because a high-severity issue on a non-internet-facing test VM (TEST-VM-17) is less urgent than a critical RCE on an internet-facing edge device, as the test VM has limited exposure and lower likelihood of exploitation. Option D is wrong because default credentials on a printer (PRINTER-3F), while easily exploitable, typically have limited impact compared to a critical RCE on a perimeter VPN gateway that could lead to full network compromise.

Full explanation →

595

Matchingmedium

Match each data example to the most appropriate classification label. 1. A public marketing flyer approved for external posting. 2. An internal org chart and office directory meant only for employees. 3. A customer case file with contact details and order history. 4. A vault export containing API keys and encryption secrets.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Public

Internal

Confidential

Restricted

Why these pairings

These matches follow a typical data classification scheme: Public for non-sensitive info, Internal for company-only data, Confidential for customer PII, and Restricted for highly sensitive secrets.

Full explanation →

596

MCQmedium

After a routine dependency update, a development team notices that the customer portal begins making outbound connections to an unfamiliar domain during startup. The domain is not part of the application design, and the behavior started immediately after the third-party library was updated. Which threat is most likely?

A.Supply-chain compromise

B.Evil twin access point

C.Bluetooth pairing abuse

D.DNS poisoning on the client network

AnswerA

A supply-chain compromise occurs when an attacker injects malicious code into a legitimate software dependency, which is then distributed through trusted update channels. In this scenario, the routine dependency update is the infection vector; the trojanized library can spawn unexpected outbound connections to command-and-control servers to exfiltrate data or receive instructions. The timing correlation between the update and anomalous network traffic makes this the most direct and probable cause.

Why this answer

The scenario describes a supply-chain compromise, where a trusted third-party library has been maliciously altered to include unauthorized outbound connections. This is a classic software supply-chain attack, as the dependency update introduced code that phones home to an unfamiliar domain, indicating the library's integrity was compromised before or during distribution.

Exam trap

The trap here is that candidates may confuse supply-chain compromise with DNS poisoning, because both involve unexpected outbound connections, but DNS poisoning would affect all network traffic and not be tied to a specific library update.

How to eliminate wrong answers

Option B (Evil twin access point) is wrong because it involves a rogue Wi-Fi access point impersonating a legitimate one to intercept network traffic, which is unrelated to a dependency update triggering outbound connections. Option C (Bluetooth pairing abuse) is wrong because it exploits Bluetooth vulnerabilities for unauthorized access or data exfiltration, not relevant to a third-party library update causing outbound connections. Option D (DNS poisoning on the client network) is wrong because it corrupts DNS cache to redirect traffic to malicious sites, but the behavior started immediately after the library update and targets a specific domain, not a broad redirection of all traffic.

Full explanation →

597

MCQmedium

SIEM alerts show one workstation making SMB connections to 30 internal hosts within 10 minutes, followed by remote service creation and repeated access attempts to admin shares. The workstation also begins authenticating with several privileged accounts. What is the most likely activity?

A.A distributed denial-of-service attack launched from a compromised internal host.

B.DNS tunneling used to exfiltrate data through allowed name-resolution traffic.

C.ARP spoofing to redirect local traffic at the network layer.

D.Lateral movement after credential compromise or endpoint takeover.

AnswerD

The workstation is behaving like an attacker foothold that is probing internal systems, using administrative shares, and attempting remote service creation. Those are strong signs of lateral movement after credentials or the device itself have been compromised. The privileged-account authentication attempts also suggest the attacker is trying to expand access and reach higher-value systems inside the environment.

Why this answer

The sequence of SMB connections to many internal hosts, followed by remote service creation and repeated access attempts to admin shares, combined with authentication using privileged accounts, is the classic pattern of lateral movement. This indicates the attacker has already compromised the workstation (endpoint takeover) or obtained valid credentials and is now using SMB and PsExec-like techniques to move laterally across the network, escalate privileges, and establish persistence.

Exam trap

The trap here is that candidates may confuse lateral movement with a DDoS attack because of the many outbound connections, but the key differentiator is the use of admin shares and privileged account authentication, which are hallmarks of post-exploitation lateral movement, not volumetric attacks.

How to eliminate wrong answers

Option A is wrong because a DDoS attack would generate massive traffic to overwhelm a target, not involve targeted SMB connections to admin shares or privileged account authentication. Option B is wrong because DNS tunneling exfiltrates data by encoding it in DNS queries/responses, not by making SMB connections or creating remote services. Option C is wrong because ARP spoofing operates at Layer 2 to intercept traffic on a local subnet, not to perform SMB-based lateral movement or authenticate with multiple privileged accounts across many hosts.

Full explanation →

598

MCQmedium

An EDR console shows `mshta.exe` launching `powershell.exe` from a user profile directory, followed by a script that never writes a new executable to disk. Minutes later, the host begins making regular outbound HTTPS connections to an unfamiliar IP address. What type of malware behavior is most likely being observed?

A.Fileless attack

B.Ransomware

C.Worm

D.Rootkit

AnswerA

Fileless attacks rely on built-in Windows tools and memory-resident activity instead of dropping a traditional executable on disk. The observed process chain of mshta.exe launching powershell.exe is a classic indicator, as these living-off-the-land binaries can run malicious scripts or download payloads directly into memory. This technique evades file-based antivirus detection and often leaves no persistent artifact on the filesystem.

Why this answer

The EDR console shows mshta.exe (a Microsoft binary for executing HTML Applications) launching PowerShell from a user profile directory, followed by a script that never writes a new executable to disk. This is classic fileless malware behavior, where the malicious payload runs entirely in memory (e.g., via PowerShell or .NET reflection) without dropping a file, making it harder for traditional signature-based antivirus to detect. The subsequent outbound HTTPS connections to an unfamiliar IP indicate command-and-control (C2) communication, consistent with a fileless attack that persists only in memory.

Exam trap

The trap here is that candidates may confuse 'fileless' with 'no malware at all' or think it must involve a rootkit, but the key indicator is the absence of a file write combined with in-memory script execution via trusted system binaries.

How to eliminate wrong answers

Option B (Ransomware) is wrong because ransomware typically encrypts files and demands payment, often writing a ransom note to disk and modifying file extensions; the described behavior of never writing an executable to disk and making outbound HTTPS connections is more indicative of a fileless C2 channel, not encryption or extortion. Option C (Worm) is wrong because worms self-propagate across networks without user interaction, often exploiting vulnerabilities or using removable media; the scenario focuses on a single host's in-memory execution and C2 traffic, not lateral movement or replication. Option D (Rootkit) is wrong because rootkits are designed to hide their presence by modifying the operating system kernel or system calls, often persisting via drivers or bootkits; the described behavior of launching PowerShell from mshta.exe and making outbound connections is a user-mode fileless attack, not a kernel-level stealth mechanism.

Full explanation →

599

Multi-Selecteasy

After a phishing campaign, several employees entered credentials on a fake login page. Management wants a control that both improves user behavior and gives the security team a way to measure whether click rates are going down. Which two actions best meet that goal? Select two.

Select 2 answers

A.Send a reminder email once a year and stop there

B.Run role-based phishing awareness training

C.Disable all external email for every employee

D.Use simulated phishing exercises with reporting metrics

E.Tell users to ignore suspicious messages unless IT calls first

AnswersB, D

Role-based phishing awareness training maps real-world scenarios to each employee's job function—finance teams practice spotting BEC invoices, HR recognizes W-2 scams, and developers identify credential-harvesting pages—so the lessons feel relevant and memorable. This approach reduces cognitive overload by focusing on the attack types most likely to target that role and allows training teams to track competence before and after the campaign.

Why this answer

Role-based phishing awareness training (B) directly improves user behavior by tailoring content to specific job functions, making the training more relevant and effective. Simulated phishing exercises with reporting metrics (D) provide a measurable way for the security team to track click rates over time, enabling data-driven assessment of improvement. Together, they address both behavioral change and quantifiable measurement.

Exam trap

CompTIA often tests the distinction between passive awareness (like annual emails) and active, measurable training (like simulated phishing with metrics), leading candidates to mistakenly select a single control that only addresses one aspect of the goal.

Full explanation →

600

MCQeasy

An administrator wants to add a new vendor IP range to a firewall rule in production. What is the best change-management step to reduce risk?

A.Apply the change immediately during peak business hours.

B.Test and approve the change before implementing it in production.

C.Allow the entire vendor subnet permanently without review.

D.Skip documentation to speed up the rollout.

AnswerB

Change management should include review, approval, and testing before production deployment. This reduces the chance of outages, misconfigurations, and unintended access. A controlled change window and validation steps are especially important for firewall rules because small mistakes can break connectivity or create security gaps.

Why this answer

Change management requires testing and approval before applying changes to production systems. Adding a new vendor IP range to a firewall rule without validation could inadvertently allow malicious traffic or block legitimate traffic, leading to a security breach or service disruption. Testing in a non-production environment or using a change window ensures the rule behaves as intended and aligns with the organization's security policy.

Exam trap

The trap here is that candidates may think immediate implementation (Option A) is acceptable for urgent security fixes, but the question specifies adding a new vendor IP range, which is a planned change that must follow proper change management procedures to avoid unintended access or downtime.

How to eliminate wrong answers

Option A is wrong because applying the change immediately during peak business hours violates change management best practices and risks causing outages or security gaps when the network is under heavy load, making rollback difficult. Option C is wrong because allowing the entire vendor subnet permanently without review bypasses the principle of least privilege and could expose the network to unnecessary risk if the vendor's IP range changes or includes untrusted addresses. Option D is wrong because skipping documentation undermines audit trails and incident response; without records, administrators cannot verify what changes were made or revert them if needed.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 526–600