Security+ SY0-701 SY0-701 Questions 601–675 | Page 9/14

601

MCQeasy

A help desk team wants users to be unable to install unsanctioned browser extensions or freeware on corporate Windows laptops, while approved business apps still run. Which endpoint control is best?

A.Full-disk encryption on every laptop.

B.Application allowlisting or application control.

C.A remote access VPN.

D.A desktop wallpaper policy.

AnswerB

This is the best choice because allowlisting permits only approved software and blocks unapproved tools, extensions, and installers. It is a strong way to reduce malware risk and limit user-driven software sprawl. Approved business applications can still run because they are explicitly allowed, which preserves usability while enforcing a controlled endpoint environment.

Why this answer

Application allowlisting (or application control) is the correct endpoint control because it explicitly defines which software executables, scripts, and installers are permitted to run on the system. By default, all unapproved applications—including unsanctioned browser extensions and freeware—are blocked, while approved business apps are allowed to execute. This directly addresses the requirement to prevent unauthorized installations while maintaining normal operations for sanctioned software.

Exam trap

The trap here is that candidates often confuse data protection controls (like encryption) or network controls (like VPN) with application execution controls, failing to recognize that only allowlisting directly governs what software can run on the endpoint.

How to eliminate wrong answers

Option A is wrong because full-disk encryption protects data at rest from unauthorized access if the laptop is lost or stolen, but it does not control which applications or extensions a user can install or run. Option C is wrong because a remote access VPN secures network communications between the laptop and corporate resources, but it has no ability to block local software installations or enforce application policies. Option D is wrong because a desktop wallpaper policy is a visual configuration setting that cannot enforce any security controls over application execution or installation.

Full explanation →

602

MCQmedium

A team deploys an e-commerce application on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. The company wants to reduce the chance that attackers exploit outdated software on the VM itself. Which responsibility remains with the company?

A.Replace the cloud provider’s physical security controls with on-site guards.

B.Patch and harden the guest operating system and application running on the VM.

C.Install new firmware on the physical host server maintained by the provider.

D.Set the data center’s perimeter access badge policy.

AnswerB

In IaaS, the organization is responsible for the guest OS and everything above it, including applications and configuration. If attackers may exploit outdated software on the VM, the company must handle patching, hardening, and secure configuration of that environment.

Why this answer

In an IaaS model, the cloud provider is responsible for the security of the cloud (datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes patching and hardening the guest OS and application on the VM. The company must manage vulnerabilities in the software stack it controls to prevent exploitation of outdated components.

Exam trap

The trap here is confusing the shared responsibility model: candidates often assume the provider handles all security (including OS patching) because they secure the hypervisor, but in IaaS, the customer retains full responsibility for the guest OS and applications.

How to eliminate wrong answers

Option A is wrong because physical security controls (e.g., on-site guards) are the provider's responsibility under the shared responsibility model; the company cannot replace them. Option C is wrong because firmware updates for the physical host server are the provider's responsibility, not the customer's, as the customer has no access to the hypervisor or host hardware. Option D is wrong because setting data center perimeter access badge policies is a physical security task owned by the provider, not the company using the IaaS VM.

Full explanation →

603

MCQmedium

Help desk staff must restart one Windows service and read its event logs on 150 servers, but they should not have local administrator rights or interactive logon to the systems. Which approach best supports this requirement?

A.Create one shared local administrator account for the entire help desk team.

B.Add the staff to the local Administrators group on every server.

C.Use a Just Enough Administration constrained endpoint for the allowed tasks.

D.Run the maintenance job under each technician's personal account on a schedule.

AnswerC

JEA (Just Enough Administration) is the correct technique because it lets you register a constrained PowerShell endpoint that exposes only the exact cmdlets needed — for example, Restart-Service filtered to the specific service name and Get-Content/Get-WinEvent for its log files. Users connect to the JEA endpoint and execute the permitted commands under a virtual account with just enough privilege, while full console or admin access is never granted. JEA also automatically records session transcripts, preserving an auditable trail that ties each action back to the individual technician.

Why this answer

Just Enough Administration (JEA) allows you to create constrained PowerShell endpoints that delegate specific administrative tasks—such as restarting a service and reading event logs—without granting full local administrator rights or interactive logon. By defining role capabilities that limit cmdlets and parameters, help desk staff can perform only the required operations on all 150 servers via a constrained endpoint, meeting the security requirement precisely.

Exam trap

The trap here is that candidates often assume that adding users to the local Administrators group or using a shared admin account is the simplest way to delegate tasks, overlooking that JEA provides a secure, auditable, and least-privilege alternative that specifically prevents interactive logon and limits command scope.

How to eliminate wrong answers

Option A is wrong because a shared local administrator account violates the principle of least privilege and non-repudiation, as it cannot audit individual actions and provides full administrative access. Option B is wrong because adding staff to the local Administrators group grants them interactive logon rights and unrestricted control over each server, which directly contradicts the requirement to avoid local admin rights and interactive logon. Option D is wrong because running maintenance jobs under each technician's personal account on a schedule does not prevent interactive logon or grant administrative rights, but it fails to provide the on-demand, constrained access needed for ad-hoc restarts and log reading, and it introduces scheduling complexity without addressing the delegation requirement.

Full explanation →

604

MCQmedium

Several employees in a branch office report that their laptops automatically connected to a network named "CorpWiFi" even though they were away from the office. Shortly afterward, a few users saw a captive portal asking them to re-enter company credentials. Which threat best explains this situation?

A.Evil twin access point impersonating the legitimate wireless network

B.Bluetooth pairing abuse from a nearby device

C.DNS poisoning caused by a compromised resolver

D.NFC relay attack against the laptops' login process

AnswerA

An evil twin is a rogue access point configured to look like the trusted wireless network, often using the same or a very similar SSID. Because clients may auto-connect, attackers can capture credentials or inspect traffic through the fake network. The captive portal and automatic connection away from the office strongly suggest a malicious wireless impersonation setup.

Why this answer

The scenario describes an evil twin attack where a rogue access point broadcasts the SSID "CorpWiFi" to trick laptops into automatically connecting. Once connected, the attacker presents a fake captive portal to harvest credentials. This exploits the fact that client devices often prioritize known SSIDs without verifying the authenticity of the access point, relying solely on the network name.

Exam trap

The trap here is that candidates may confuse an evil twin with a rogue AP that requires manual connection, but the key detail is the automatic connection, which exploits the client's saved network profile, not just the presence of a malicious AP.

How to eliminate wrong answers

Option B is wrong because Bluetooth pairing abuse requires active pairing or discovery, not automatic connection to a Wi-Fi network, and does not involve a captive portal for credential harvesting. Option C is wrong because DNS poisoning would redirect traffic to malicious sites after connection, but it does not explain why laptops automatically connected to a network named "CorpWiFi" away from the office. Option D is wrong because NFC relay attacks require physical proximity (typically centimeters) and are used for contactless payment or access card cloning, not for connecting to Wi-Fi networks or presenting a captive portal.

Full explanation →

605

MCQeasy

Which action is the best example of accounting in AAA?

A.The system checks a password and a one-time code before allowing access.

B.The system records the username, timestamp, and files opened during the session.

C.The system grants access to the finance folder after the user is approved.

D.The system forces the user to change their password after 90 days.

AnswerB

Accounting is the tracking and logging part of AAA. Recording the username, timestamp, and accessed files creates an audit trail that can be reviewed later for investigations, compliance, or troubleshooting. Good accounting data helps organizations understand who did what, when it happened, and what resources were affected.

Why this answer

Accounting in AAA (Authentication, Authorization, and Accounting) focuses on tracking user activities and resource usage. Option B correctly describes this by specifying the recording of username, timestamp, and files accessed, which are typical audit log entries used for monitoring and compliance.

Exam trap

The trap here is that candidates confuse Accounting with Authentication or Authorization, especially when options involve access control or credential management, but Accounting is strictly about logging and tracking usage, not granting or verifying access.

How to eliminate wrong answers

Option A is wrong because checking a password and one-time code is a multi-factor authentication process, which falls under Authentication, not Accounting. Option C is wrong because granting access to a folder after approval is Authorization, which determines what resources a user can access. Option D is wrong because forcing a password change after 90 days is a password policy enforcement mechanism, which relates to Authentication or security policy, not Accounting.

Full explanation →

606

MCQmedium

Based on the exhibit, which capability should be added so the SaaS app automatically creates, updates, and disables user accounts as directory changes occur?

A.Require MFA on the SaaS login page and leave account provisioning manual.

B.Add SCIM provisioning between the directory and the SaaS application.

C.Change the password rotation interval to every 30 days for all users.

D.Store credentials in a shared spreadsheet so the help desk can disable access faster.

AnswerB

SCIM (System for Cross-domain Identity Management) is a RESTful API standard that automatically exchanges user identity attributes between an identity provider and cloud apps. When an admin changes a user's status in the directory, SCIM pushes that event to the SaaS application, creating, updating, or deactivating the account in near real time. This eliminates the window during which terminated employees retain access and removes the need for manual provisioning. It directly satisfies the requirement for automated identity lifecycle synchronization.

Why this answer

SCIM (System for Cross-domain Identity Management) is the standard protocol designed to automate user provisioning and deprovisioning between an identity provider (like a directory) and a service provider (like a SaaS app). By adding SCIM provisioning, the SaaS app can automatically create, update, and disable user accounts in response to changes in the directory, eliminating the need for manual account management.

Exam trap

The trap here is that candidates may confuse authentication mechanisms (like MFA) or password policies with identity lifecycle management, failing to recognize that SCIM is the specific protocol designed for automated provisioning and deprovisioning.

How to eliminate wrong answers

Option A is wrong because requiring MFA only adds an authentication layer and does not automate account lifecycle management; manual provisioning remains, which does not address the requirement. Option C is wrong because changing the password rotation interval to 30 days is a password policy change that does not automate the creation, update, or disabling of user accounts based on directory changes. Option D is wrong because storing credentials in a shared spreadsheet introduces security risks and does not provide automated provisioning; it only offers a manual, insecure method for disabling access.

Full explanation →

607

MCQeasy

Based on the exhibit, which supply-chain threat is most likely?

A.Dependency compromise

B.Brute-force attack

C.SQL injection

D.Privilege escalation

AnswerA

The application began contacting an unfamiliar domain immediately after a dependency update, and the package came from a newly created repository account. That strongly suggests dependency compromise, a supply-chain issue where a trusted library has been replaced or altered with malicious behavior.

Why this answer

The exhibit shows a dependency on a third-party library (e.g., a JavaScript package from a CDN or a software component from an external repository). A dependency compromise occurs when an attacker injects malicious code into that trusted third-party component, which is then pulled into the organization's environment during updates or builds. This is the most likely supply-chain threat because it directly exploits the trust placed in external dependencies.

Exam trap

The SY0-701 exam often tests the distinction between supply-chain attacks (compromising a trusted third-party component) and direct attacks on the organization's own systems; the trap here is that candidates may confuse a dependency compromise with a brute-force attack or SQL injection because they all involve unauthorized access, but the key difference is the vector—the dependency is externally sourced and trusted.

How to eliminate wrong answers

Option B (Brute-force attack) is wrong because it targets authentication mechanisms (e.g., SSH, RDP) by guessing credentials, not the integrity of third-party components in the supply chain. Option C (SQL injection) is wrong because it exploits improper input validation in database queries, not the trust relationship with external dependencies. Option D (Privilege escalation) is wrong because it involves gaining elevated access within a system after initial compromise, not the initial infiltration via a compromised dependency.

Full explanation →

608

MCQmedium

The CIO wants to compare two mitigation options for a payment system outage and justify the budget request in dollars. The team already knows the likely downtime window, annual incident frequency, and estimated revenue loss per hour. Which approach would best support the decision?

A.Qualitative risk analysis

B.Quantitative risk analysis

C.Risk avoidance

D.Risk acceptance

AnswerB

Quantitative risk analysis uses measurable values like threat frequency, downtime, and financial loss to calculate metrics such as Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE). This approach enables a direct monetary comparison of mitigation alternatives, supplying the cost-benefit data the CIO needs to justify spending in budget requests.

Why this answer

Quantitative risk analysis (Option B) is correct because it uses numerical data—such as the likely downtime window, annual incident frequency, and estimated revenue loss per hour—to calculate a monetary value (e.g., Annualized Loss Expectancy). This directly supports the CIO's need to compare mitigation options in dollars and justify a budget request with hard numbers, unlike qualitative methods that rely on subjective ratings.

Exam trap

The trap here is that candidates confuse qualitative risk analysis with quantitative risk analysis, assuming that any risk assessment involving 'analysis' can produce dollar figures, but qualitative methods only yield ordinal rankings, not monetary values.

How to eliminate wrong answers

Option A is wrong because qualitative risk analysis uses subjective ratings (e.g., high/medium/low) rather than hard dollar figures, so it cannot provide the precise monetary comparison the CIO needs for budget justification. Option C is wrong because risk avoidance means eliminating the activity causing the risk (e.g., discontinuing the payment system), which is not a comparison of mitigation options but a drastic measure that would halt business operations. Option D is wrong because risk acceptance means acknowledging the risk without taking action, which does not involve comparing mitigation options or justifying a budget request—it simply accepts the potential loss.

Full explanation →

609

MCQmedium

A hospital's claims portal has two open risks. Risk A is an internet-facing login page with a low-severity software flaw, but monitoring shows a steady increase in automated login attempts. Risk B is an internal file share with a medium-severity patch gap, but only a small admin group can access it and no exploitation is observed. Leadership can fund only one remediation this month. Which risk should be prioritized first?

A.Prioritize Risk A because it is exposed to the internet and already shows active attack interest.

B.Prioritize Risk B because a medium-severity flaw is always more important than a low-severity flaw.

C.Accept Risk A because no confirmed compromise has occurred yet.

D.Transfer Risk A to an insurer because public-facing exposure cannot be reduced.

AnswerA

Risk A has the higher overall business risk because exposure and observed attack activity raise the likelihood of exploitation. Even if the flaw is rated low severity, an internet-facing system is more likely to be targeted quickly and broadly. Prioritization should consider both impact and likelihood, not severity alone. Addressing the public login page first reduces the chance of a successful compromise across a high-value service.

Why this answer

Risk A should be prioritized because the internet-facing login page is exposed to the public attack surface, and the steady increase in automated login attempts indicates active reconnaissance or credential-stuffing attacks. Even though the software flaw is low severity, the combination of internet exposure and active attacker interest significantly elevates the likelihood of exploitation, making it a higher priority than an internal file share with no observed exploitation.

Exam trap

The trap here is that candidates fixate on severity ratings (low vs. medium) without considering the risk equation, especially the critical factor of active attack interest and internet exposure, which the SY0-701 exam emphasizes in the context of threat intelligence and attack surface management.

How to eliminate wrong answers

Option B is wrong because it incorrectly assumes severity alone determines priority; in risk management, likelihood (internet exposure, active attack interest) and impact must be weighed together, and a medium-severity flaw with no exploitation and limited access is less urgent than a low-severity flaw under active attack. Option C is wrong because accepting a risk without remediation is only appropriate when the residual risk is within the organization's tolerance, but here the active attack interest and internet exposure create an unacceptable level of risk that requires immediate action.

Full explanation →

610

MCQhard

An online retailer is moving its public web app, internal API, and database into separate zones. Public users must reach only the web tier. The web tier must contact the app tier, and only the app tier may query the database. Admins should manage all servers from a hardened jump host. Which design best meets these goals and minimizes lateral movement?

A.Place all servers in one VLAN and rely on host-based firewalls to block unwanted traffic.

B.Create separate DMZ, application, and database zones with default-deny east-west rules and use a jump host for administration.

C.Put the database in the DMZ so the web tier can connect to it without extra firewall rules.

D.Expose the application tier to the Internet and use NAT to hide the database subnet.

AnswerB

Placing web, application, and database appliances into separate security zones with default-deny east-west rules enforces a least-privilege network. The DMZ only exposes the public-facing web tier; the application zone is not directly reachable from the Internet, and the database zone accepts connections solely from the application subnet. A jump host (bastion) centralizes administrative access from a hardened, auditable entry point, preventing direct management of sensitive tiers from unsecured networks. This tiered design contains a successful web-server compromise, as later moves to the application or database zones are blocked unless explicitly allowlisted.

Why this answer

It implements a multi-tier network architecture with separate DMZ, application, and database zones, enforcing default-deny east-west traffic rules. This ensures that public users can only reach the web tier, the web tier can only communicate with the app tier, and only the app tier can query the database, while all administrative access is funneled through a hardened jump host, which minimizes lateral movement by restricting inter-zone traffic to only what is explicitly required.

Exam trap

The trap here is that candidates often assume placing the database in the DMZ simplifies connectivity, but this violates the principle of defense in depth by removing network segmentation between the web tier and sensitive data storage.

How to eliminate wrong answers

Option A is wrong because placing all servers in one VLAN with host-based firewalls does not provide network-level segmentation; a compromised host could still potentially bypass host firewalls or exploit misconfigurations, allowing lateral movement across all tiers. Option C is wrong because putting the database in the DMZ exposes it to the same network segment as the web tier, violating the principle of least privilege and increasing the attack surface, as the database should never be directly accessible from the DMZ. Option D is wrong because exposing the application tier to the Internet directly exposes internal logic and APIs to potential attacks, and NAT alone does not enforce access control between tiers, leaving the database vulnerable to lateral movement if the app tier is compromised.

Full explanation →

611

MCQeasy

A file contains employee Social Security numbers and bank account details. The company uses the labels Public, Internal, Confidential, and Restricted. Which label is most appropriate?

A.Public, because employees may need to share it with outside vendors

B.Internal, because only company staff should see it

C.Confidential, because the information is sensitive but not highly regulated

D.Restricted, because it contains highly sensitive personal and financial information

AnswerD

Restricted is correct because this file contains highly sensitive personal data (SSNs) and financial account numbers, which are commonly classified at the highest level of restriction. Such data requires strong access controls, encryption, audit logging, and adherence to privacy regulations, as a breach could lead to identity theft, financial fraud, and legal penalties. Restricted classification ensures only authorized personnel with a legitimate business need can access the data.

Why this answer

Social Security numbers and bank account details are classified as personally identifiable information (PII) and financial data, which are subject to strict regulatory requirements (e.g., GDPR, PCI DSS). The 'Restricted' label is designed for the most sensitive data that requires the highest level of access control and encryption, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates may confuse 'Confidential' with 'Restricted', assuming any sensitive data fits the 'Confidential' label, but 'Restricted' is specifically reserved for data that is both highly sensitive and subject to regulatory compliance requirements.

How to eliminate wrong answers

Option A is wrong because labeling this data as 'Public' would allow unrestricted access, violating data privacy regulations and exposing the company to legal penalties. Option B is wrong because 'Internal' is typically used for data that is not sensitive but should not be shared externally, whereas SSNs and bank details require more stringent controls. Option C is wrong because 'Confidential' is often used for sensitive business data (e.g., trade secrets), but it does not imply the highest level of protection needed for highly regulated personal financial information; 'Restricted' is the appropriate label for such data.

Full explanation →

612

MCQeasy

A development team updates a third-party software library used by its web application. After the release, new deployments begin making unexpected outbound connections to an unfamiliar domain. What type of threat is most likely?

A.Dependency compromise

B.Phishing

C.Rootkit infection

D.Password spraying

AnswerA

Dependency compromise happens when a trusted third-party library, package, or component is altered to include malicious behavior. The unusual outbound connections after an update are a strong sign that the dependency may have been tampered with.

Why this answer

Dependency compromise. This scenario describes a supply chain attack where a third-party library has been maliciously altered or replaced, causing the web application to make unauthorized outbound connections to an attacker-controlled domain. Such compromises often occur when developers unknowingly integrate a tampered version of a library from a compromised repository or via a typosquatting attack, leading to data exfiltration or command-and-control (C2) communication.

Exam trap

The trap here is that candidates may confuse a dependency compromise with a rootkit infection (Option C) because both involve stealthy, unauthorized behavior, but a rootkit specifically targets the OS kernel, not a web application's third-party library.

How to eliminate wrong answers

Option B is wrong because phishing is a social engineering attack that tricks users into revealing credentials or installing malware via deceptive emails or messages, not a technical compromise of a software library. Option C is wrong because a rootkit infection is a type of malware that hides its presence and provides persistent, stealthy access to an operating system, not a supply chain attack on a web application's dependencies. Option D is wrong because password spraying is a brute-force attack that attempts a few common passwords against many accounts, not a method to alter a third-party library's behavior.

Full explanation →

613

MCQmedium

During testing, entering ' OR '1'='1 into a login field returns all user records instead of rejecting the input. What is the best fix to address this flaw?

A.Add client-side JavaScript validation to block quote characters

B.Use parameterized queries or prepared statements for database access

C.Store passwords in a stronger hash format

D.Change the login page to HTTPS

AnswerB

Parameterized queries separate code from data, which prevents SQL injection even when attackers supply special characters.

Why this answer

The flaw is a classic SQL injection vulnerability, where unsanitized user input is concatenated directly into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data, ensuring that input like ' OR '1'='1 is treated as a literal string value, not executable code. This is the industry-standard mitigation per OWASP and effectively prevents injection attacks.

Exam trap

The trap here is that candidates often confuse input validation (like blocking quotes) with the proper defense of parameterized queries, not realizing that blacklisting characters is ineffective and that the correct fix is to use prepared statements to separate code from data.

How to eliminate wrong answers

Option A is wrong because client-side JavaScript validation can be easily bypassed by disabling JavaScript or using tools like Burp Suite to send raw HTTP requests, so it provides no real security against SQL injection. Option C is wrong because stronger password hashing (e.g., bcrypt, Argon2) addresses credential storage security, not the SQL injection vulnerability that allows an attacker to extract all records without needing passwords. Option D is wrong because HTTPS encrypts data in transit but does not prevent the server from executing malicious SQL commands; the injection occurs after decryption on the server side.

Full explanation →

614

MCQmedium

A team runs a confidential document repository on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. Which task remains the organization’s responsibility?

A.Patching the physical hosts inside the cloud provider's datacenter.

B.Replacing the provider's hypervisor when a new version is released.

C.Hardening the guest operating system and controlling access to the repository application.

D.Managing the cloud provider's physical badge access for the server room.

AnswerC

In IaaS, the organization is responsible for what it deploys on the virtual machine, including the guest operating system, its configuration, patching, and application-level access controls. Those tasks directly affect who can use the document repository and how securely the workload runs. Shared responsibility means the provider handles the platform, while the customer secures the OS and data-layer usage.

Why this answer

In an IaaS model, the cloud provider is responsible for the security of the cloud (physical datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes hardening the guest OS, configuring firewalls, managing access controls, and patching the operating system and applications. Option C correctly identifies the organization's duty to secure the guest OS and the repository application.

Exam trap

The trap here is confusing the IaaS shared responsibility model with PaaS or SaaS, where the provider handles more of the stack; candidates often assume the provider patches the guest OS or manages application access, but in IaaS those are customer responsibilities.

How to eliminate wrong answers

Option A is wrong because patching physical hosts is the cloud provider's responsibility under the shared responsibility model; the customer has no access to the physical infrastructure. Option B is wrong because replacing the hypervisor is a provider-managed task; the customer only interacts with the virtual machine and its guest OS. Option D is wrong because managing physical badge access to the server room is a physical security control that falls entirely on the cloud provider, not the customer.

Full explanation →

615

MCQhard

Based on the exhibit, which security principle is the proposed workflow most directly enforcing?

A.Least privilege, because each person gets only the minimum access needed for the task.

B.Defense in depth, because multiple layers of security are added around firewall changes.

C.Separation of duties, because no single person can create, approve, and implement the same production change.

D.Need-to-know, because the ticket is visible only to assigned people.

AnswerC

This is the correct principle because the redesign intentionally splits the workflow among different roles. One person drafts the change, another approves it, and a third implements it. That reduces fraud and mistakes by preventing one individual from controlling every step. The limited ticket visibility also supports the same idea, but the central security principle is separation of duties.

Why this answer

The proposed workflow enforces separation of duties by requiring three distinct roles—requester, approver, and implementer—to complete a single firewall change. No single person can both create and approve the change, nor can they implement it without prior approval. This directly prevents any one individual from having end-to-end control over a production change, which is the core of separation of duties.

Exam trap

The trap here is that candidates confuse separation of duties with least privilege because both involve limiting actions, but separation of duties specifically divides a process across multiple people, whereas least privilege limits the scope of permissions per person.

How to eliminate wrong answers

Option A is wrong because least privilege focuses on granting only the minimum permissions needed for a role, not on dividing a process into multiple roles; the workflow does not specify access levels or permissions. Option B is wrong because defense in depth involves multiple overlapping security controls (e.g., firewall, IDS, encryption), not a procedural separation of tasks within a single change process.

Full explanation →

616

MCQhard

Based on the exhibit, what should the records manager do next?

A.Delete the records on schedule because the retention period is still the primary rule.

B.Move the records to long-term archive and continue the normal deletion schedule.

C.Print the records, delete the digital copies, and keep the paper copies instead.

D.Suspend deletion and preserve all related records until the legal hold is formally lifted.

AnswerD

A legal hold takes precedence over the routine retention schedule. Because counsel explicitly instructed the organization to preserve all related communications and prevent deletion or alteration, the records manager must stop auto-deletion and ensure the data remains intact. This supports legal defensibility and audit readiness while avoiding accidental spoliation of evidence.

Why this answer

When a legal hold is in effect, it overrides any standard retention or deletion policies. The records manager must suspend all deletion activities and preserve all related records until the legal hold is formally lifted, as failure to do so could result in spoliation of evidence and legal penalties.

Exam trap

The trap here is that candidates may assume retention schedules are absolute, but legal holds are a higher-priority legal obligation that overrides standard data lifecycle policies.

How to eliminate wrong answers

Option A is wrong because it ignores the legal hold, which supersedes the retention period as the primary rule when litigation is pending. Option B is wrong because moving records to long-term archive does not satisfy the legal hold requirement; the hold requires preservation of all records, not just a change in storage location, and continuing a normal deletion schedule could destroy relevant data. Option C is wrong because printing digital copies and deleting the originals would destroy metadata and potentially violate the legal hold, as the original digital records may be required for e-discovery in their native format.

Full explanation →

617

MCQmedium

After a new search feature goes live, logs show requests containing `UNION SELECT` and the application returns database error messages. Security testing confirms attackers can retrieve rows from other tables by modifying the query string. Which fix is best?

A.Rewrite the database access layer to use parameterized queries or prepared statements.

B.Encode special characters in the browser before submitting the search form.

C.Disable detailed error messages so attackers cannot see the database name.

D.Increase password complexity requirements for all application users.

AnswerA

Parameterized queries separate user input from SQL code, which prevents attacker-controlled strings from changing the query structure. That directly addresses the injection flaw rather than only hiding symptoms. Because the app is already returning database errors and leaking data, the safest fix is to eliminate dynamic SQL construction at the source of the problem.

Why this answer

The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.

Exam trap

The trap here is that candidates often choose to hide error messages (Option C) thinking it stops the attack, but this only obscures the information leakage without fixing the underlying SQL injection flaw, which can still be exploited via blind techniques.

How to eliminate wrong answers

Option B is wrong because encoding special characters in the browser is a client-side measure that can be easily bypassed by attackers sending raw HTTP requests, and it does not prevent server-side SQL injection. Option C is wrong because disabling detailed error messages only hides the symptoms (e.g., database name exposure) but does not prevent the attacker from exploiting the SQL injection vulnerability; they can still extract data via blind SQL injection techniques. Option D is wrong because increasing password complexity does nothing to address the SQL injection vulnerability in the search feature; it is a security control for authentication, not input validation.

Full explanation →

618

Multi-Selectmedium

A security analyst is investigating a potential data exfiltration incident. Which three of the following indicators are most commonly associated with a data exfiltration attack? (Choose three.)

Select 3 answers

.Unusual outbound network traffic, especially during non-business hours

.Multiple failed login attempts from a single user account

.Large volumes of data being transferred to an external IP address

.A sudden increase in DNS queries to a known malicious domain

.A spike in CPU usage on a database server

.An employee receiving a phishing email with a malicious attachment

Why this answer

Unusual outbound network traffic, especially during non-business hours, is a classic indicator of data exfiltration because attackers often schedule transfers when monitoring is less active. Large volumes of data being transferred to an external IP address directly suggests that sensitive data is being moved outside the organization. A sudden increase in DNS queries to a known malicious domain can indicate DNS tunneling, where data is encoded in DNS requests to bypass traditional network controls.

Exam trap

The SY0-701 exam often tests the distinction between indicators of an active exfiltration event (like data transfer or unusual traffic patterns) and indicators of a precursor attack (like failed logins), so candidates mistakenly select the latter as a direct exfiltration indicator.

Full explanation →

619

MCQmedium

Sales staff use company laptops on public Wi-Fi and travel frequently. The company wants the disk contents unreadable if a laptop is stolen, even if the drive is removed and placed in another system. Which control is the best fit?

A.Require a screen lock after five minutes of inactivity.

B.Enable full-disk encryption with a hardware-backed key store such as a TPM, preferably with a pre-boot PIN.

C.Encrypt only the most sensitive folders with file-level encryption.

D.Rely on remote wipe because the device will usually connect to the internet again.

AnswerB

Full-disk encryption with a TPM-backed key store ensures the disk's encryption key is sealed to the device's firmware state, and adding a pre-boot PIN requires something you know in addition to the hardware. Without the PIN, the TPM won't release the key, so the drive cannot be decrypted even if it's removed and mounted elsewhere. This protects all data at rest, including OS files, and is the strongest practical defense when a device might fall into a thief's hands on the road.

Why this answer

Full-disk encryption (FDE) with a hardware-backed key store like a TPM ensures that the entire disk contents are encrypted at rest. Even if the drive is removed and placed in another system, the decryption key remains bound to the original TPM, and a pre-boot PIN adds an additional authentication factor, making the data unreadable without both the TPM and the correct PIN.

Exam trap

The trap here is that candidates often choose remote wipe (Option D) because it sounds proactive, but they overlook the critical requirement that the device must be online for remote wipe to work, which is not guaranteed for a stolen laptop that may never connect to the internet.

How to eliminate wrong answers

Option A is wrong because a screen lock after five minutes of inactivity only protects the device while it is locked; it does not encrypt the disk, so if the drive is removed and placed in another system, the data is fully readable. Option C is wrong because file-level encryption only protects specific folders, leaving other areas of the disk (e.g., system files, temp files, and unencrypted user data) exposed when the drive is removed. Option D is wrong because remote wipe relies on the device connecting to the internet; if the laptop is stolen and never reconnects, or if the thief immediately removes the drive, the wipe command cannot execute, leaving the data accessible.

Full explanation →

620

Multi-Selecthard

An organization stores full payment card numbers, analysts need the last four digits for investigation, and the backup team is worried about ransomware and stolen backup media. Which three controls best address these requirements? Select three.

Select 3 answers

A.Tokenize primary account numbers before they reach analytics, reporting, or test systems.

B.Store backups on the same production storage array to simplify restore operations.

C.Encrypt backup sets with keys managed outside the backup repository itself.

D.Use simple masking only in spreadsheets while leaving the source database unchanged.

E.Keep one immutable or air-gapped backup copy to resist ransomware and theft.

AnswersA, C, E

Tokenization replaces sensitive values with nonusable substitutes while preserving business usefulness for many workflows. Analysts can still correlate records, but exposed reports and test data no longer reveal the true card number. This is especially valuable for payment data because it reduces the number of environments that ever handle the actual secret value.

Why this answer

Tokenization replaces the full primary account number (PAN) with a unique token that retains the last four digits for analytics, so analysts can perform investigations without exposing sensitive cardholder data. This directly satisfies PCI DSS requirements for minimizing the use of full PANs in non-production environments, while preserving the utility needed for fraud analysis or reporting.

Exam trap

The trap here is that candidates often confuse tokenization with masking or encryption, assuming any obfuscation technique is sufficient, but tokenization is the only option that irreversibly removes the full PAN from analytics systems while preserving the last four digits for investigation.

Full explanation →

621

Multi-Selecthard

A packet capture from a branch office shows the default gateway IP mapped to a MAC address that does not belong to the router. The same suspicious MAC also answers for the DNS server IP, and gratuitous ARP replies appear every 30 seconds. Which two attacks best match this evidence? Select two.

Select 2 answers

A.ARP spoofing or poisoning is occurring on the local network.

B.A man-in-the-middle interception is likely happening between clients and internal services.

C.The network is experiencing a SYN flood against the gateway.

D.An external host is performing broad port scanning on public services.

E.A password-spraying campaign is targeting remote logins.

AnswersA, B

The evidence fits ARP poisoning because an unauthorized MAC address is associating itself with trusted IP addresses such as the gateway and DNS server. Gratuitous ARP replies reinforce the cache manipulation and allow the attacker to redirect traffic at the layer 2 level. This is the classic setup for a local network spoofing attack.

Why this answer

The evidence shows the default gateway IP is mapped to a MAC address that does not belong to the router, and the same suspicious MAC also answers for the DNS server IP. This is a classic indicator of ARP spoofing or poisoning, where an attacker sends forged ARP replies to associate their MAC address with the IP addresses of critical network devices, such as the gateway and DNS server. Gratuitous ARP replies every 30 seconds further confirm an active ARP poisoning attack, as the attacker repeatedly broadcasts these unsolicited replies to maintain the poisoned ARP cache entries on victim hosts.

Exam trap

The trap here is that candidates may confuse ARP spoofing with a SYN flood or other denial-of-service attacks, failing to recognize that the specific evidence of a mismatched MAC address and gratuitous ARP replies directly points to ARP cache poisoning, not a network-level flood.

Full explanation →

622

MCQmedium

After seizing a suspected insider's laptop, a responder makes a bit-for-bit image of the drive. The legal team asks what step most directly proves the image was not altered after acquisition. What should be done?

A.Record the laptop's hostname and the user who last logged in.

B.Compute and document cryptographic hashes of the source media and the forensic image.

C.Copy the most recent files to a USB drive for quick review.

D.Return the laptop to the user once the image is saved.

AnswerB

Compute and document cryptographic hashes of both the source media and the forensic image using a collision-resistant algorithm like SHA-256. The hash generated from the source device and the hash of the acquired image must match exactly, providing strong evidence that no data was altered, added, or lost. This integrity check is a foundational practice in forensic imaging and is necessary to demonstrate the evidence is authentic and admissible in court.

Why this answer

Computing and documenting cryptographic hashes (e.g., SHA-256 or MD5) of both the source media and the forensic image immediately after acquisition creates a verifiable digital fingerprint. If the hash values match, it proves that the image is an exact, unaltered copy of the original drive. This step is foundational to maintaining the chain of custody and ensuring data integrity in forensic investigations.

Exam trap

The trap here is that candidates may confuse documentation steps (like recording hostnames) with integrity verification, or think that copying files to a USB drive is a valid forensic preservation method, when only cryptographic hashing provides mathematical proof of non-alteration.

How to eliminate wrong answers

Option A is wrong because recording the hostname and last logged-in user is part of documentation but does not provide any cryptographic verification that the image was not altered after acquisition. Option C is wrong because copying the most recent files to a USB drive for quick review introduces a separate copy that is not a bit-for-bit duplicate and does not prove the integrity of the original forensic image. Option D is wrong because returning the laptop to the user after imaging violates chain of custody and could allow tampering with the original evidence, but it does not directly prove the image was unaltered.

Full explanation →

623

MCQeasy

An HR assistant should be able to view employee records, but should not have access to payroll administration or IT server tools. Which access model is best for assigning permissions by job role?

A.Role-based access control

B.Shared local administrator accounts

C.Open access for all employees

D.Biometric authentication

AnswerA

Role-based access control (RBAC) maps permissions to defined job functions rather than to individual identities, so an HR assistant receives exactly the permissions needed for HR tasks—viewing employee records—without elevation to unrelated administrative rights. In NIST's RBAC model, users are assigned to roles, roles have permissions on objects, and session constraints can enforce least privilege dynamically. This aligns with the principle of least privilege and scales cleanly as personnel changes, making it the appropriate access control model for an HR assistant role.

Why this answer

Role-based access control (RBAC) is the correct model because it assigns permissions based on job functions rather than individual users. In this scenario, the HR assistant role would be granted read/write access to employee records, while being explicitly denied access to payroll administration and IT server tools, ensuring least privilege and separation of duties. RBAC simplifies administration by grouping permissions into roles, which can be easily assigned or revoked as job responsibilities change.

Exam trap

The trap here is that candidates confuse authentication (biometrics) with authorization (access control), or assume that shared accounts or open access can be secured by policy alone, ignoring the fundamental need for role-based permission segregation.

How to eliminate wrong answers

Option B is wrong because shared local administrator accounts provide unrestricted, non-repudiable access to all system resources, which violates the principle of least privilege and would grant the HR assistant full control over payroll and IT tools. Option C is wrong because open access for all employees would allow every user, including the HR assistant, to view and modify payroll and IT server data, directly contradicting the requirement to restrict access. Option D is wrong because biometric authentication is an identity verification method (something you are), not an authorization model; it controls who logs in, not what permissions they have after authentication.

Full explanation →

624

MCQmedium

Threat intelligence reports that an adversary changes domains daily and uses disposable cloud hosting, but the malware binary hash and a unique mutex name remain unchanged across incidents. Which indicator is the best candidate for immediate detection rule creation?

A.The daily domain names, because they are the easiest items to collect.

B.The malware file hash, because it directly identifies the reused sample.

C.The cloud provider name, because the attacker uses disposable infrastructure.

D.The time of day the campaign was observed, because the attacker is consistent.

AnswerB

The file hash is the strongest immediate IOC here because the same malware sample is being reused across incidents. If the binary remains unchanged, the hash will match exactly and can be used for fast blocking or hunting. Volatile infrastructure such as domains and cloud hosting changes too frequently to serve as the primary detection point.

Why this answer

The malware file hash (e.g., SHA-256) provides a static, deterministic identifier for the exact binary sample. Since the adversary reuses the same malware binary across incidents, the hash remains unchanged and can be used to create a precise detection rule (e.g., a YARA rule or hash-based IOC blocklist) that will reliably match the malicious file regardless of network-level churn like domain or IP changes.

Exam trap

The trap here is that candidates often choose the 'easiest' or most visible indicator (domain names) without considering stability and false-positive risk, whereas the exam tests the principle that static, unique artifacts (like file hashes) are superior for detection rule creation.

How to eliminate wrong answers

Option A is wrong because daily domain names are highly volatile and ephemeral; they change every 24 hours, making them poor candidates for a stable detection rule and requiring constant updates. Option C is wrong because the cloud provider name (e.g., AWS, Azure, GCP) is a generic attribute shared by millions of legitimate services; using it as a detection indicator would cause massive false positives and does not uniquely identify the adversary's infrastructure. Option D is wrong because the time of day the campaign was observed is not a reliable or unique indicator; attackers can easily shift their activity window, and time-based rules lack specificity and are prone to false positives.

Full explanation →

625

MCQhard

A Windows file server was built from a gold image, but six months later a scan shows Remote Desktop enabled, SMBv1 re-enabled, and Print Spooler running. The same drift appears on several other servers after emergency troubleshooting. Security wants to return the environment to the approved baseline and prevent the changes from coming back. What is the best solution?

A.Document the deviations and rely on manual checks after each maintenance window

B.Deploy configuration management that enforces the hardened baseline continuously

C.Run a vulnerability scan more often and close the findings in the ticketing system

D.Increase storage capacity so the image can be rebuilt faster next time

AnswerB

Continuous configuration management is the best answer because it can reapply the approved baseline and correct drift across many systems automatically. This approach does more than detect the problem; it helps prevent the same insecure settings from persisting after troubleshooting or emergency changes. It is the most effective way to standardize hardening at scale and keep the environment aligned to policy.

Why this answer

Configuration management tools like Ansible, DSC, or Group Policy can continuously enforce a hardened baseline by reverting unauthorized changes (e.g., disabling SMBv1, stopping Print Spooler, disabling RDP) at a defined interval or on a trigger. This prevents configuration drift without relying on manual intervention or reactive scanning, directly addressing the root cause of the problem.

Exam trap

The trap here is that candidates confuse reactive vulnerability scanning (Option C) with proactive configuration enforcement, or mistakenly think manual documentation (Option A) or faster rebuilds (Option D) address the continuous drift problem.

How to eliminate wrong answers

Option A is wrong because documenting deviations and relying on manual checks is reactive and does not prevent drift from recurring, especially after emergency troubleshooting. Option C is wrong because running vulnerability scans more often only detects drift after it occurs, and closing findings in a ticketing system does not enforce the baseline or prevent re-enabling of services. Option D is wrong because increasing storage capacity to rebuild images faster does not prevent configuration drift; it only reduces recovery time after a rebuild, which is not a proactive solution.

Full explanation →

626

MCQmedium

A help desk analyst receives a phone call from someone claiming to be the CFO, who says their phone was lost while traveling and requests an immediate MFA reset and temporary bypass for payroll access. The caller knows the CFO's last name and the company name, but cannot answer the callback verification question. What attack technique is most likely being used?

A.Phishing

B.Vishing

C.Baiting

D.Watering hole attack

AnswerB

Vishing (voice phishing) is the correct classification because the entire attack is executed over a direct phone call, a hallmark of voice-based social engineering. The attacker creates a false sense of urgency and asserts authority, likely impersonating an executive or IT administrator, to pressure the help desk analyst into bypassing standard verification and changing authentication controls. This call is a deliberate manipulation of a human process, not a technical exploit, and vishing is specifically designed to target help desk personnel who have the power to reset credentials or alter account access.

Why this answer

The caller is using voice communication to impersonate a high-level executive (CFO) and manipulate the help desk analyst into bypassing security controls, which is the defining characteristic of vishing (voice phishing). The request for an MFA reset and temporary bypass is a social engineering tactic to exploit the analyst's authority bias and urgency, and the inability to pass callback verification confirms the caller is not legitimate.

Exam trap

The trap here is that candidates may confuse vishing with phishing because both involve social engineering, but vishing is specifically voice-based, and the question's context of a phone call and callback verification failure directly points to vishing, not email-based phishing.

How to eliminate wrong answers

Option A (Phishing) is wrong because phishing typically involves deceptive emails, text messages, or websites to steal credentials or deliver malware, not a direct phone call requesting an MFA bypass. Option C (Baiting) is wrong because baiting relies on offering something enticing (e.g., a free USB drive or download) to trick a victim into performing an action, not impersonating an executive over the phone. Option D (Watering hole attack) is wrong because it compromises a website frequently visited by the target group to infect them with malware, not a direct social engineering call to a help desk.

Full explanation →

627

MCQmedium

A security analyst is reviewing the results of a dynamic application security test (DAST) on a new e-commerce application. The report indicates that the application's product search functionality is vulnerable to blind SQL injection. The analyst is tasked with recommending a remediation to the development team. The developers currently concatenate user input directly into SQL queries. Which of the following recommendations would most effectively and permanently mitigate this vulnerability?

A.Implement a web application firewall (WAF) rule to block suspicious SQL keywords in search parameters.

B.Sanitize user input by escaping single quotes and other special characters before concatenation.

C.Replace dynamic SQL queries with parameterized prepared statements.

D.Encode all user input using HTML entity encoding before database operations.

AnswerC

Parameterized prepared statements ensure that user input is always treated as data, not executable code. The database compiles the SQL statement with parameter placeholders, and the actual values are bound separately. This completely prevents SQL injection because the input cannot alter the query structure. This is the industry-standard permanent fix.

Why this answer

Parameterized prepared statements separate SQL logic from user input, ensuring that input is always treated as data, not executable code. This permanently prevents SQL injection by design, regardless of the input content, unlike input filtering or WAF rules which can be bypassed.

Exam trap

The trap here is that candidates often choose input sanitization (Option B) because they confuse escaping with proper parameterization, not realizing that escaping is a fragile, context-dependent workaround that fails against advanced injection techniques like time-based blind SQLi or multi-byte character attacks.

Why the other options are wrong

A WAF can block known SQL injection patterns but does not fix the root cause; attackers can bypass WAF rules using encoding or other techniques, and it does not prevent injection in all cases.

Escaping special characters is error-prone and can be bypassed by attackers using alternative encodings or complex payloads; it does not eliminate the SQL injection vulnerability because the query structure remains dynamic.

HTML entity encoding is designed to prevent XSS attacks by neutralizing HTML special characters, not SQL injection. It does not alter SQL syntax or prevent malicious SQL from being interpreted by the database.

When would these options actually be correct?

In a scenario where the organization cannot modify application code (e.g., legacy system) and needs a temporary compensating control while planning a code rewrite, a WAF would be the correct recommendation to reduce immediate risk.

In a scenario where the application uses a legacy database system that does not support parameterized queries, and the developer must manually handle input within a stored procedure that already uses parameterized calls, input sanitization might be a secondary defense.

This option would be correct in a question about mitigating stored or reflected XSS vulnerabilities in a web application, where user input is displayed in HTML pages and must be encoded to prevent script execution.

Why candidates pick the wrong answer

Candidates may think a WAF provides a quick, easy fix without requiring code changes, overlooking that it is a detective/preventive control rather than a permanent remediation.

Candidates often confuse input sanitization with secure coding practices, believing that escaping characters is sufficient to prevent SQL injection, without understanding that parameterized queries provide a structural separation of code and data.

Candidates may confuse encoding techniques, thinking that any encoding of user input can prevent injection attacks, or they may overgeneralize the principle of 'sanitizing input' without understanding the specific context of SQL injection.

Full explanation →

628

MCQmedium

A public-facing web service suddenly becomes very slow. NetFlow shows a high volume of small DNS queries leaving attacker-controlled systems and much larger DNS responses arriving at the victim's IP address from many different resolvers. Which attack is taking place?

A.DNS amplification DDoS

B.Replay attack

C.ARP poisoning

D.Session fixation

AnswerA

DNS amplification is a reflection-based volumetric DDoS attack: the attacker sends small UDP queries (often using the ANY or DNSSEC record types) to numerous open recursive resolvers, spoofing the victim's IP address as the source. The resolvers then send large responses (up to 50-100 times the request size) to the victim, saturating its bandwidth and connection table. Netflow would show a flood of inbound UDP traffic from many DNS servers to the victim, with little or no corresponding outbound traffic, which matches the observed slowdown.

Why this answer

This is a DNS amplification DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to open DNS resolvers, which then send large DNS responses to the victim. The high volume of small queries and much larger responses from many resolvers is the classic signature of an amplification attack, exploiting the UDP protocol's lack of source verification.

Exam trap

The trap here is that candidates may confuse the high volume of DNS traffic with a normal DNS flood or a reflection attack, but the key differentiator is the amplification ratio—small queries generating large responses—which is unique to amplification DDoS, not a simple reflection or volumetric flood.

How to eliminate wrong answers

Option B is wrong because a replay attack involves capturing and retransmitting valid network traffic (e.g., authentication packets) to impersonate a user or gain unauthorized access, not generating high-volume DNS traffic from multiple resolvers. Option C is wrong because ARP poisoning is a local network attack that manipulates ARP tables to intercept traffic on a LAN, not a distributed attack using DNS queries and responses across the internet.

Full explanation →

629

MCQeasy

A user's laptop starts renaming many documents, and a ransom note appears on the desktop. What is the best immediate action for the help desk to recommend?

A.Shut down the laptop immediately and leave it on the desk.

B.Disconnect the laptop from the network to contain the infection.

C.Delete the ransom note and continue working until the next reboot.

D.Install a new browser extension to block the attacker.

AnswerB

Disconnecting the laptop from the network deprives the ransomware of both lateral movement and command-and-control communication. Without network access, it cannot propagate via SMB/Windows Admin Shares, reach mapped drives, or download additional payloads/ransomware variants, while the live system stays intact for volatile memory collection. Physically unplugging the Ethernet cable or disabling Wi-Fi in the OS is a practical containment step that should be done before any reboot or cleanup.

Why this answer

Disconnecting the laptop from the network immediately stops the ransomware from communicating with its command-and-control (C2) server, preventing further encryption of network shares and lateral movement. This containment step is critical before any remediation, as it isolates the threat and preserves evidence for forensic analysis.

Exam trap

The trap here is that candidates confuse immediate containment with system shutdown, mistakenly believing that powering off stops the attack, when in fact network isolation is the correct first step to halt both encryption and lateral spread.

How to eliminate wrong answers

Option A is wrong because shutting down the laptop may allow the ransomware to complete its encryption process during shutdown and could destroy volatile evidence (e.g., memory-resident encryption keys). Option C is wrong because deleting the ransom note does not stop the encryption process; the ransomware continues to encrypt files in the background, and working normally risks further damage and potential spread to network resources. Option D is wrong because installing a browser extension does not address the active ransomware infection; it is an irrelevant and potentially harmful action that could introduce additional vulnerabilities.

Full explanation →

630

MCQhard

Based on the exhibit, what should the security team add before approving the vendor's requested change?

A.A broader employee awareness training requirement for the vendor's staff.

B.A contract clause requiring prior written approval for new subprocessors and flow-down security obligations.

C.A larger cyber insurance policy to cover possible losses if the vendor is breached.

D.A request for the vendor to send monthly screenshots of its backup jobs.

AnswerB

This is the strongest control because the risk comes from an unapproved change in the supply chain. Prior approval gives the customer visibility into who will process the data, and flow-down obligations ensure the subcontractor must meet the same security requirements. That directly addresses third-party risk, unlike insurance or generic training.

Why this answer

The exhibit shows the vendor requesting a change to use a new subprocessor for data storage. The security team must ensure that the vendor's contract includes a clause requiring prior written approval for new subprocessors and that security obligations flow down to them. This directly addresses the risk of unauthorized data handling by third parties, which is a key concern in vendor risk management.

Exam trap

CompTIA often tests the distinction between reactive controls (like insurance or monitoring) and proactive contractual controls (like approval clauses) in vendor change management scenarios, leading candidates to pick a monitoring or financial solution instead of the correct governance measure.

How to eliminate wrong answers

Option A is wrong because broader employee awareness training for the vendor's staff does not address the specific risk of a new subprocessor being introduced without oversight; training is a general control, not a contractual safeguard for subprocessor changes. Option C is wrong because a larger cyber insurance policy covers financial losses after a breach but does not prevent the unauthorized use of a subprocessor or enforce security obligations proactively. Option D is wrong because monthly screenshots of backup jobs provide only a point-in-time verification of backups, not a mechanism to control or approve changes to subprocessors or ensure security requirements are met.

Full explanation →

631

MCQmedium

A SOC analyst receives an alert from the VPN appliance and identity platform. In the last 10 minutes, a user account had 14 failed VPN logons from one country, then one successful login from a different country. The user calls the help desk and says they have not used their account today. What should the analyst do first?

A.Block the foreign IP address at the firewall and wait for more alerts before acting.

B.Disable the user account and revoke active sessions or tokens while escalating the event as a suspected account compromise.

C.Reset the user password and close the alert because the new password will stop the attack.

D.Reimage the user’s laptop immediately to remove any possible malware before taking other steps.

AnswerB

The successful login after repeated failures, combined with the user’s confirmation that they were not active, strongly suggests compromise. The fastest effective containment is to disable the account and invalidate existing sessions or tokens so the attacker cannot continue using stolen credentials. This preserves the ability to investigate while stopping ongoing access. It is a stronger first action than a password reset alone, which may leave active tokens usable.

Why this answer

The combination of multiple failed logins from one country followed by a successful login from a different country, combined with the user's denial of activity, is a classic indicator of account compromise (e.g., credential stuffing or token theft). Disabling the account and revoking active sessions/tokens immediately stops the attacker's access, preventing further lateral movement or data exfiltration, while escalation ensures proper incident response. This aligns with the CompTIA incident response process: identification, containment, eradication, and recovery.

Exam trap

The trap here is that candidates may think resetting the password (Option C) is sufficient, but they overlook that active sessions and tokens must be explicitly revoked to fully contain the compromise, as per CompTIA's emphasis on session management in incident response.

How to eliminate wrong answers

Option A is wrong because blocking the foreign IP address alone is insufficient—the attacker may use multiple IPs or proxies, and waiting for more alerts delays containment, allowing the attacker to continue malicious activity. Option C is wrong because resetting the password without revoking active sessions or tokens leaves existing authenticated sessions intact; the attacker could still use a stolen session token or OAuth refresh token to maintain access. Option D is wrong because reimaging the laptop is premature and unnecessary—the compromise is likely credential-based, not malware-based, and the user's laptop may not be involved; this wastes time and resources before proper investigation.

Full explanation →

632

MCQmedium

A user reports that a shared department drive is rapidly renaming files and creating ransom notes on a Windows file server. The SOC confirms suspicious activity is still occurring on that server. What should the incident responder do first?

A.Shut down the server immediately to stop all malicious activity.

B.Isolate the server from the network while keeping it powered on if possible.

C.Restore the drive from backup before collecting any evidence.

D.Inform users to continue working until the forensic team arrives.

AnswerB

Network isolation contains the spread while preserving memory and other volatile evidence for analysis.

Why this answer

The immediate priority is to contain the ransomware outbreak by isolating the server from the network, which stops the malicious activity from spreading to other systems while preserving volatile evidence (e.g., running processes, memory contents) for forensic analysis. Powering off the server (Option A) would destroy this critical evidence and may not stop the encryption process if it is already in memory. Isolation via network disconnection (e.g., disabling the NIC or unplugging the cable) is the standard first step in incident response for active ransomware.

Exam trap

The trap here is that candidates assume immediate shutdown (Option A) is the safest action, but CompTIA emphasizes containment without destroying evidence, making network isolation the correct first step in active ransomware incidents.

How to eliminate wrong answers

Option A is wrong because shutting down the server immediately destroys volatile evidence (e.g., memory-resident malware, active network connections) and may allow the ransomware to complete encryption on disk before the OS halts. Option C is wrong because restoring from backup before collecting evidence can overwrite forensic artifacts and may reintroduce the vulnerability if the root cause is not identified. Option D is wrong because informing users to continue working risks further data loss and lateral movement of the ransomware across the network.

Full explanation →

633

MCQmedium

After a successful phishing attempt, the security team adds MFA, email sandboxing, endpoint isolation, and immutable backups so that one failed safeguard does not expose the company. Which principle does this best illustrate?

A.Defense in depth

B.Need-to-know

C.Availability

D.Compensating control

AnswerA

Adding MFA after a successful phishing attack exemplifies defense in depth because the security team is introducing an additional, independent control layer beyond passwords. If a user's credentials are compromised via phishing, the attacker still lacks the second factor (e.g., a time-based one-time code or hardware key), thereby preventing unauthorized access. This strategy assumes no single control is fail-proof and employs overlapping safeguards—such as email filtering, security awareness training, and MFA—to reduce overall risk when any one control fails.

Why this answer

Defense in depth is the best fit because the organization is using several independent safeguards across different layers: user authentication, email inspection, endpoint containment, and backup recovery. The idea is that a single compromise, such as one successful phishing email, should not lead directly to full compromise. Security+ expects you to recognize layered protection as a strategy, not just list individual tools.

Why others are wrong: Need-to-know concerns restricting information to only those who require it for their job. Availability is one of the CIA triad objectives, but it is not a layered security strategy. Compensating control refers to an alternative measure used because the preferred control is unavailable or impractical; here the organization is not replacing one missing control, but strengthening multiple defenses at once.

Full explanation →

634

Matchingmedium

Match each security monitoring artifact from the SOC alert queue to the best investigation focus.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Investigate possible script-based malware execution launched through a document

Check for suspicious domain lookups that may indicate command-and-control activity

Look for beaconing behavior from a potentially compromised endpoint

Assess for stolen credentials or credential-stuffing activity

Why these pairings

Each alert type suggests a specific investigation focus: phishing requires email analysis; malware needs file/behavior analysis; brute force focuses on auth logs; data exfiltration looks at outbound traffic; privileged misuse examines user activity; ransomware involves encryption events.

Full explanation →

635

MCQeasy

An HR department wants each employee to access only the systems required for their job. A new hire should receive the same permissions as other HR specialists, and changes to the role should update access centrally. Which access model should be used?

A.Role-based access control (RBAC)

B.Attribute-based access control (ABAC)

C.Multi-factor authentication (MFA)

D.Privileged access management (PAM)

AnswerA

Role-based access control (RBAC) maps permissions to job roles rather than to individuals; HR can define a role like 'HR Specialist' with access solely to the HRIS, payroll, and recruitment systems, then assign employees into that role. This centralizes onboarding, role changes, and terminations because access changes to a role propagate to all members, which directly satisfies the need for each employee to access only the systems their job requires. RBAC enforces least privilege at the role level, making it the correct access control model for this scenario.

Why this answer

Role-based access control (RBAC) is the correct model because it assigns permissions based on job roles (e.g., HR specialist), ensuring that a new hire automatically inherits the same access as others in that role. Centralized role management allows changes to the role's permissions to propagate to all members, meeting the requirement for centralized updates.

Exam trap

The trap here is that candidates often confuse ABAC with RBAC because both can use attributes, but RBAC relies on static role assignments, whereas ABAC evaluates dynamic attributes at runtime, making RBAC the correct choice for role-based inheritance and centralized updates.

How to eliminate wrong answers

Option B (ABAC) is wrong because it evaluates access based on attributes (e.g., time, location, department) rather than a predefined role, which would require complex policy rules for each user and does not inherently support role-based inheritance. Option C (MFA) is wrong because it is an authentication mechanism, not an access control model; it verifies identity but does not define what resources a user can access. Option D (PAM) is wrong because it is designed to manage and monitor privileged accounts (e.g., administrators), not to assign standard user permissions based on job roles.

Full explanation →

636

MCQmedium

A security analyst receives a phone call from an individual claiming to be a member of the IT help desk. The caller states that an emergency security update requires the analyst's password immediately, and the request sounds urgent. The analyst notices the caller's voice is unfamiliar and the background noise is inconsistent with an office environment. Which type of social engineering attack is being attempted?

A.Phishing

B.Vishing

C.Spear phishing

D.Pretexting

AnswerB

Vishing (voice phishing) is the correct answer because the attack uses a phone call to impersonate a legitimate entity and trick the victim into providing sensitive information, such as a password. The urgency and caller ID spoofing are common vishing tactics.

Why this answer

This is a vishing (voice phishing) attack because the threat actor uses a phone call to impersonate IT help desk personnel and pressures the analyst into disclosing sensitive credentials. Vishing specifically leverages voice communication to bypass email-based security controls and exploit human trust through urgency and authority.

Exam trap

The trap here is that candidates confuse pretexting with vishing, but CompTIA distinguishes vishing as a subtype of social engineering that specifically uses voice technology, whereas pretexting is the broader act of fabricating an identity or scenario regardless of the communication channel.

Why the other options are wrong

Phishing typically involves deceptive emails or websites, not phone calls. This scenario describes a voice-based attack, which is vishing.

Spear phishing involves targeted, personalized emails or messages, not phone calls. The attack described uses a phone call, which is characteristic of vishing, not spear phishing.

Pretexting involves creating a fabricated scenario to obtain information, but the question specifically describes a phone call requesting a password, which is vishing (voice phishing). The attack is not pretexting because the caller is not establishing a false identity beyond claiming to be IT help desk; the primary threat is the phone-based phishing attempt.

When would these options actually be correct?

A security analyst receives an email that appears to be from the IT help desk, requesting password reset due to an emergency update. The email contains a link to a fake login page. This would be phishing.

A security analyst receives a personalized email that appears to be from the IT help desk, addressing them by name and referencing their specific role, requesting password reset due to a security update. This targeted email attack would be spear phishing.

Pretexting would be correct if the scenario described an attacker impersonating a help desk technician who calls to verify account details by asking for the analyst's mother's maiden name or other personal information, without directly requesting a password, and uses that information to access the system later.

Why candidates pick the wrong answer

Candidates may broadly associate any social engineering attack that requests credentials with phishing, without distinguishing the delivery method (email vs. phone).

Candidates may confuse spear phishing with vishing because both involve impersonation of a trusted entity, but they forget that spear phishing is exclusively a digital (email/message) attack, not a voice call.

Candidates may confuse pretexting with vishing because both involve impersonation and deception over the phone, but pretexting focuses on building a false narrative to extract information, while vishing is a direct phishing attempt via voice.

Full explanation →

637

MCQeasy

A development team needs a centralized service to store, rotate, and control access to encryption keys for applications. Which solution best fits?

A.Key management service, because it centralizes key storage and rotation controls.

B.Port forwarding rule, because it allows applications to reach the encryption system.

C.Load balancer, because it distributes encryption requests across servers.

D.Web application firewall, because it protects the keys from injection attacks.

AnswerA

A key management service is designed to store, manage, rotate, and control access to cryptographic keys. It helps reduce the risk of hardcoded or poorly protected keys and gives administrators a central place to enforce lifecycle management. This is the best fit when multiple applications need secure, organized key handling.

Why this answer

A key management service (KMS) centralizes the lifecycle of cryptographic keys, including secure storage, automated rotation, and fine-grained access control via IAM policies. This directly meets the requirement for a centralized service to store, rotate, and control access to encryption keys for applications, as KMS is purpose-built for these tasks.

Exam trap

The trap here is that candidates may confuse a general security appliance (like a WAF or load balancer) with a specialized cryptographic service, or mistakenly think network-level controls (port forwarding) can manage key lifecycles, when only a dedicated key management service provides centralized storage, rotation, and access control for encryption keys.

How to eliminate wrong answers

Option B is wrong because a port forwarding rule is a network address translation (NAT) mechanism that redirects traffic from one IP/port to another; it does not store, rotate, or control access to encryption keys. Option C is wrong because a load balancer distributes incoming network traffic across multiple servers to ensure availability and performance; it has no capability to manage cryptographic key lifecycles or enforce access policies on keys. Option D is wrong because a web application firewall (WAF) inspects and filters HTTP/HTTPS traffic to block web-based attacks like SQL injection or XSS; it does not provide centralized key storage, rotation, or access control for encryption keys.

Full explanation →

638

MCQmedium

A security analyst is investigating a web application that allows users to input a filename to view its contents. The application passes the user input directly to a system command without sanitization. An attacker submits the input 'file.txt; cat /etc/passwd' and successfully retrieves the contents of the password file. Which type of attack occurred?

A.Cross-site scripting (XSS)

B.SQL injection

C.Command injection

D.Directory traversal

AnswerC

Command injection is a server-side vulnerability where an attacker inserts operating system commands into input fields that are passed to system functions like exec() or system() without sanitization. The semicolon is a classic delimiter that allows chaining a second command after the intended one, enabling arbitrary code execution with the web server's privileges. This directly explains why the scenario points to command injection rather than other injection classes.

Why this answer

The application passes user input directly to a system command without sanitization. The attacker's input 'file.txt; cat /etc/passwd' uses a semicolon to terminate the intended command and execute a second command, which retrieves the password file. This is a classic command injection attack, where arbitrary system commands are executed via the vulnerable interface.

Exam trap

The SY0-701 exam often tests the distinction between command injection and directory traversal by using a payload that includes both a path and a command separator, leading candidates to mistakenly choose directory traversal when the core exploit is command execution via shell metacharacters.

Why the other options are wrong

The attack involves injecting a system command via user input, not injecting client-side scripts into web pages viewed by other users.

The attack involves executing system commands via user input, not manipulating a database query. SQL injection targets database queries, not system commands.

Directory traversal involves accessing files outside the web root by manipulating path parameters (e.g., '../../etc/passwd'), not by injecting commands. The attacker here injected a command separator (';') to execute an arbitrary system command, which is command injection.

When would these options actually be correct?

A web application reflects user input without sanitization, and an attacker submits a script like <script>alert('XSS')</script> that executes in another user's browser, stealing session cookies.

A web application takes user input and directly concatenates it into a SQL query without sanitization, e.g., 'SELECT * FROM users WHERE id = ' + user_input. An attacker submits '1 OR 1=1' to retrieve all records.

A question where user input is used to construct a file path (e.g., 'filename=../../../etc/passwd') and the application fails to validate or sanitize the path, allowing access to sensitive files outside the intended directory.

Why candidates pick the wrong answer

Candidates may confuse any injection-based attack with XSS, especially when the input is unsanitized, without recognizing the specific context of command execution versus script execution.

Candidates may confuse injection attacks, thinking any injection is SQL injection, or they may not distinguish between command injection and SQL injection.

Candidates may confuse the retrieval of '/etc/passwd' with directory traversal, but the key difference is the use of a command separator (';') versus path traversal sequences ('../').

Full explanation →

639

MCQmedium

A security team discovers that several laptops occasionally boot from a removable drive before Windows loads, allowing unapproved recovery tools to run. Management wants to prevent this with the least impact on normal users. Which control is the best fit?

A.Disable all USB ports permanently on every laptop.

B.Enable secure boot and restrict the firmware boot order so only the approved internal boot path is allowed.

C.Uninstall the endpoint protection agent and replace it with manual inspections.

D.Move user data to cloud storage so rogue boot media can no longer access it.

AnswerB

Secure boot helps ensure the platform loads trusted boot components, while boot-order restrictions prevent users from starting the system from unapproved removable media. Together, they address the problem at the pre-OS layer and preserve normal daily use. This is a targeted hardening change that is less disruptive than disabling all external ports.

Why this answer

Secure Boot ensures that only signed, trusted firmware and bootloaders execute during the startup process. By restricting the firmware boot order to the internal drive only, the laptop will ignore removable media during boot, preventing unapproved recovery tools from running before Windows loads. This has minimal impact on normal users because they can still use USB devices after the OS has booted.

Exam trap

The trap here is that candidates may think disabling USB ports entirely is the simplest solution, but the question specifically asks for the control with the least impact on normal users, and Secure Boot with boot order restriction targets only the pre-boot phase without affecting post-boot USB functionality.

How to eliminate wrong answers

Option A is wrong because disabling all USB ports permanently would prevent legitimate use of USB peripherals (e.g., mice, keyboards, external storage) after boot, causing significant disruption to normal users. Option C is wrong because uninstalling the endpoint protection agent and replacing it with manual inspections removes automated threat detection and response, increasing security risk and administrative overhead without addressing the boot-time attack vector.

Full explanation →

640

Multi-Selecteasy

A SOC analyst reviews one user account and sees several failed logins from a single IP, then a successful login from the same IP, followed by a new inbox forwarding rule to an external address. Which two findings most strongly suggest account compromise? Select two.

Select 2 answers

A.Repeated failed logins followed by a successful login from the same source IP.

B.The user authenticated during normal business hours.

C.A new inbox forwarding rule sends mail to an external address.

D.The user accessed email from a corporate laptop.

E.The password age is 89 days.

AnswersA, C

Multiple failed attempts from the same source IP indicate a systematic credential attack rather than an accidental lockout. When a successful authentication follows immediately after, it strongly suggests the attacker eventually guessed or sprayed a valid password. This is a classic signature of brute-force or password-spraying and is a high-fidelity indicator of an account compromise.

Why this answer

A brute-force attack pattern—multiple failed logins followed by a successful authentication from the same external IP—strongly indicates credential compromise. This sequence suggests the attacker guessed or obtained the password and then successfully logged in. The single source IP ties the failed attempts to the eventual successful session, making it a classic indicator of account takeover.

Exam trap

The SY0-701 exam often tests the concept that a single successful login after failures is not enough—candidates must recognize that the forwarding rule is the second critical indicator, not the timing of the login.

Full explanation →

641

MCQeasy

A security team can patch only one system today. Which asset should be remediated first?

A.An internal print server with a high-severity finding and no direct user access

B.A lab workstation with a critical finding and no sensitive data

C.An internet-facing application server with a critical vulnerability and a known exploit

D.A user laptop with a medium-severity issue that requires local access

AnswerC

An internet-facing system with a critical vulnerability and a known exploit has the highest immediate risk. Attackers can reach it easily, and public exploit code increases the chance of compromise, so it should be patched first.

Why this answer

An internet-facing application server with a critical vulnerability and a known exploit represents the highest risk: it is exposed to external threats, the vulnerability is critical, and a known exploit means attackers can reliably compromise it. Patching this system first reduces the likelihood of a remote breach that could lead to data exfiltration or service disruption, aligning with the principle of prioritizing assets with the greatest attack surface and exploitability.

Exam trap

CompTIA often tests the misconception that the highest CVSS score (critical vs. high/medium) alone dictates remediation priority, but the trap here is that asset exposure and exploitability—specifically an internet-facing server with a known exploit—override internal assets with higher severity but lower risk.

How to eliminate wrong answers

Option A is wrong because an internal print server with a high-severity finding and no direct user access has a lower attack surface (internal network only) and no direct user interaction, making it less urgent than an internet-facing system with a critical vulnerability and known exploit. Option B is wrong because a lab workstation with a critical finding and no sensitive data, while serious, is typically isolated or used for testing, so the impact of compromise is limited compared to an externally reachable server. Option D is wrong because a user laptop with a medium-severity issue that requires local access is less critical—medium severity and local access requirement reduce the likelihood of remote exploitation, and user laptops can often be mitigated temporarily with user awareness or endpoint controls.

Full explanation →

642

MCQmedium

A sysadmin is preparing a dedicated database server for production. The server will not host web services, print services, or file sharing. Which action best follows least privilege and secure defaults?

A.Enable every management service so support can connect easily.

B.Use the domain admin account to run the database service.

C.Disable unused services and run the database under a dedicated least-privilege service account.

D.Share the same account with backup software to simplify troubleshooting.

AnswerC

Correct. Removing unnecessary services reduces the attack surface, and a dedicated service account limits the damage if the database process is compromised. This is a direct application of least privilege and secure defaults. It also supports cleaner auditing because the service activity is separated from administrator activity and unrelated functions are not exposed.

Why this answer

Disabling unused services reduces the attack surface, and running the database under a dedicated least-privilege service account ensures the account has only the permissions necessary for the database to function. This aligns with the principles of least privilege and secure defaults, as the server is dedicated to database services and should not have extraneous services or overly permissive accounts.

Exam trap

The trap here is that candidates may think using a domain admin account is acceptable for a database server to simplify management, but CompTIA tests the understanding that least privilege requires a dedicated service account with minimal permissions, not a highly privileged account.

How to eliminate wrong answers

Option A is wrong because enabling every management service violates least privilege by increasing the attack surface and potential for unauthorized access; a dedicated database server should only have necessary management interfaces enabled. Option B is wrong because using the domain admin account to run the database service violates least privilege by granting excessive privileges; if the database is compromised, an attacker could gain domain-wide control. Option D is wrong because sharing the same account with backup software violates least privilege by coupling database and backup permissions, increasing the risk of lateral movement if either service is compromised.

Full explanation →

643

MCQhard

Based on the exhibit, which risk treatment should the security manager recommend first?

A.Accept the risk and document it for the next quarterly review.

B.Avoid the risk by permanently shutting down the file transfer service.

C.Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.

D.Transfer the risk by purchasing cyber insurance and keeping the current configuration.

AnswerC

Mitigation is best because the asset is unsupported, internet-facing, and processes sensitive tax data. The cost to replace is manageable compared with the exposure. A WAF alone does not adequately protect an unsupported service, so the manager should reduce the vulnerability and exposure directly.

Why this answer

The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.

Exam trap

The trap here is that candidates may confuse 'transfer the risk' (Option D) with a proactive security measure, when in fact cyber insurance is a financial risk transfer that does not address the technical vulnerability, whereas mitigation (Option C) directly reduces the likelihood of exploitation.

How to eliminate wrong answers

Option A is wrong because accepting the risk without any compensating controls would leave a vulnerable, internet-facing appliance actively exploitable, which is irresponsible and violates the principle of due care. Option B is wrong because permanently shutting down the file transfer service would disrupt business operations and likely violate service-level agreements, making it an overly drastic and unnecessary first step when isolation and patching are feasible. Option D is wrong because transferring the risk via cyber insurance does not reduce the likelihood or impact of a breach; it only provides financial compensation after an incident, leaving the vulnerable appliance exposed and operational.

Full explanation →

644

MCQhard

Based on the exhibit, what is the most important next IR action?

A.Change the password again and monitor the mailbox for a few days.

B.Revoke active sessions and OAuth consent grants for the account.

C.Restore the deleted inbox rule from backup to preserve evidence.

D.Close the incident because the forwarding rule was removed.

AnswerB

The password has already been changed and the inbox rule removed, but the audit trail shows an OAuth consent grant and a refresh token issued from an unfamiliar IP. Those tokens can continue to authorize access even after a password reset. Revoking active sessions and removing the malicious consent closes the persistent access path.

Why this answer

The exhibit shows a compromised account with a suspicious inbox rule forwarding emails externally. The most critical next step is to revoke active sessions and OAuth consent grants to immediately terminate the attacker's access and prevent further data exfiltration, as changing the password alone does not invalidate existing OAuth tokens or active sessions.

Exam trap

The trap here is that candidates assume changing the password is sufficient to stop an attacker, but they overlook that OAuth tokens and active sessions persist independently of password changes, allowing continued unauthorized access.

How to eliminate wrong answers

Option A is wrong because changing the password again does not revoke existing OAuth tokens or active sessions, so the attacker could maintain access via cached credentials or token-based authentication. Option C is wrong because restoring the deleted inbox rule from backup is not the most important next action; preserving evidence is secondary to stopping active compromise, and the rule may have already been removed by the attacker. Option D is wrong because closing the incident after removing the forwarding rule ignores the fact that the attacker still has active sessions and OAuth grants, leaving the account vulnerable to further abuse.

Full explanation →

645

MCQeasy

A security team configures the SIEM to alert when a user account has several failed logins followed by a successful login from a new location. What type of control is this?

A.Preventive control, because it blocks the login attempt before it occurs.

B.Detective control, because it identifies suspicious activity after the event has started.

C.Corrective control, because it automatically fixes the account after the login succeeds.

D.Deterrent control, because it discourages attackers from trying to sign in.

AnswerB

This is a detective control because the SIEM is observing activity and generating an alert when a suspicious pattern appears. It does not stop the login by itself, but it helps security staff notice possible compromise quickly. Detection is important for investigation and response, especially when an attacker has already obtained valid credentials.

Why this answer

This is a detective control because the SIEM is configured to monitor and analyze log data after events have occurred, specifically identifying a pattern of several failed logins followed by a successful login from a new location. The alert does not prevent or block the login; it only notifies the security team of potentially suspicious activity that has already taken place, allowing them to investigate further.

Exam trap

The trap here is that candidates confuse the SIEM's alerting capability with a preventive action, mistakenly thinking that because the alert is configured 'before' the successful login in the rule logic, it somehow blocks the event, when in fact the SIEM only detects and reports on completed events.

How to eliminate wrong answers

Option A is wrong because a preventive control would actively block the login attempt before it occurs (e.g., account lockout policy or conditional access rule), whereas the SIEM alert only detects the pattern after the successful login. Option C is wrong because a corrective control would automatically remediate the issue after detection (e.g., disabling the account or resetting the password), but the SIEM alert does not perform any automated fix; it simply generates an alert. Option D is wrong because a deterrent control is designed to discourage attackers from attempting an action (e.g., warning banners or visible surveillance), not to detect or alert on activity that has already happened.

Full explanation →

646

MCQhard

Based on the exhibit, what is the best data-handling action before sharing the file with the third party?

A.Send the full spreadsheet encrypted and let the vendor filter out the extra columns.

B.Redact the unnecessary sensitive fields and provide only the minimum necessary extract after approval.

C.Mark the spreadsheet as internal and share it through the benefits contractor's cloud portal.

D.Send the file unchanged because the contractor signed a nondisclosure agreement.

AnswerB

This follows data minimization and handling requirements. The third party only needs names, email addresses, and benefits selections, so bank and government-ID fields should be removed before sharing. Encryption alone is not enough because the recipient would still receive more data than needed. This approach reduces privacy exposure and aligns with the policy note in the exhibit.

Why this answer

Data minimization and the principle of least privilege require that only the minimum necessary sensitive data be shared with a third party. Redacting unnecessary sensitive fields and obtaining approval ensures compliance with data protection policies and reduces the risk of unauthorized exposure, even if the recipient has signed an NDA.

Exam trap

CompTIA often tests the misconception that a signed NDA or encryption alone is sufficient to share all data, when in fact data minimization and formal approval are required to meet security and compliance standards.

How to eliminate wrong answers

Option A is wrong because sending the full spreadsheet with extra columns still exposes sensitive data that the vendor does not need, violating data minimization and increasing breach risk. Option C is wrong because marking the spreadsheet as 'internal' and sharing via the contractor's cloud portal does not remove sensitive fields and may bypass proper access controls, as the portal may not enforce data redaction. Option D is wrong because a nondisclosure agreement does not justify sharing all data unchanged; it does not eliminate the need to limit data to the minimum necessary for the task.

Full explanation →

647

MCQmedium

A security analyst notices a sudden increase in outbound traffic from a database server that normally only communicates with internal application servers. The server is running a standard OS with no recent changes. Which of the following actions should the analyst take FIRST to determine if the server is compromised?

A.Run a full antivirus scan on the server.

B.Check the server's running processes for unknown executables.

C.Block all outbound traffic from the server at the firewall.

D.Review the server's event logs for failed login attempts.

AnswerB

Inspecting the server's active process list is the most direct method to correlate the anomalous outbound traffic with a specific executable. Tools like `ps`, Task Manager, or `netstat -bno` can reveal a process's PID and its established remote connections, often immediately exposing an unknown or masquerading binary. This step provides high-fidelity, real-time evidence before more invasive or slower actions, making it the appropriate incident-response triage action.

Why this answer

Checking the server's running processes for unknown executables is the first and most direct step to identify if an attacker has established a foothold. A sudden outbound traffic spike without recent configuration changes strongly suggests a malicious process (e.g., a reverse shell or data exfiltration tool) is running. Examining running processes allows the analyst to spot suspicious executables or command-line arguments before taking more disruptive actions like blocking traffic or running a scan.

Exam trap

The trap here is that candidates often jump to blocking traffic (Option C) as a quick fix, but the FIRST action must be to gather evidence by inspecting running processes, as blocking prematurely destroys forensic data and violates the principle of 'do no harm' during incident response.

Why the other options are wrong

Running a full antivirus scan is time-consuming and may not detect sophisticated or custom malware. The immediate priority is to identify suspicious processes causing the unusual outbound traffic, which is faster and more direct.

Blocking all outbound traffic at the firewall would disrupt legitimate internal communications and is a reactive containment step, not a first investigative action to determine compromise.

Reviewing event logs for failed login attempts is a secondary step; the immediate priority is to identify active malicious processes causing the outbound traffic spike, not historical authentication events.

When would these options actually be correct?

A security analyst notices multiple endpoints exhibiting slow performance and pop-ups, and a recent email campaign delivered a known malware strain. Running a full antivirus scan would be the first step to identify and remove the known malware across the environment.

If the question asked for the BEST immediate action to prevent data exfiltration after confirming a compromise, blocking outbound traffic at the firewall would be correct.

This would be correct if the question described a scenario where the analyst suspects a brute-force attack or credential compromise, and the first step is to identify the source of unauthorized access attempts.

Why candidates pick the wrong answer

Candidates often default to antivirus scans as a standard response to potential compromise, overlooking that the immediate symptom (unusual outbound traffic) requires process investigation for a quicker assessment.

Candidates may think stopping suspicious traffic is the priority, but the first step is to gather evidence (processes) before taking containment actions.

Candidates often associate compromise with unauthorized access, so they default to checking login logs, overlooking that active data exfiltration requires immediate process investigation.

Full explanation →

648

MCQmedium

A company is enhancing its network security posture. The security team deploys a system that passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts when suspicious patterns are detected. This system does not actively block or modify any traffic. Which type of security control does this system BEST represent?

A.Preventive control

B.Detective control

C.Corrective control

D.Deterrent control

AnswerB

Correct. A detective control identifies and logs security events after they happen or in real time. The described system passively monitors and generates alerts, which is the hallmark of a detective control like an IDS.

Why this answer

This system is a detective control because it passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts without actively blocking or modifying traffic. Detective controls are designed to identify and report security incidents after they occur or as they happen, which aligns with the described behavior of an Intrusion Detection System (IDS). Unlike preventive controls, it does not enforce policy or stop threats in real time.

Exam trap

The trap here is that candidates often confuse an Intrusion Detection System (IDS) with an Intrusion Prevention System (IPS), mistakenly selecting 'preventive control' because they think any security tool that detects threats also blocks them, but the question explicitly states the system does not block or modify traffic.

Why the other options are wrong

The system described only monitors and alerts; it does not actively block or prevent malicious activity, so it is not a preventive control.

The system described is passive and only monitors traffic without taking action to remediate or reverse damage, which is the purpose of corrective controls. Corrective controls are applied after an incident to restore systems, not to detect ongoing threats.

When would these options actually be correct?

A firewall configured with rules to block unauthorized inbound traffic, or an intrusion prevention system (IPS) that automatically drops malicious packets, would be a preventive control.

A question describing a system that automatically quarantines infected endpoints, restores clean backups, or patches vulnerabilities after detecting an intrusion would make corrective control the correct answer.

Why candidates pick the wrong answer

Candidates may confuse detection with prevention, thinking that generating alerts helps prevent attacks, but prevention requires active blocking.

Candidates may confuse detective and corrective controls because both involve response to incidents; however, corrective controls actively fix or mitigate damage, whereas detective controls only identify and alert.

Full explanation →

649

MCQeasy

An employee receives a text message that says, "Your MFA enrollment expired. Tap here now to re-activate access or your account will be locked." What should the employee do first?

A.Tap the link and complete the MFA reset immediately

B.Verify the request using a known company contact method and report the text

C.Forward the text to coworkers so they can watch for it too

D.Reply to the sender and ask for more details

AnswerB

This is the best first step because the employee should not trust a security-related request delivered through an unexpected text message. Using a known internal help desk number, portal, or security reporting process confirms whether the request is legitimate. It also helps the organization investigate the suspicious message quickly.

Why this answer

The message is a classic phishing attempt designed to harvest MFA credentials or session tokens. The employee must first verify the request through a trusted company channel (e.g., calling the IT help desk or checking the official security portal) and then report the text to the security team. This prevents falling for social engineering that could bypass MFA protections.

Exam trap

The trap here is that candidates assume MFA is unbreakable and rush to re-enroll, not realizing that phishing kits can intercept MFA tokens in real time via reverse proxy attacks.

How to eliminate wrong answers

Option A is wrong because tapping the link could lead to a fake MFA portal that captures the employee's credentials or session tokens, compromising their account. Option C is wrong because forwarding the text to coworkers risks spreading the phishing attempt and may cause others to fall for it before the threat is contained. Option D is wrong because replying to the sender confirms the phone number is active and may expose the employee to further targeted attacks or malware delivery.

Full explanation →

650

MCQmedium

Based on the exhibit, which backup protection change best improves ransomware resilience and protects the backup media if it is stolen?

A.Enable backup encryption only, because encrypted backups cannot be read if stolen.

B.Add an immutable offline or air-gapped copy with separate backup credentials and regular restore testing.

C.Move the USB drive into a different cabinet inside the same server room.

D.Reduce the retention period so backups consume less storage space.

AnswerB

An immutable or offline copy protects backups from tampering, ransomware, and accidental deletion because the attacker cannot easily modify it. Separate credentials reduce the chance that compromised domain admin accounts can reach every backup copy. Regular restore testing ensures the organization can actually recover when needed. This is the strongest improvement in the exhibit.

Why this answer

Implementing an immutable, offline or air-gapped backup copy with separate credentials ensures that even if an attacker compromises the primary backup system or steals the media, they cannot modify or delete the backups. Regular restore testing verifies the integrity and recoverability of the data, which is critical for ransomware resilience. This approach aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for cyber recovery.

Exam trap

The trap here is that candidates often assume encryption alone (Option A) is sufficient for ransomware protection, overlooking that encryption does not prevent backup corruption or deletion, and that an immutable, air-gapped copy with separate credentials is the only option that addresses both theft and ransomware attack scenarios.

How to eliminate wrong answers

Option A is wrong because backup encryption alone does not prevent ransomware from encrypting or deleting the backup files themselves; encryption only protects data confidentiality if the media is stolen, but the attacker could still corrupt or destroy the backups before encryption is applied. Option C is wrong because moving the USB drive to a different cabinet in the same server room does not create an air gap or offline copy; the drive remains accessible to the same network and threats, and physical theft of the cabinet would still compromise the backups. Option D is wrong because reducing the retention period only frees storage space and does not improve resilience against ransomware; it actually increases the risk of data loss by shortening the recovery window, and it does not protect backups from being encrypted or deleted.

Full explanation →

651

MCQeasy

A company uses several SaaS applications and wants employees to sign in once with a corporate account instead of maintaining separate passwords for each app. Which architecture is best?

A.Shared generic accounts for each department.

B.Federated single sign-on with a central identity provider.

C.A separate username and password database in every SaaS application.

D.A site-to-site VPN for every SaaS vendor.

AnswerB

This is the best choice because a central identity provider can authenticate the user once and then issue trusted access to multiple SaaS applications. It reduces password sprawl, simplifies account provisioning, and supports faster deprovisioning when an employee leaves. Federation also improves control because the business can manage identity from one place.

Why this answer

Federated single sign-on (SSO) with a central identity provider (IdP) allows users to authenticate once using their corporate account (e.g., via SAML 2.0 or OIDC) and then access multiple SaaS applications without re-entering credentials. The IdP issues a token that each SaaS app trusts, eliminating the need for separate passwords while maintaining centralized control over authentication policies.

Exam trap

The trap here is that candidates confuse network-level VPN connectivity with identity-level federation, assuming a VPN can provide SSO, when in fact VPNs only secure the transport layer and do not address authentication across separate application domains.

How to eliminate wrong answers

Option A is wrong because shared generic accounts violate the principle of least privilege and non-repudiation, as multiple users share the same credentials, making it impossible to audit individual actions. Option C is wrong because maintaining a separate username and password database in every SaaS application directly contradicts the requirement to eliminate separate passwords and introduces redundant identity silos. Option D is wrong because a site-to-site VPN provides network-layer connectivity, not identity federation; it does not solve the problem of authenticating users across different SaaS applications without separate credentials.

Full explanation →

652

MCQmedium

A security analyst is reviewing network flow logs and notices a series of outbound connections from a single internal workstation to an external IP address on TCP port 443. The connections occur every 5 minutes, each lasting about 2 seconds, and the amount of data transferred per connection is consistently around 1 KB. The workstation's user reports no unusual activity. The analyst checks the host's EDR logs and sees no malicious processes or known indicators. Which type of activity is this pattern most consistent with?

A.Beaconing to a command-and-control server

B.Normal software update check

C.DNS tunneling

D.Data exfiltration via HTTPS

AnswerA

Beaconing to a command-and-control server is the correct classification. This pattern is hallmarks of malware that maintains a C2 channel by sending periodic 'heartbeat' messages at fixed intervals with minimal payloads. The consistent 5-minute cadence and ~1 KB data transfer per connection are classic indicators of a beaconing protocol, designed to evade detection by blending in with low-volume background traffic while ensuring the compromised host remains controllable. Such regularity is atypical for legitimate software, which usually introduces jitter or variable sizes, and the tiny payload is insufficient for meaningful data exfiltration, making C2 beaconing the most probable explanation.

Why this answer

This pattern is most consistent with beaconing to a command-and-control (C2) server because the connections are periodic (every 5 minutes), short-lived (2 seconds), and consistently transfer a small amount of data (~1 KB) over HTTPS (TCP 443). These characteristics—regular intervals, low data volume, and stealthy use of encrypted channels—are hallmarks of C2 beaconing used by malware to maintain persistence and receive instructions without raising immediate suspicion.

Exam trap

The trap here is that candidates confuse periodic HTTPS connections with normal software updates, but the key differentiator is the extremely consistent timing and tiny data size—updates are rarely this regular or this small, while C2 beaconing is designed to be minimal and predictable to evade detection.

Why the other options are wrong

Normal software update checks typically occur less frequently (e.g., daily) and transfer more data (e.g., several MB) for downloading patches, not 1 KB every 5 minutes. The consistent, short-duration connections suggest a heartbeat mechanism, not a routine update.

DNS tunneling typically uses DNS queries (UDP 53) or occasionally TCP 53, not TCP 443, and involves larger or irregular data patterns, not small, periodic HTTPS connections.

Data exfiltration via HTTPS would typically involve larger data transfers (e.g., megabytes) and longer connection durations, not the small, consistent 1 KB every 5 minutes seen here.

When would these options actually be correct?

This option would be correct if the connections were to a known vendor's update server (e.g., Microsoft or Adobe), occurred at irregular intervals (e.g., once per day), and transferred larger payloads (e.g., 10-100 MB) consistent with downloading updates.

A question describing a workstation making frequent DNS queries to an unusual domain with encoded data in subdomains, or where the traffic is on port 53 and the data per query is larger than normal, would make DNS tunneling the correct answer.

This option would be correct if the logs showed large, irregular outbound HTTPS transfers (e.g., 100 MB files) from a workstation to an external IP, especially if the data matches sensitive internal files and no legitimate business need exists.

Why candidates pick the wrong answer

Candidates may assume that any periodic outbound HTTPS traffic to an external IP is benign, overlooking the specific pattern of very small, frequent transfers that is characteristic of beaconing rather than updates.

Candidates may confuse any covert channel with beaconing, and the periodic nature of the traffic might be misattributed to tunneling, especially if they overlook the specific port and protocol used.

Candidates see HTTPS (port 443) and think of encrypted data exfiltration, overlooking that the tiny, periodic transfers are more characteristic of beaconing than actual data theft.

Full explanation →

653

MCQmedium

A regulated analytics workload must run in the cloud with the strongest isolation from other customers, but the company does not want to manage its own physical server room. Which placement is most appropriate?

A.A public subnet with an internet gateway so the workload can be reached directly.

B.A shared-tenancy virtual machine in the provider's default compute pool.

C.A dedicated host or equivalent single-tenant compute placement in the provider's environment.

D.A serverless function because it removes all underlying infrastructure concerns.

AnswerC

A dedicated host (or an equivalent single-tenant placement such as an AWS Dedicated Host, Azure Dedicated Host, or GCP sole-tenant node) assigns an entire physical server to a single customer, eliminating co-tenant compute activity on that machine. This physical isolation directly addresses regulatory mandates that require data containment, while still allowing the cloud provider to manage hardware maintenance and updates. It also enables consistent instance placement, brings-your-own-license (BYOL) scenarios, and helps meet stringent compliance frameworks such as HIPAA, PCI DSS, or FedRAMP.

Why this answer

A dedicated host or single-tenant compute placement ensures that the physical server is not shared with any other customer, providing the strongest isolation required for regulated workloads. This model meets the compliance need for physical separation while still being a cloud service, so the company avoids managing its own server room.

Exam trap

The trap here is that candidates often confuse logical isolation (e.g., VPCs, private subnets) with physical isolation, and mistakenly choose a shared-tenancy option like a private subnet VM, thinking it provides the strongest separation.

How to eliminate wrong answers

Option A is wrong because a public subnet with an internet gateway exposes the workload directly to the internet, which weakens security and does not provide any physical isolation from other customers. Option B is wrong because a shared-tenancy virtual machine runs on hardware shared with other customers, offering only logical isolation and failing the requirement for the strongest physical isolation. Option D is wrong because serverless functions run on shared infrastructure managed by the provider, with no guarantee of single-tenant physical isolation, and they do not meet the explicit need for the strongest isolation from other customers.

Full explanation →

654

MCQhard

Company-owned tablets are used by field staff for both corporate email and approved personal apps. Security must isolate company data from personal data, allow remote wipe of only the corporate workspace, and block access if the device is rooted or encryption is disabled. Which approach best fits?

A.Use a consumer anti-malware app and perform a full-device wipe if the tablet is lost.

B.Use MDM or UEM with a managed work profile or container, compliance checks, and selective wipe.

C.Install a VPN app on the tablets and let users choose their own lock-screen settings.

D.Use application allowlisting alone and avoid enrolling the tablets in a management platform.

AnswerB

An MDM/UEM solution with a managed work profile or container separates corporate apps and data into an isolated, policy-controlled space on the same tablet, leaving personal content untouched. Compliance checks—such as validating passcode strength, OS patch level, and rooting/jailbreak status—allow the system to block access to corporate resources on noncompliant devices. A selective wipe then removes only the managed container and corporate data if needed, preserving the user’s personal information, which perfectly suits company-owned tablets used for both purposes.

Why this answer

Mobile Device Management (MDM) or Unified Endpoint Management (UEM) with a managed work profile (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted container for corporate data. This allows compliance checks to detect rooted devices or disabled encryption, and enables a selective wipe that removes only the corporate workspace without affecting personal apps or data.

Exam trap

The trap here is that candidates often confuse a full-device wipe (which destroys personal data) with a selective wipe (which only removes the corporate container), or assume that a VPN or anti-malware app alone can provide the required isolation and compliance enforcement.

How to eliminate wrong answers

Option A is wrong because a consumer anti-malware app cannot enforce containerization or selective wipe; a full-device wipe destroys all personal data, violating the requirement to isolate and preserve personal data. Option C is wrong because a VPN app alone does not provide work profile isolation, compliance checks for root/encryption, or selective wipe capabilities; letting users choose lock-screen settings undermines security policy enforcement. Option D is wrong because application allowlisting without a management platform cannot create a separate corporate workspace, enforce encryption or root detection, or perform a selective wipe; it only controls which apps can run, not data isolation or remote wipe.

Full explanation →

655

MCQmedium

A vulnerability scan reports that a Windows file share has SMB signing disabled and anonymous read access is permitted to one directory containing payroll exports. No exploitation has been observed yet. Which action best reduces exposure with minimal business impact?

A.Remove all backup jobs until the scan is cleared.

B.Disable the file server and rebuild it from scratch immediately.

C.Enable SMB signing and remove anonymous access to the share.

D.Increase the directory quota so the share cannot overflow.

AnswerC

This is the best targeted remediation because it directly addresses both weaknesses identified by the scan. SMB signing helps protect integrity for SMB traffic, and removing anonymous read access prevents unauthorized users from viewing sensitive payroll data. Together, these changes reduce exposure without taking the entire server offline. In vulnerability management, the best choice is often a precise configuration fix that closes the finding while preserving business continuity and avoiding more disruptive action than necessary.

Why this answer

Enabling SMB signing prevents man-in-the-middle attacks that could tamper with file transfers, and removing anonymous read access eliminates unauthorized visibility into sensitive payroll data. These changes directly address the two vulnerabilities (SMB signing disabled and anonymous read access) without disrupting legitimate file-sharing operations, thus minimizing business impact.

Exam trap

The trap here is that candidates may overreact by choosing extreme remediation (like rebuilding the server) or irrelevant actions (like adjusting quotas), instead of recognizing that targeted configuration changes (enabling SMB signing and removing anonymous access) are the proportional, low-impact fix.

How to eliminate wrong answers

Option A is wrong because removing backup jobs does not address the SMB signing or anonymous access vulnerabilities; it would only increase data loss risk without reducing exposure. Option B is wrong because immediately disabling and rebuilding the file server is an extreme, unnecessary measure that causes significant business disruption; the vulnerabilities can be fixed with configuration changes. Option D is wrong because increasing the directory quota prevents overflow but does not mitigate the security issues of disabled SMB signing or anonymous read access.

Full explanation →

656

MCQmedium

A workstation starts failing security checks. The antivirus service no longer appears in the running process list, a known driver's hash does not match the vendor's value, and a task manager view shows fewer processes than expected. The user also reports that local admin tools behave inconsistently. What type of malware is most likely present?

A.Spyware

B.Rootkit

C.Trojan

D.Logic bomb

AnswerB

A rootkit is purpose-built to maintain privileged, stealthy access by manipulating the OS kernel, drivers, or core system files. It hooks system calls to hide malicious processes from the process list and may patch legitimate binaries, causing antivirus hash checks to fail. The workstation's failure of security checks due to missing processes and hash mismatches is the classic signature of a rootkit infection, as other malware types rarely exhibit this combination of systemic concealment and integrity violation.

Why this answer

The symptoms—antivirus service missing from the process list, a known driver's hash mismatch, fewer processes in Task Manager, and inconsistent admin tool behavior—are classic indicators of a rootkit. Rootkits operate at kernel or driver level, allowing them to hide processes, files, and registry keys from standard system tools, and they often tamper with driver hashes to evade integrity checks.

Exam trap

The trap here is that candidates often confuse a rootkit with a trojan because both can be stealthy, but the specific clues—driver hash mismatch and hidden processes—point to kernel-level manipulation unique to rootkits, not the user-level deception of a trojan.

How to eliminate wrong answers

Option A is wrong because spyware typically focuses on data theft and monitoring (e.g., keylogging, screen captures) and does not hide its processes or alter driver hashes at the kernel level. Option C is wrong because a trojan masquerades as legitimate software to gain initial access but does not inherently possess the capability to hide processes or modify driver hashes post-infection. Option D is wrong because a logic bomb is a dormant piece of code triggered by a specific condition (e.g., date or event) and does not actively hide processes or alter system drivers.

Full explanation →

657

MCQeasy

Based on the exhibit, what should the team do next to confirm the backups can actually be used during an outage?

A.Increase the retention period before making any restore attempts.

B.Perform a test restore to a nonproduction location and verify the recovered files.

C.Delete older backup sets so the backup window is shorter.

D.Convert the backups to full backups only so the status report is simpler.

AnswerB

A test restore is the best way to validate that backups are usable during recovery. Successful backup jobs alone do not guarantee that data can be restored quickly, completely, or without corruption. Restoring to a nonproduction location confirms the files open correctly and helps the team measure recovery readiness before an actual incident.

Why this answer

The only way to confirm that backups are usable during an outage is to perform a test restore to a nonproduction location and verify the recovered files. This validates the integrity of the backup data, the restore process, and that the files are complete and functional, which is a core principle of backup validation (often called a 'restore test' or 'disaster recovery drill'). Simply reviewing backup status reports or increasing retention does not prove that the data can be successfully restored.

Exam trap

The trap here is that candidates often assume a successful backup job (green status) guarantees recoverability, but the exam tests the distinction between backup completion and restore validation—CompTIA often tests this by making 'increase retention' or 'simplify backup type' seem like proactive steps, when only a test restore confirms usability.

How to eliminate wrong answers

Option A is wrong because increasing the retention period only keeps more historical copies of backups; it does not test whether those backups are actually restorable or contain valid data. Option C is wrong because deleting older backup sets to shorten the backup window does not validate the usability of the remaining backups and may actually reduce recovery point objectives (RPO) unnecessarily. Option D is wrong because converting to full backups only simplifies the status report but does not test the restore process; full backups can still be corrupt or incomplete without a restore verification.

Full explanation →

658

MCQmedium

A legacy finance application cannot yet support multifactor authentication. The security team still wants administrators to use separate privileged accounts, receive elevated access only when a ticket is approved, and have those privileges removed automatically after the maintenance window ends. Which solution best fits?

A.Create one shared administrator account and rotate its password every week.

B.Assign permanent administrator rights through role-based access control and rely on audit logs afterward.

C.Use privileged access management with separate admin accounts and time-bound elevation approvals.

D.Move the application behind a federation service so all users can sign in with a single password.

AnswerC

Privileged access management is designed for this situation. Separate admin accounts preserve accountability, while time-bound elevation reduces standing privilege and limits exposure when the elevated rights are not needed. Approval workflows also support operational control and can be tied to maintenance tickets for traceability.

Why this answer

Privileged Access Management (PAM) solutions are specifically designed to enforce just-in-time (JIT) privileged access. They allow administrators to request time-bound elevation of rights for a specific maintenance window, with automatic revocation after the window expires. This directly meets the requirements of separate privileged accounts, ticket-based approval, and automatic removal of privileges, even when the legacy application itself cannot support MFA.

Exam trap

The trap here is that candidates may confuse federation (SSO) with privileged access management, thinking that a single sign-on solution can enforce time-bound elevation, when in fact federation only centralizes authentication and does not manage granular, time-limited privilege escalation.

How to eliminate wrong answers

Option A is wrong because a shared administrator account violates the principle of least privilege and non-repudiation; rotating the password weekly does not provide time-bound, ticket-approved elevation or automatic removal of privileges. Option B is wrong because permanent administrator rights through RBAC contradict the requirement for elevated access only when a ticket is approved and automatic removal after the maintenance window; audit logs alone do not enforce time-bound access. Option D is wrong because placing the application behind a federation service with a single password does not provide separate privileged accounts, ticket-based approval, or time-bound elevation; it also introduces a single point of failure and does not address the need for privileged access management.

Full explanation →

659

Multi-Selecthard

A hybrid cloud portal first checks device health at the identity provider, then requires MFA, then enforces a per-application authorization decision before each sensitive action. Network access is also limited by a gateway, and a WAF sits in front of the app. Which two principles are best demonstrated? Select two.

Select 2 answers

A.Zero trust, because access is continuously verified instead of assumed after one login.

B.Defense in depth, because several independent layers protect the workload from different angles.

C.Least privilege, because users are granted no access at all until the app is offline.

D.Separation of duties, because administrators and users must approve each other's actions.

E.Need-to-know, because the system hides all information until the user requests it.

AnswersA, B

The portal keeps re-evaluating trust through identity, device, and application-layer checks.

Why this answer

The scenario describes continuous verification of device health, MFA, and per-application authorization before each sensitive action, which aligns with the Zero Trust principle of 'never trust, always verify.' Unlike traditional perimeter-based security, Zero Trust assumes no implicit trust after initial authentication and requires ongoing validation at every access attempt.

Exam trap

CompTIA often tests the distinction between Zero Trust (continuous verification) and Defense in depth (layered controls), and the trap here is confusing 'least privilege' with 'continuous verification' or assuming that any multi-step authentication automatically implies separation of duties.

Full explanation →

660

MCQmedium

A security architect is designing the network security posture for a new branch office. The plan includes a next-generation firewall at the perimeter, an intrusion prevention system on the internal network, mandatory multi-factor authentication for all remote access, and quarterly security awareness training for employees. The architect explains that these controls are independent of each other so that a failure in any single control does not leave the entire network unprotected. Which security concept is the architect primarily implementing?

A.Least privilege

B.Defense in depth

C.Zero trust

D.Separation of duties

AnswerB

Defense in depth uses multiple overlapping and independent security controls to protect an environment, ensuring that if one control fails, others continue to provide protection. The architect's design directly implements this principle.

Why this answer

The architect is implementing defense in depth by layering multiple independent security controls—a next-generation firewall (NGFW) at the perimeter, an intrusion prevention system (IPS) on the internal network, mandatory multi-factor authentication (MFA) for remote access, and quarterly security awareness training. The key phrase 'independent of each other so that a failure in any single control does not leave the entire network unprotected' directly describes the principle of layered defenses, where no single point of failure compromises overall security. This approach ensures that if an attacker bypasses the NGFW, the IPS or MFA may still prevent or detect the breach.

Exam trap

The trap here is that candidates confuse 'defense in depth' with 'zero trust' because both involve multiple controls, but zero trust specifically requires continuous authentication and micro-segmentation, not just independent layers.

Why the other options are wrong

The question describes multiple overlapping security controls (firewall, IPS, MFA, training) that work together to protect the network even if one fails, which is the definition of defense in depth, not least privilege.

Zero trust is a security model that assumes no implicit trust and requires continuous verification of every access request, but the question describes multiple independent layers of security (firewall, IPS, MFA, training) which is the definition of defense in depth, not zero trust.

Separation of duties divides critical tasks among multiple people to prevent fraud or error, but the question describes multiple independent security controls, not task division among personnel.

When would these options actually be correct?

A question where the scenario involves restricting user permissions to only what is necessary for their job role, such as 'A system administrator configures file permissions so that each employee can only access the folders required for their tasks.'

A question describing a network architecture where all resources are segmented, every access request is authenticated and authorized regardless of source (e.g., internal or external), and no device or user is trusted by default. For example: 'An organization implements micro-segmentation, continuous authentication, and least-privilege access for all users, including those on the internal network.'

A question describing a policy where one person cannot both approve and process payments, requiring two different employees for each step, would make separation of duties the correct answer.

Why candidates pick the wrong answer

Candidates may confuse least privilege with defense in depth because both are fundamental security principles, but least privilege focuses on access rights, not layered controls.

Candidates may confuse zero trust with defense in depth because both involve multiple security controls, but zero trust specifically focuses on eliminating implicit trust and verifying every access, whereas defense in depth layers independent controls to provide redundancy.

Candidates may confuse 'independent controls' with 'separation of duties' because both involve redundancy, but separation of duties applies to human roles, not technical controls.

Full explanation →

661

MCQmedium

A SOC analyst receives an alert that a domain admin account authenticated to a file server at 02:14 from a jump host that is normally used only by the infrastructure team. The Windows logs also show a scheduled task launching a backup script at the same time, and the backup team says the task was created during yesterday's change window. What is the best next step to determine whether this is a false positive?

A.Disable the domain admin account immediately and wait for the backup team to respond.

B.Correlate the authentication event with the change ticket and the scheduled task details.

C.Escalate the alert as confirmed compromise because the login occurred after hours.

D.Delete the scheduled task so it cannot be used again.

AnswerB

Correlating the authentication event with the change ticket and scheduled task details is the foundational verification step. Because scheduled tasks run under specific security principals, a match between the login time, source, and the task's execution window provides strong evidence that the activity was expected and legitimate. This approach reduces false positives while preserving any potentially malicious evidence for later analysis. It distinguishes an authorized administrative workflow from an attacker's authentication attempt, enabling an informed risk-based decision.

Why this answer

The alert involves a domain admin authentication from a jump host at an unusual time, but the scheduled task was created during a change window. Correlating the authentication event with the change ticket and the scheduled task details allows the SOC analyst to verify if the activity was authorized, preventing unnecessary incident response. This step aligns with the incident response process of validating alerts before taking action.

Exam trap

The trap here is that candidates assume any after-hours admin login is malicious, but the scheduled task created during a change window provides a legitimate explanation that must be verified through correlation.

How to eliminate wrong answers

Option A is wrong because disabling the domain admin account immediately without investigation could disrupt legitimate operations and is premature; the activity may be authorized. Option C is wrong because escalating as a confirmed compromise based solely on after-hours login ignores the possibility of scheduled maintenance or authorized changes, leading to false positives. Option D is wrong because deleting the scheduled task destroys evidence and could break legitimate business processes; the task should be analyzed, not removed.

Full explanation →

662

MCQhard

Based on the exhibit, what is the BEST immediate containment action? The workstation is still powered on, and the user reports that files are being renamed and the system is running very slowly. The security analyst confirms malicious activity is in progress.

A.Immediately isolate the endpoint from the network using EDR containment or switch quarantine.

B.Power off the workstation immediately to prevent any further file changes.

C.Uninstall Microsoft Office so the malicious spreadsheet cannot launch again.

D.Block the destination IP address at the firewall and wait for the user to log off.

AnswerA

The device is actively exhibiting ransomware-like behavior, and isolation stops lateral spread and additional command-and-control traffic while preserving the powered-on system for later review.

Why this answer

The immediate priority is to stop the active malicious activity (file renaming, system slowdown) by severing the workstation's network connectivity. EDR containment or switch quarantine isolates the endpoint at Layer 2, preventing the attacker from exfiltrating data, communicating with command-and-control servers, or spreading laterally, while preserving volatile memory for forensic analysis. This is faster and more controlled than powering off, which destroys evidence and may trigger destructive payloads.

Exam trap

CompTIA often tests the distinction between containment (stopping the spread) and eradication (removing the threat), tempting candidates to choose power-off or uninstall actions that destroy evidence or fail to stop active malicious processes.

How to eliminate wrong answers

Option B is wrong because powering off the workstation destroys volatile evidence (e.g., running processes, network connections, memory-resident malware) and may trigger destructive payloads designed to activate on shutdown. Option C is wrong because uninstalling Microsoft Office is a remediation step, not an immediate containment action; it does not stop the ongoing malicious activity and may take too long while the attacker continues to rename files. Option D is wrong because blocking the destination IP at the firewall does not stop the local malicious process already running on the workstation, and waiting for the user to log off allows further damage; containment must be applied directly to the endpoint.

Full explanation →

663

MCQmedium

A legal department sends a confidential contract to an outside partner without first exchanging a shared secret. The sender encrypts the document with the partner's public key so that only the partner can decrypt it with the matching private key. Which cryptographic approach is being used?

A.Symmetric encryption

B.Asymmetric encryption

C.Hashing

D.Digital signatures

AnswerB

Asymmetric encryption uses a public key to encrypt data and a corresponding private key to decrypt it. That makes it ideal when two parties have not yet shared a secret. In this scenario, the sender uses the partner's public key so only the partner's private key can open the contract, preserving confidentiality across an untrusted network.

Why this answer

B is correct because the scenario describes encrypting a document with the recipient's public key, which can only be decrypted by the recipient's private key. This is the defining characteristic of asymmetric encryption (also known as public-key cryptography), where two different but mathematically related keys are used for encryption and decryption.

Exam trap

The trap here is that candidates may confuse the use of a public key for encryption with a digital signature, which uses the private key for signing, or mistakenly think that any use of a key pair is symmetric encryption.

How to eliminate wrong answers

Option A is wrong because symmetric encryption uses a single shared secret key for both encryption and decryption, but the scenario explicitly states that no shared secret was exchanged beforehand. Option C is wrong because hashing is a one-way function that produces a fixed-size digest for integrity verification, not for encryption or decryption of data. Option D is wrong because digital signatures use the sender's private key to sign a message for non-repudiation and integrity, not the recipient's public key to encrypt a document.

Full explanation →

664

Multi-Selecthard

A router interface connects the DMZ subnet 10.10.10.0/24 to the internal network. A web server at 10.10.10.25 must reach an application server at 10.10.20.20 on TCP 8443, and all other DMZ-to-internal traffic must be blocked. Which two ACL entries should be applied inbound on the DMZ-facing interface? Select two.

Select 2 answers

A.permit tcp 10.10.10.25 host 10.10.20.20 eq 8443

B.permit tcp host 10.10.20.20 any eq 8443

C.deny ip 10.10.10.0/24 10.10.20.0/24

D.permit ip any any

E.permit udp 10.10.10.0/24 host 10.10.20.20 eq 8443

AnswersA, C

This rule allows only the required web-server-to-application-server connection on the specified port. It uses a very narrow source and destination definition, which is the safest way to permit the business flow. The ACL should allow the needed application traffic and nothing broader than that.

Why this answer

It permits TCP traffic from the specific web server (10.10.10.25) to the application server (10.10.20.20) on destination port 8443, which is the only allowed DMZ-to-internal communication. This entry uses the 'host' keyword to specify the exact source IP and the 'eq' keyword to match the required destination port, implementing the principle of least privilege.

Exam trap

The SY0-701 exam often tests the misconception that a single permit statement is sufficient, but candidates forget that an explicit deny entry is needed to block all other traffic when the requirement specifies 'all other traffic must be blocked', as the implicit deny alone does not satisfy the explicit blocking requirement in the question.

Full explanation →

665

Multi-Selecthard

A company is evaluating a multi-tenant SaaS document platform. The security team wants to reduce the impact of another tenant’s breach and ensure employees who leave are removed from the app within minutes. Which two requirements should the team prioritize? Select two.

Select 2 answers

A.Require the provider to document logical tenant isolation and separate customer encryption keys.

B.Use a shared local administrator account for the app so offboarding is easier.

C.Allow anonymous public links as the default method for external collaboration.

D.Integrate the SaaS with the corporate IdP using federation and SCIM lifecycle automation.

E.Rely on manual quarterly cleanup tickets to disable former employees.

AnswersA, D

Logical tenant isolation helps prevent one tenant from reading or influencing another tenant’s data. Separate customer encryption keys further reduce cross-tenant risk because encrypted content is not protected by a single shared key set. Together, these requirements are useful when evaluating multi-tenant SaaS risk and selecting a provider with stronger separation controls.

Why this answer

Logical tenant isolation (e.g., separate databases or namespaces) and separate customer encryption keys ensure that a breach in one tenant cannot access another tenant's data, directly reducing the impact of cross-tenant attacks. This aligns with the shared responsibility model in SaaS, where the provider must enforce strong multi-tenant boundaries at the application and data layers.

Exam trap

The trap here is that candidates may confuse 'shared local admin account' (Option B) with efficient offboarding, but it actually undermines security and auditability, while the correct approach is federation with SCIM for automated lifecycle management.

Full explanation →

666

MCQmedium

A file server suddenly shows many encrypted files with a new extension, and endpoint tools report that Volume Shadow Copy Service was disabled minutes earlier. A note on the desktop demands payment in cryptocurrency. What should the security team do first?

A.Pay the ransom immediately to restore access quickly.

B.Isolate the affected systems from the network and preserve evidence.

C.Reimage the server immediately without documenting the event.

D.Disable antivirus alerts so staff can work without distractions.

AnswerB

Isolation is the first priority because it helps stop the spread of ransomware and prevents additional encryption or lateral movement. Preserving evidence at the same time supports later incident response, forensics, and potential legal or insurance needs. The organization can then assess the scope, validate backups, and begin containment and recovery in a controlled way. Immediate disconnection from the network is usually more valuable than attempting remediation on a live, actively infected host.

Why this answer

Isolating the affected systems from the network and preserving evidence is the correct first step because it prevents the ransomware from spreading to other systems via SMB or other network protocols, and it preserves the forensic artifacts (e.g., the ransom note, encrypted files, and Volume Shadow Copy Service logs) needed for incident response and potential decryption. Disabling VSS is a common ransomware tactic to prevent file recovery, so immediate containment is critical before any remediation.

Exam trap

The trap here is that candidates may confuse 'immediate remediation' (e.g., reimaging) with 'first response' (containment and evidence preservation), or they may incorrectly assume paying the ransom is a viable technical solution, when in fact it is never recommended in incident response frameworks like NIST SP 800-61.

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee decryption (attackers may not provide the key), it funds further criminal activity, and it violates most organizational security policies and legal guidelines. Option C is wrong because reimaging the server immediately destroys all forensic evidence (e.g., memory dumps, logs, encrypted file samples) that could be used for attribution, decryption research, or legal action, and it bypasses the necessary containment step to prevent lateral movement.

Full explanation →

667

MCQhard

Based on the exhibit, which metric best shows that employees are recognizing and escalating phishing attempts more quickly?

A.Click rate, because a lower click rate is the only useful awareness metric.

B.Training completion rate, because it proves every employee attended the awareness session.

C.Median report time, because it shows how quickly users notify security after spotting a phish.

D.Number of simulation emails sent, because a larger campaign is always a better metric.

AnswerC

Median report time best demonstrates faster recognition and escalation, which reduces attacker dwell time and improves response. In the exhibit, the median time dropped from 8 minutes to 3 minutes, showing better behavior under pressure. Click rate is still useful, but quick reporting is the stronger indicator of resilience and response readiness.

Why this answer

The median report time directly measures the speed at which employees notify the security team after identifying a phishing simulation email. A decreasing median report time indicates that users are recognizing phishing attempts more quickly and escalating them, which is the key behavioral change this metric captures. Unlike click rate, which only measures failure, report time measures the positive action of reporting.

Exam trap

The SY0-701 exam often tests the distinction between metrics that measure awareness (e.g., training completion) versus metrics that measure behavioral change (e.g., median report time), and candidates mistakenly choose click rate because it is a common phishing metric, but it does not capture the speed of escalation.

How to eliminate wrong answers

Option A is wrong because click rate measures the percentage of users who clicked a phishing link, which indicates failure to recognize a phish, not the speed of recognition or escalation; a lower click rate is useful but does not show how quickly users report. Option B is wrong because training completion rate only proves attendance, not whether employees learned to recognize or escalate phishing attempts; it is a proxy for exposure, not effectiveness. Option D is wrong because the number of simulation emails sent is a measure of campaign scale, not user behavior; a larger campaign does not inherently indicate faster recognition or reporting.

Full explanation →

668

MCQeasy

After a workstation hardening baseline is updated, the security team wants to confirm that finance laptops actually match the new settings. Which control is the best way to verify this?

A.Run a configuration compliance scan against the updated baseline

B.Ask users whether they think their laptops are secure

C.Assume the baseline was applied because the change ticket was approved

D.Delete the old baseline so there is only one policy to reference

AnswerA

A configuration compliance scan is the definitive verification method because it programmatically compares each endpoint's actual registry keys, service states, group policy settings, and installed software against the approved hardening baseline. This identifies even minor deviations such as a disabled firewall rule or an outdated patch level, giving security teams concrete evidence of compliance or drift. Unlike subjective assessments, a scan produces reproducible, auditable results that directly reflect whether the updated baseline was successfully deployed.

Why this answer

A configuration compliance scan compares the current settings of the finance laptops against the updated hardening baseline. This automated process checks specific registry keys, file permissions, service states, and security policy settings (e.g., via SCAP or CIS benchmarks) to verify alignment. It provides objective, measurable evidence of compliance, unlike subjective user feedback or assumptions.

Exam trap

The trap here is that candidates may confuse change management approval (Option C) with actual technical verification, overlooking the need for a direct compliance check to confirm implementation.

How to eliminate wrong answers

Option B is wrong because asking users whether they think their laptops are secure relies on subjective opinion and lacks technical verification; users cannot accurately assess registry settings, service configurations, or Group Policy objects. Option C is wrong because assuming the baseline was applied based solely on an approved change ticket ignores the possibility of failed deployments, manual overrides, or configuration drift; change management does not guarantee technical enforcement. Option D is wrong because deleting the old baseline does not verify that the new settings are actually applied; it only removes a reference point, leaving no way to measure compliance or detect deviations.

Full explanation →

669

MCQeasy

A policy states that sensitive data must be encrypted, but it does not say which encryption strength to use. The security architect wants a document that lists the exact approved encryption settings for systems to follow. What document is needed?

A.A procedure, because it explains the step-by-step order for handling every file.

B.A standard, because it specifies the required technical values and configurations.

C.A guideline, because it gives suggestions that teams may choose to adopt.

D.A memo, because it is the fastest way to tell teams about a new requirement.

AnswerB

A standard is the right document when the organization needs exact, mandatory technical settings such as approved encryption strength or configuration values. The policy provides the high-level requirement, while the standard translates that requirement into measurable controls that systems and auditors can follow consistently.

Why this answer

A standard is the correct document because it mandates specific, measurable technical requirements—such as exact encryption algorithms (e.g., AES-256), key lengths, and cipher modes (e.g., GCM)—that systems must follow to comply with the policy. Unlike a policy, which states a goal (e.g., 'encrypt sensitive data'), a standard provides the enforceable configuration baseline that the security architect needs.

Exam trap

The trap here is confusing a standard with a guideline: candidates often pick 'guideline' because both documents provide technical details, but a standard is mandatory and prescriptive, while a guideline is advisory and flexible.

How to eliminate wrong answers

Option A is wrong because a procedure details the step-by-step order for performing a task (e.g., how to encrypt a file using a specific tool), not the approved encryption settings themselves. Option C is wrong because a guideline offers recommendations or best practices that teams may choose to adopt, but the security architect requires mandatory, exact values, not optional suggestions. Option D is wrong because a memo is an informal communication method, not a formal document that defines technical requirements; it lacks the authority and precision needed for enforcing encryption configurations.

Full explanation →

670

MCQhard

Based on the exhibit, which governance artifact is being described?

A.Policy, because it states broad organizational intent without requiring specific settings.

B.Standard, because it defines mandatory requirements but does not describe a step-by-step process.

C.Procedure, because it explains the exact sequence an administrator should follow to secure the device.

D.Baseline, because it defines the approved minimum configuration that systems must meet.

AnswerD

The exhibit is labeled as a minimum configuration and lists required settings that establish the approved security floor for all laptops. That is the classic purpose of a baseline. It provides a reference point for configuration consistency and drift detection, and it is often approved by security and technical owners together. The annual review cycle also fits a controlled baseline update process.

Why this answer

The exhibit describes a baseline because it specifies the approved minimum configuration settings that systems must meet, such as requiring AES-256 encryption, disabling weak protocols like SSL and TLS 1.0, and enforcing a minimum password length of 14 characters. These are mandatory security thresholds, not broad intent, step-by-step instructions, or optional standards.

Exam trap

The trap here is that candidates confuse a standard with a baseline, but a standard is a broader mandatory requirement (e.g., 'use encryption') while a baseline specifies the exact minimum acceptable configuration (e.g., 'use AES-256 with a key length of 256 bits').

How to eliminate wrong answers

Option A is wrong because a policy states broad organizational intent and high-level goals, not specific configuration settings like 'AES-256 encryption' or 'disable SSL/TLS 1.0'. Option B is wrong because a standard defines mandatory requirements but does not include the specific numeric thresholds or approved minimum values that a baseline does; the exhibit lists exact minimums (e.g., 14-character passwords), which is characteristic of a baseline. Option C is wrong because a procedure provides a step-by-step sequence of actions, whereas the exhibit only lists required configuration states without any ordered instructions.

Full explanation →

671

MCQmedium

A company is placing a customer-facing web application behind a new security control. The team wants to block malicious HTTP requests such as injection attempts before they reach the application server, with minimal code changes to the app itself. Which control is the best fit?

A.Network access control (NAC) at the switch port.

B.Web application firewall (WAF) in front of the application.

C.Data loss prevention (DLP) on the email gateway.

D.Endpoint detection and response (EDR) on the web server only.

AnswerB

A web application firewall (WAF) is purpose-built to protect web applications by inspecting HTTP/HTTPS traffic at the application layer and filtering malicious requests using signature-based and behavioral rules. It understands web protocols, allowing it to block common exploits such as SQL injection, cross-site scripting (XSS), and CSRF without requiring changes to application code. Deploying a WAF inline in front of the application provides real-time, proactive filtering of inbound requests before they reach the server, making it the correct control for this scenario.

Why this answer

A web application firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7), blocking malicious payloads such as SQL injection and cross-site scripting (XSS) before they reach the web server. It operates without requiring changes to the application code, making it the ideal choice for this scenario.

Exam trap

The trap here is that candidates may confuse a WAF with a network firewall or NAC, thinking any 'security control' placed in front of a server can block application-layer attacks, but only a WAF operates at Layer 7 with HTTP-specific inspection capabilities.

How to eliminate wrong answers

Option A is wrong because Network Access Control (NAC) operates at Layer 2/3 to enforce access policies based on device posture or authentication at the switch port, and it cannot inspect or block application-layer HTTP attacks like injection attempts. Option C is wrong because Data Loss Prevention (DLP) on the email gateway is designed to monitor and prevent exfiltration of sensitive data in email traffic, not to filter malicious HTTP requests targeting a web application. Option D is wrong because Endpoint Detection and Response (EDR) on the web server only detects and responds to threats at the host level after they have reached the server, whereas the requirement is to block attacks before they reach the application server with minimal code changes.

Full explanation →

672

MCQeasy

A customer-facing website must stay available if one of two application servers fails. Which design should the team implement?

A.A single server with a larger power supply

B.A load balancer in front of multiple application servers

C.A daily screenshot of the website

D.A more restrictive password policy

AnswerB

A load balancer can send traffic to a healthy server if one instance becomes unavailable.

Why this answer

A load balancer distributes incoming traffic across multiple application servers, providing high availability and fault tolerance. If one server fails, the load balancer automatically redirects traffic to the remaining healthy server(s), ensuring the website remains accessible. This design directly addresses the requirement for continued availability despite a single server failure.

Exam trap

The trap here is that candidates may confuse high availability with other security or operational measures, such as backups or password policies, failing to recognize that only redundant infrastructure with automatic failover can maintain uptime during a server failure.

How to eliminate wrong answers

Option A is wrong because a larger power supply only addresses power redundancy for a single server, not server-level failure; if the server itself fails, the website goes down regardless of power capacity. Option C is wrong because a daily screenshot captures a static image of the website at a point in time and does nothing to maintain live availability or handle server failures. Option D is wrong because a more restrictive password policy improves authentication security but has no impact on server redundancy or application availability.

Full explanation →

673

MCQmedium

An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?

A.Power off the server immediately to stop all attacker activity

B.Isolate the server from the network while keeping it powered on

C.Start restoring from backup before collecting any logs or memory data

D.Delete the ransomware note and suspicious files to reduce business disruption

AnswerB

Network isolation, such as unplugging the cable or applying a host-based firewall rule, halts the ransomware's ability to encrypt additional shares and disrupts command-and-control channels, effectively containing the blast radius. Keeping the server powered preserves memory-resident data, including the malicious process, open handles, and potential encryption keys, which can be harvested via a memory dump for attribution and recovery. This approach balances incident containment with evidence preservation, and should be executed in a way that doesn't delete or alter on-disk artifacts.

Why this answer

The correct first step is to isolate the server from the network while keeping it powered on. This preserves volatile evidence (e.g., memory, running processes, network connections) that is critical for forensic analysis and understanding the ransomware's entry vector. Powering off would destroy this data, and restoring from backup prematurely could reintroduce the infection or miss evidence needed to prevent recurrence.

Exam trap

The trap here is that candidates often assume immediate power-off is the safest containment action, but CompTIA emphasizes preserving volatile evidence first, as powering off destroys critical forensic data that may be needed for decryption or attribution.

How to eliminate wrong answers

Option A is wrong because powering off the server immediately destroys volatile data in RAM (e.g., encryption keys, active network connections, process artifacts) that are essential for forensic analysis and may be needed to decrypt files or identify the ransomware variant. Option C is wrong because restoring from backup before collecting logs or memory data risks restoring an infected state or missing evidence that could reveal how the ransomware entered, allowing it to strike again.

Full explanation →

674

MCQmedium

A security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of outbound traffic from a single internal workstation to an external IP address known to be associated with a command-and-control (C2) server. The workstation's user reports no unusual activity. Which of the following should the analyst do FIRST?

A.Disconnect the workstation from the network.

B.Run a full antivirus scan on the workstation.

C.Review firewall logs to see if the traffic is being blocked.

D.Inform the user to shut down the workstation.

AnswerA

Disconnecting the workstation from the network is the immediate containment action because it severs the active command-and-control channel, preventing data exfiltration and halting any further lateral movement. Unlike shutting down, this preserves volatile evidence such as running processes, open network connections, and memory-resident malware, which are critical for forensic analysis and determining the full scope of the compromise.

Why this answer

The IDS alert indicates a high volume of outbound traffic to a known C2 server, which strongly suggests the workstation is compromised and communicating with an attacker. Disconnecting the workstation from the network (Option A) is the immediate containment step to prevent data exfiltration and further C2 communication, following the NIST incident response framework's containment phase. This action stops the threat at the network layer without waiting for additional analysis.

Exam trap

CompTIA often tests the principle that containment (disconnecting the network) must precede eradication (antivirus scan) or analysis (log review), and the trap here is that candidates choose a less disruptive step like running a scan or checking logs, thinking they need more data before acting.

Why the other options are wrong

Running a full antivirus scan is a secondary step after containing the threat; the immediate priority is to stop potential data exfiltration or further C2 communication by disconnecting the workstation from the network.

Reviewing firewall logs to see if traffic is being blocked is a secondary step; the immediate priority is to contain the potential compromise by disconnecting the workstation from the network to prevent further C2 communication.

In this scenario, the priority is to contain the potential compromise immediately by disconnecting the workstation from the network. Instructing the user to shut down the workstation could destroy volatile evidence (e.g., memory contents) and does not prevent the C2 traffic from continuing during the shutdown process.

When would these options actually be correct?

This would be the correct first step if the alert indicated a low-priority anomaly (e.g., a single outbound connection to a non-malicious IP) and the analyst needed to verify the workstation's security posture before escalating.

This option would be correct if the question asked: 'After containing a potential C2 infection, which step should the analyst take to verify if the IDS alert was a false positive?' In that scenario, reviewing firewall logs helps confirm whether the traffic was actually blocked or allowed.

This option would be correct if the question stated that the workstation is exhibiting signs of a severe malware infection (e.g., ransomware encrypting files) and the analyst's goal is to prevent further damage to the system itself, with network containment already in place or not the primary concern.

Why candidates pick the wrong answer

Candidates often default to scanning as a standard response to malware alerts, overlooking that containment is critical when active C2 traffic is detected.

Candidates may think that checking firewall logs is a quick way to validate the alert without disrupting the user, but they overlook the urgency of stopping active C2 traffic.

Candidates may think shutting down the workstation is a quick way to stop the traffic and prevent further damage, but they overlook the need to preserve evidence and the fact that disconnecting the network is a more effective containment step.

Full explanation →

675

MCQmedium

During triage, you see a legitimate browser process spawning powershell.exe with an encoded command, followed by an outbound connection to a newly registered domain. No new executable is written to disk. Which malware characteristic best fits this behavior?

A.Fileless malware that relies on scripting and memory-resident execution.

B.A macro virus that only runs when a document is opened.

C.A boot sector virus that persists by altering startup code.

D.A logic bomb that activates only when a specific date or event is reached.

AnswerA

This pattern matches malware that abuses trusted processes and scripts instead of dropping a traditional executable file. Browser-to-PowerShell chaining, encoded commands, and memory-resident activity are common indicators. The lack of a new file on disk does not mean the endpoint is clean; it often means the attacker is trying to evade traditional file-based detection.

Why this answer

The described behavior—a legitimate browser process spawning PowerShell with an encoded command, executing in memory without writing a new executable to disk, and making an outbound connection to a newly registered domain—is the classic hallmark of fileless malware. Fileless malware leverages built-in scripting engines (like PowerShell) and runs entirely in memory, avoiding traditional disk-based detection by antivirus and forensic tools.

Exam trap

The trap here is that candidates may assume any malware that doesn't write a file is a 'macro virus' or 'boot sector virus,' but the key differentiator is the use of a scripting engine (PowerShell) spawned by a legitimate process, combined with memory-only execution and an immediate C2 connection, which uniquely defines fileless malware.

How to eliminate wrong answers

Option B is wrong because a macro virus requires a document to be opened and typically writes a macro to the document or template, whereas the scenario involves a browser process spawning PowerShell with an encoded command and no document interaction. Option C is wrong because a boot sector virus alters the Master Boot Record (MBR) or Volume Boot Record (VBR) to persist on disk at system startup, but the scenario shows no disk write and execution is memory-resident via a scripting engine. Option D is wrong because a logic bomb triggers only when a specific condition (date, event, or user action) is met, but the scenario describes an immediate outbound connection following the PowerShell execution, with no mention of a delayed or conditional trigger.

Full explanation →

Security+ SY0-701 (SY0-701) — Questions 601–675