44 Security Operations & Identity/Access Mgmt Practice Questions & Answers

1. 1. At 09:12 a sales manager signs in to the cloud suite from an office address in Chicago. At 09:41 the same account authenticates successfully from an address geolocated to Bucharest and approves a push prompt. No remote-access tunnel is in use. What is the best reading, and what should the analyst do?

   • A.A mobile client refreshed a stored token overnight; suppress travel alerts for mobile applications.
   • B.The location database mismapped the second address; mark the alert a known mapping error and close it.
   • C.The user connected through a partner proxy abroad; exempt that address range from the travel rule.
   • D.The session was hijacked or the prompt was fatigue-approved; revoke sessions and reset the credential.✓ Answer

   Two successful authentications 29 minutes apart from cities that cannot be travelled between in that time cannot both belong to the same person, so the second session is either a stolen token replayed by an attacker or a push the user approved out of habit. Containment comes before explanation: kill the live sessions and reset the credential, then test the geolocation and proxy theories.

   Ref QB-Y9BWSVSource: NIST SP 800-61, Computer Security Incident Handling Guide — detection and analysis of anomalous authenticationReport a problem with this question

2. 2. An endpoint agent alerts that a finance workstation launched a signed scripting host from a mail attachment, which then reached a rarely seen external address and registered a scheduled task. Which reading of this telemetry is best supported?

   • A.The signed binary cannot be abused, so the agent mislabeled a routine software update job.
   • B.The document launched built-in tooling and set persistence; treat it as an intrusion.✓ Answer
   • C.The scheduled task is ordinary patch activity and the address belongs to a content network.
   • D.No file was dropped to disk, so nothing malicious ran and the alert needs no further work.

   A code signature proves who published the interpreter, not what it was told to do, and attackers prefer such built-in tools precisely because they are trusted. Attachment to interpreter to rare external destination to scheduled task is an execution chain followed by persistence, which is an intrusion rather than an agent error.

   Ref QB-ESSD2USource: MITRE ATT&CK, T1059 Command and Scripting Interpreter and T1053.005 Scheduled TaskReport a problem with this question

3. 3. An unauthenticated scan reports a critical flaw in a web library on a Linux server. A credentialed check shows the distribution package carries the vendor's backported fix, the version string is unchanged by design, and a proof-of-concept exploit fails. How should the finding be handled?

   • A.Keep it open as a true positive, since a failed exploit only shows the test was flawed.
   • B.Remove the package and the service, since backported fixes are not tracked by scanners.
   • C.Rebuild the library from upstream source, since the banner version governs the real risk.
   • D.Close it as a false positive with the credentialed evidence, and tune the scan policy.✓ Answer

   Distributions commonly apply a vendor fix while keeping the upstream version string, so a scanner that judges by banner alone reports a vulnerability that is not present. Credentialed package evidence plus a failed exploit is what confirms a false positive, and the policy should be adjusted so the same noise does not return each cycle.

   Ref QB-X9YJMUSource: CompTIA Security+ Exam Objectives, Security Operations — vulnerability analysis: confirmation of false positives and credentialed scanningReport a problem with this question

4. 4. Ransomware is encrypting files on three file servers and is spreading over server message block shares. A junior administrator proposes reimaging the first server at once. What should be done first, and why?

   • A.Reimage the first server immediately, because eradication at the source halts the spread.
   • B.Notify customers and the regulator now, because disclosure clocks start at first detection.
   • C.Restore the shares from last night's backup, because recovery of service is the priority.
   • D.Isolate the hosts and block the spreading path, because containment precedes eradication.✓ Answer

   Standard incident handling places containment before eradication so that damage stops while evidence is still intact. Reimaging the first server destroys the memory and disk evidence and leaves the other infected hosts free to keep encrypting, and notification and restoration both belong to later phases.

   Ref QB-HSUDJXSource: NIST SP 800-61, Computer Security Incident Handling Guide — containment, eradication and recoveryReport a problem with this question

5. 5. A compromised laptop is off the network with its account disabled, memory and disk images are captured, and a malicious browser extension is identified as the entry point. Under standard incident handling, what comes next?

   • A.Hold the lessons-learned review and revise the plan, since the entry point is already known.
   • B.Return the laptop to the user and watch for repeat alerts, treating isolation as sufficient.
   • C.Remove the extension and its artifacts, then confirm the host is clean before rebuilding it.✓ Answer
   • D.Restore the user's files and reconnect the host, since the threat no longer has any access.

   Isolation and account disablement are containment, and evidence has already been preserved, so the next phase is eradication: remove the malicious component and every artifact it created, then verify. Recovery restores and validates the host afterwards, and lessons learned is the final phase, not a shortcut taken while the host is still dirty.

   Ref QB-2A2K5YSource: NIST SP 800-61, Computer Security Incident Handling Guide — eradication following containmentReport a problem with this question

6. 6. A server believed to hold an attacker's tooling is still powered on. The team can collect memory, temporary and swap files, the system disk, and logs already shipped to the log server. Which acquisition order is correct?

   • A.The system disk, then memory and live connections, then swap files, then the shipped logs.
   • B.Shipped logs, then the system disk, then temporary and swap files, then memory contents.
   • C.Temporary and swap files, then the system disk, then shipped logs, then memory contents.
   • D.Memory and live connections, then temporary and swap files, then the disk, then shipped logs.✓ Answer

   Acquisition works from the most perishable source to the most durable, because powering down or even continued running destroys volatile state first. Memory and live connections vanish at shutdown, temporary and swap files are overwritten soon after, the disk survives handling, and logs already copied to a separate server are the most stable of all.

   Ref QB-GSG3DWSource: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response — order of volatilityReport a problem with this question

7. 7. Leadership must know exactly which records left the company during a two-hour encrypted transfer of 4 GB to an external host. Flow records and endpoint process logs are available. Which source can establish the content that was sent?

   • A.The flow records, since byte counts, ports and duration identify the files that moved.
   • B.The endpoint process log, since the process name reveals which documents were read.
   • C.The firewall log, since each permitted session entry stores the payload it carried.
   • D.The packet capture from that window, if session keys or a decrypting proxy exist.✓ Answer

   Flow records, firewall entries and process logs are all metadata: they answer who talked to whom, for how long and with which program, but none of them stores the bytes of the conversation. Only a packet capture carries the payload, and it is readable only where the session keys are held or a proxy terminated the encryption.

   Ref QB-Z9P8YWSource: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response — collecting network traffic dataReport a problem with this question

8. 8. An imaged drive passes from the first responder to an examiner and then to outside counsel. At the hearing, the other side argues the image cannot be tied to the seized machine. Which practice most directly answers that argument?

   • A.A calibration certificate showing the imaging hardware was tested before the acquisition.
   • B.A responder statement describing how the machine was found and what was done to it.
   • C.A retention schedule proving the image was held for the period the policy requires.
   • D.An unbroken handoff record naming each custodian, the date, the time and the purpose.✓ Answer

   The challenge is about continuity of possession, which only a chain of custody answers: it records every person who held the evidence, when, and why, so that no unaccounted gap exists between seizure and court. Calibration papers, narrative statements and retention schedules address other questions and leave the gap argument standing.

   Ref QB-BSQDHQSource: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response — chain of custodyReport a problem with this question

9. 9. Counsel advises that litigation involving a former employee is reasonably anticipated. Mail items are purged after 90 days and security logs roll after 30. What must the operations team do?

   • A.Suspend the purge schedules for those accounts and log sources until counsel lifts it.✓ Answer
   • B.Export the mailbox to a local archive file and let the normal purge schedules continue.
   • C.Shorten retention to the legal minimum so less material can be demanded in discovery.
   • D.Change nothing until a subpoena arrives, since retention policy governs until that point.

   A preservation duty attaches when litigation is reasonably anticipated, not when a subpoena is served, and it overrides routine deletion for the relevant custodians and systems. Letting the 30-day and 90-day cycles run, or shortening retention on purpose, risks a spoliation finding even though the deletion was automatic.

   Ref QB-U9WJ4RSource: U.S. Federal Rules of Civil Procedure, Rule 37(e) — failure to preserve electronically stored informationReport a problem with this question

10. 10. Retired solid-state drives holding confidential data will be sold to a refurbisher. Each drive encrypts everything it writes with an internal media key. Which method sanitizes them and leaves them usable?

    • A.Overwrite every logical block three times, which clears all cells the controller manages.
    • B.Degauss each drive in a certified field, which clears the contents of any storage medium.
    • C.Invoke the drive's cryptographic erase, which discards the media key and orphans the data.✓ Answer
    • D.Quick-format and reinstall the system, which removes the stored records from the drive.

    On self-encrypting flash media, destroying the media key makes every stored block unreadable in one operation while the device stays serviceable. Overwriting cannot reach spare and over-provisioned cells hidden by wear levelling, degaussing only affects magnetic media, and a quick format merely removes file pointers.

    Ref QB-4NU2QXSource: NIST SP 800-88, Guidelines for Media Sanitization — cryptographic erase and flash memory mediaReport a problem with this question

11. 11. A security operations centre takes roughly 4,000 alerts a shift, and nine in ten come from three rules that fire on ordinary administrative activity. Analysts now close batches unread, and a real detection was missed last week. What is the correct response?

    • A.Disable the three rules outright, since their volume proves they detect nothing of value.
    • B.Add analysts to each shift, since this is a staffing shortfall rather than a rule problem.
    • C.Tune the three rules with scoped exclusions and thresholds, then measure detection quality.✓ Answer
    • D.Raise every alert's severity, so that nothing can be closed in bulk without being read.

    Alert fatigue is a detection-engineering failure, and the remedy is tuning: exclude the known-good administrative patterns and set thresholds so the rules still fire on the abnormal case. Disabling the rules creates blind spots, extra staff only absorb the same noise, and inflating severity destroys the priority scheme that tells analysts what to open first.

    Ref QB-K5PV4XSource: CompTIA Security+ Exam Objectives, Security Operations — alerting and monitoring activities: alert tuningReport a problem with this question

12. 12. A company publishes a DNS record listing the hosts permitted to send mail for its domain, yet partners keep reporting fake invoices that show the company's domain in the visible From header. What explains this, and what closes the gap?

    • A.That record signs each message, so a bad signature is rejected and the reports must be wrong.
    • B.That record already covers the visible header, so the gap is receivers choosing not to check.
    • C.That record checks only the sending host; a policy and alignment record drives rejection.✓ Answer
    • D.That record is cached too long, so shortening its lifetime will stop the spoofed messages.

    A sender-authorization record is evaluated against the envelope sender, so a message can pass it while carrying any domain the attacker likes in the header the user actually reads. The policy record is what requires the authenticated identifier to align with that visible header and tells receivers to quarantine or reject when it does not, with aggregate reports back to the domain owner.

    Ref QB-5N7DVYSource: RFC 7489 (DMARC) — identifier alignment and policy, with RFC 7208 (SPF) — envelope sender authorizationReport a problem with this question

13. 13. Over six hours, authentication logs record exactly one failed sign-in against each of 900 different accounts from a handful of external addresses, followed by two successes. No account reached its lockout threshold. Which activity does this pattern show?

    • A.One or two common passwords tried across many accounts to stay under lockout limits.✓ Answer
    • B.Many passwords tried quickly against a single account until the correct one is accepted.
    • C.Breached username and password pairs replayed in bulk against a different service.
    • D.A misconfigured client repeatedly presenting one user's stale cached credential.

    The shape of the data decides it: breadth across accounts with a single attempt each is how an attacker stays below lockout counters, which is password spraying. Classic brute force concentrates many guesses on one account, and a misconfigured client repeats failures for one identity rather than walking through 900 of them.

    Ref QB-M528AYSource: MITRE ATT&CK, T1110.003 Brute Force: Password SprayingReport a problem with this question

14. 14. A team must find injection-prone code paths in a new service before release. There is no running instance to exercise and no test environment yet. Which method fits, and what does it miss?

    • A.Dynamic testing of a running build, which exercises inputs but needs a live environment.
    • B.Static review of the source, which flags risky patterns but misses runtime configuration.✓ Answer
    • C.Fuzzing the service endpoints, which finds crash conditions but needs a listening service.
    • D.Dependency package monitoring, which reports library flaws but not the team's own code.

    Static analysis reads the source without executing it, so it is the only listed method that works before any instance exists, and it is well suited to spotting unvalidated input reaching a query or command. Its blind spot is everything that depends on the deployed state, such as server configuration, credentials and runtime data flows, which later dynamic testing must cover.

    Ref QB-6NJQ22Source: NIST SP 800-218, Secure Software Development Framework — review and analyze human-readable codeReport a problem with this question

15. 15. A remediation ticket carries a unique catalogue identifier for the flaw and, separately, a numeric severity rating from 0 to 10. A manager asks which of the two should drive the order of work. Which statement is correct?

    • A.The identifier encodes severity in its sequence, so the rating adds nothing to that order.
    • B.The numeric rating names the flaw uniquely, while the identifier estimates exploitability.
    • C.The identifier only names the flaw; the rating, weighed with exposure, sets urgency.✓ Answer
    • D.Both measure severity, so the higher of the two values should decide what is fixed first.

    The catalogue identifier is a label that lets everyone refer to the same flaw; its digits carry no severity meaning at all. The 0 to 10 rating is the severity scoring system, and its environmental and threat metrics are exactly where exposure — internet-facing, exploit available, compensating controls — is folded in to produce the working order.

    Ref QB-N5DJFZSource: FIRST Common Vulnerability Scoring System specification; MITRE CVE Program identifier definitionReport a problem with this question

16. 16. A retailer's staff wireless uses a shared passphrase. A consultant captured the association exchange and recovered the passphrase offline with a wordlist. Which change removes that offline attack without deploying client certificates?

    • A.Lengthen the passphrase and rotate it quarterly so the captured exchange becomes useless.
    • B.Stop broadcasting the network name so the association exchange can no longer be captured.
    • C.Adopt the personal mode whose key exchange blocks offline guessing and adds forward secrecy.✓ Answer
    • D.Allow only known hardware addresses so the consultant's capture device cannot associate.

    The newer personal mode replaces the pre-shared-key handshake with a password-authenticated key exchange, so a captured exchange yields no material an attacker can test guesses against offline, and each session key stays safe even if the passphrase later leaks. A longer passphrase only raises the cost of guessing, while hiding the name and filtering hardware addresses stop neither capture nor cracking.

    Ref QB-7NW283Source: Wi-Fi Alliance WPA3 specification — Simultaneous Authentication of Equals (SAE) handshakeReport a problem with this question

17. 17. With no alert having fired, a team forms the hypothesis that an intruder is persisting through scheduled tasks and searches 90 days of endpoint telemetry for rarely seen task names. How is this work best characterised?

    • A.Incident response in its detection phase, which starts once an alert has been validated.
    • B.Hypothesis-driven hunting, which can surface activity no detection rule was written for.✓ Answer
    • C.Tuning of the persistence rules, which cuts noise by refining thresholds and exclusions.
    • D.A configuration audit of scheduled tasks, which tests hosts against the build baseline.

    Threat hunting is proactive and starts from a stated hypothesis about adversary behaviour rather than from a triggered alert, which is what lets it find intrusions that existing rules never described. Incident response is reactive by definition, tuning changes rules rather than searching data, and a configuration audit measures compliance instead of looking for an adversary.

    Ref QB-P5RVM2Source: MITRE TTP-Based Hunting methodology — hypothesis-driven hunting without a triggering alertReport a problem with this question

18. 18. A Windows security log shows 200 failed-logon events for one service account inside ten minutes, then a single successful logon for that account, then an account-creation event from the same host. What reading is best supported?

    • A.A scheduled job held a stale password and an administrator fixed it with a new account.
    • B.A password-guessing attack succeeded and the intruder created an account for persistence.✓ Answer
    • C.Cached credentials replicated between controllers, failing until the sync had completed.
    • D.An expired certificate blocked the service and the success entry shows renewal finishing.

    A dense burst of failed logons ending in one success is the signature of guessing that finally hit, and the account creation immediately afterwards from the same host is the intruder establishing a second way back in. A stale service password produces repeated failures with no success and no new account, and neither replication nor certificate renewal generates an account-creation event.

    Ref QB-8N9DD4Source: Microsoft Windows security auditing reference — logon events 4624 and 4625, account creation event 4720Report a problem with this question

19. 19. A hospital must inspect traffic on a link serving a clinical system that cannot tolerate added latency or a dropped session, and also wants automatic blocking on its guest segment. Which deployment meets both needs?

    • A.An inline blocking sensor on the clinical link and a tap-fed sensor on the guest segment.
    • B.A tap-fed sensor on the clinical link and an inline blocking sensor on the guest segment.✓ Answer
    • C.Tap-fed sensors on both links, with blocking performed by a script that reacts to alerts.
    • D.Inline blocking sensors on both links, with all signatures disabled on the clinical link.

    A sensor fed by a tap or mirror port sees a copy of the traffic, so it can never add delay or drop a clinical session, but it can only detect and alert. Blocking requires the sensor to sit in the traffic path, which is acceptable on the guest segment where a dropped session carries no clinical risk.

    Ref QB-Q548T3Source: NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems — inline versus passive sensor deploymentReport a problem with this question

20. 20. Twenty application servers have just been built from a vendor image and will publish a service to the internet through a firewall. Which set of steps most directly reduces the attack surface the image itself carries?

    • A.Strip unneeded roles and services, replace default accounts, apply the hardened baseline.✓ Answer
    • B.Install the endpoint agent, join the hosts to the domain, place them in the patch window.
    • C.Open the ports the service needs, publish them at the firewall, confirm the service answers.
    • D.Turn on verbose logging everywhere, add the hosts to the scanner, book a quarterly review.

    Attack surface is the set of listening services, enabled features and known-credential accounts an attacker can reach, so least functionality — remove what the application does not need and replace anything shipped with a default credential — is what shrinks it. Logging, agents and patch windows are valuable but detect or repair rather than reduce exposure, and opening ports enlarges it.

    Ref QB-9DTHVSSource: NIST SP 800-123, Guide to General Server Security — removing unnecessary services, applications and default accountsReport a problem with this question

21. 21. A patch was deployed to close a finding on a database server, and the administrator asks the vulnerability manager to close the ticket the same afternoon. What is required before the finding is closed?

    • A.An authenticated rescan showing the flaw is gone, recorded against the ticket.✓ Answer
    • B.A change record showing the patch was installed, recorded against the ticket.
    • C.A vendor advisory stating the release fixes the flaw, filed with the ticket.
    • D.An attestation that the server was rebooted after patching, filed with the ticket.

    Remediation is not complete until it is validated on the affected host, because patches fail to apply, roll back, or leave a vulnerable component in place behind a successful installer. Only a rescan tests the system as it now runs; installation records, vendor advisories and reboot attestations describe intent rather than the resulting state.

    Ref QB-SVYPFTSource: NIST SP 800-40, Guide to Enterprise Patch Management Planning — verification of remediationReport a problem with this question

22. 22. Staff read corporate mail on personally owned phones. Policy requires that company data can be removed at termination without touching personal photos or messages. Which configuration meets that requirement?

    • A.Enforce a managed container for corporate data so a selective wipe removes only it.✓ Answer
    • B.Require a passcode and device encryption so corporate data is unreadable at exit.
    • C.Enroll the phones for full management so a factory reset clears the device at exit.
    • D.Bar mail on personal phones and issue loaners so no company data lands on them.

    Containerization keeps corporate mail, files and credentials in a managed workspace that is cryptographically separate from the rest of the phone, so the platform can wipe that workspace alone and leave the owner's data intact. A full-device reset destroys personal content the employer has no right to erase, a passcode does nothing at termination, and banning personal phones abandons the stated arrangement rather than securing it.

    Ref QB-AD6V2USource: NIST SP 800-124, Guidelines for Managing the Security of Mobile Devices — containerization and selective wipeReport a problem with this question

23. 23. A manufacturer must let engineers employed by three supplier firms reach its parts-design portal. Legal requires that each supplier keep managing its own staff accounts, and that a departing engineer lose portal access the moment that supplier disables the account. Which design meets both requirements?

    • A.Create guest accounts in the portal's own directory for each supplier engineer, reviewed quarterly.
    • B.Extend the corporate directory to the suppliers so their administrators create the accounts inside it.
    • C.Accept identity assertions issued by each supplier's identity provider and map them to portal roles.✓ Answer
    • D.Issue one shared account per supplier firm and rotate its password after each project milestone.

    Federation lets each supplier's own identity provider authenticate its staff and send a signed assertion to the portal, which maps that assertion to a role. Because the manufacturer never holds the credential, the moment the supplier disables the account no assertion is issued and access ends. Guest accounts, a delegated corporate directory and shared logins all leave credentials the manufacturer must revoke itself.

    Ref QB-TVB2NUSource: NIST SP 800-63C, Digital Identity Guidelines: Federation and Assertions (identity provider asserts to a relying party)Report a problem with this question

24. 24. A finance team is adopting an externally hosted expense application. Security requires that no user password ever reach the vendor and that sign-in happen in the browser against the company's existing identity provider. Which arrangement satisfies that requirement?

    • A.The vendor keeps a copy of each password hash, synchronized nightly from the corporate directory.
    • B.The password manager fills the vendor's own login form from an approved shared credential vault.
    • C.The browser relays a signed authentication assertion issued by the company's identity provider.✓ Answer
    • D.The vendor queries the corporate directory over a protected channel to check the typed password.

    In browser-based single sign-on the identity provider authenticates the user and issues a signed assertion that the browser delivers to the service provider, so the secret stays at the identity provider and a breach of the vendor exposes no password. Hash synchronization, vault autofill and directory proxying each place the password, or its hash, somewhere in the vendor's path.

    Ref QB-BDH78VSource: NIST SP 800-63C, Digital Identity Guidelines: Federation and Assertions (front-channel assertion delivered through the browser)Report a problem with this question

25. 25. After an unauthorized firewall rule change, an investigation finds that four network engineers all sign in to the appliance with a single 'netadmin' account whose password is kept on a team wiki. Management asks what this practice has cost the organization. Which answer is accurate?

    • A.It destroys individual attribution, so the change cannot be tied to the one engineer who made it.✓ Answer
    • B.It weakens the password itself, because a secret known to four people is easier to compute.
    • C.It disables the appliance's logging, because devices do not record actions of shared accounts.
    • D.It breaks the encryption of the session, because the appliance cannot bind a key to a person.

    Accounting in authentication, authorization and accounting depends on every action mapping to one identifiable person. A shared credential still produces complete logs and an encrypted session, and sharing does not change the password's mathematical strength, but the log entries name only the account, so no engineer can be held responsible for the change.

    Ref QB-UVPCTVSource: NIST SP 800-53, Access Control family, AC-2 account management (individual accountability for shared and group accounts)Report a problem with this question

26. 26. A clinic must let a visiting physician open a patient chart only while she is rostered to that site, inside her scheduled hours, and from a managed device. Her permission set must not be rewritten each time she rotates to another site. Which access control design fits?

    • A.Create one role per clinic site and move the physician between those roles at each rotation.
    • B.Let each chart's owning department grant her permission on the individual records she needs.
    • C.Assign a clearance level to the physician and a sensitivity label to every patient chart.
    • D.Evaluate roster, shift window and device state at each request against a written policy rule.✓ Answer

    Attribute-based access control decides each request by evaluating subject, object and environment attributes against a policy rule, so a rotation changes the value of the roster attribute rather than the permission set. A role per site multiplies roles and requires manual moves, owner-granted permissions are discretionary and unreviewable at scale, and clearance against label is the mandatory model, which cannot express shift hours or device state.

    Ref QB-CDVHDWSource: NIST SP 800-162, Guide to Attribute Based Access Control (ABAC) Definition and ConsiderationsReport a problem with this question

27. 27. A firm's identity process grants new entitlements on the day an employee transfers, but removes nothing, and the accumulated rights surface only at the annual audit. The firm wants the condition prevented rather than reported a year later. Which change does that?

    • A.Shorten the audit cycle so the accumulated entitlements are reported once a quarter.
    • B.Move the leaver checklist earlier so accounts are disabled on the day notice is given.
    • C.Make the transfer request revoke the old department's entitlements as it grants the new ones.✓ Answer
    • D.Have the employee acknowledge the access policy again whenever a transfer is processed.

    Privilege creep is produced by a mover step that only adds, so the fix belongs in that step: revocation of the prior role's access must be part of the same transfer request, which removes the rights at the moment their business justification ends. A shorter audit cycle only detects the condition sooner, and the leaver checklist and a policy signature do not touch internal moves at all.

    Ref QB-VV2QYWSource: CompTIA Security+ exam objectives, Security Operations, identity and access management (provisioning and de-provisioning user accounts)Report a problem with this question

28. 28. A brokerage must protect administrator sign-in to its trading platform against phishing pages that relay the login to the genuine site in real time. Which second factor meets that requirement?

    • A.A six-digit code from an authenticator application, refreshed every thirty seconds.
    • B.A hardware authenticator that signs a challenge bound to the site's own domain name.✓ Answer
    • C.A one-time code sent by text message to the administrator's registered mobile number.
    • D.A push notification that the administrator approves on an enrolled corporate handset.

    A relaying phishing site defeats every factor the user can read out, retype or simply approve, because the attacker forwards it within its lifetime. An authenticator that signs a challenge bound to the origin produces a signature the attacker's domain cannot use, which is what makes it phishing resistant.

    Ref QB-5DD77NSource: NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management (verifier impersonation resistance)Report a problem with this question

29. 29. A bank's risk team wants to retire text-message one-time codes for privileged accounts. An executive objects that the codes are secret and expire within minutes. What is the accurate rebuttal?

    • A.The code is a knowledge factor, so it merely repeats the factor the password supplies.
    • B.The code is too short, so an attacker can guess it before the expiry window closes.
    • C.Text messages are unencrypted, so anyone on the same wireless network can read them.
    • D.Delivery depends on control of the number, which an attacker can seize by porting it.✓ Answer

    A code sent to a telephone number is a possession factor whose whole security rests on the subscriber controlling that number. A subscriber identity module swap or a fraudulent port moves the number to the attacker, who then receives the codes without ever breaking their secrecy or waiting out their short lifetime.

    Ref QB-NVJCSNSource: NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management (out-of-band authenticators using the public switched telephone network are restricted)Report a problem with this question

30. 30. A build pipeline's configuration file, committed to the same repository as the application, holds the production database password in clear text. The team must keep the pipeline working without that credential living in the repository. Which change accomplishes this?

    • A.Encrypt the configuration file and commit the decryption passphrase next to the pipeline.
    • B.Have the pipeline fetch the credential at run time from a vault, using its own identity.✓ Answer
    • C.Replace the password with a longer one and rotate it after each production deployment.
    • D.Move the credential into a repository variable and restrict the repository to the team.

    Secrets management removes the stored secret entirely: the workload authenticates with its own identity and is issued the credential at run time, so nothing durable sits in version control and rotation happens in one place. Committing the passphrase moves the secret rather than removing it, a repository variable still lives and is copied with the repository, and a longer password is still a stored password.

    Ref QB-CFTPDWSource: NIST SP 800-53, Identification and Authentication family, IA-5 authenticator management (protection of static authenticators embedded in applications and scripts)Report a problem with this question

31. 31. A cloud team repeatedly deploys storage buckets that allow anonymous reads, and a scanner reports the exposure days later. They want the insecure definition rejected before any bucket is created. Which practice achieves that?

    • A.Raise the scanner's frequency so a public bucket is flagged within an hour of creation.
    • B.Express the rule as machine-readable policy the pipeline checks against the template.✓ Answer
    • C.Publish a written standard forbidding public buckets and have each architect sign it.
    • D.Grant deployment rights only to senior engineers who finished the cloud security course.

    Policy expressed as code is evaluated against the infrastructure definition during the build, so a template that would create a publicly readable bucket fails the build and the resource is never created. A scanner is detective and reports after the fact, and a signed standard or a training requirement is an administrative control that cannot stop a deployment.

    Ref QB-UXMHTVSource: CompTIA Security+ exam objectives, Security Operations, automation and orchestration (guardrails in the deployment process)Report a problem with this question

32. 32. A three-person security team automates account provisioning, alert enrichment and first-line containment, all previously done by hand. The director asks what the organization actually gains. Which answer is BEST?

    • A.The written procedure becomes unnecessary, because the workflow now documents itself.
    • B.Every run executes the same way, so the work scales and responses begin sooner.✓ Answer
    • C.Staffing can be reduced, because the platform decides which incidents deserve attention.
    • D.Access reviews can be relaxed, because a service account now acts in place of people.

    The value orchestration delivers to a small team is consistency and reach: the same enforced sequence runs every time, so a handful of people can cover far more work and containment starts in seconds rather than after a queue wait. Automation does not replace documentation, does not take risk decisions, and makes the identities it uses more important to review, not less.

    Ref QB-BFFC8VSource: CompTIA Security+ exam objectives, Security Operations, automation and orchestration (efficiency, enforcing baselines, scale and reaction time)Report a problem with this question

33. 33. A year later the same team's workflows break whenever a vendor changes an interface, and a single engineer wrote nearly all of them. A board member asks what recurring cost the automation created. Which answer is accurate?

    • A.The workflows are software, so they need versioning, testing and a named owner.✓ Answer
    • B.The workflows need an analyst watching the console throughout every business day.
    • C.The workflows consume licences, so the recurring cost is essentially the platform fee.
    • D.The workflows must be re-approved by the legal team each time an incident type is added.

    Automation converts manual effort into a codebase, and a codebase carries the ongoing obligations of software: source control, testing against interface changes, documentation and an accountable owner. Concentrating authorship in one engineer adds key-person risk on top of that, while licence fees, console watching and legal review are not what makes the workflows brittle.

    Ref QB-TX97NUSource: CompTIA Security+ exam objectives, Security Operations, automation and orchestration (ongoing supportability, technical debt and single points of failure)Report a problem with this question

34. 34. A new regulation obliges a company to encrypt backup media. The company maintains a data protection policy, an encryption standard, a backup procedure and a mobile-device guideline. Where must the mandatory key length be recorded, and where must the new operator steps be written?

    • A.The key length in the standard; the steps in the procedure.✓ Answer
    • B.The key length in the procedure; the steps in the guideline.
    • C.The key length in the guideline; the steps in the policy.
    • D.The key length in the policy; the steps in the standard.

    In the governance hierarchy a standard states the mandatory specific requirement, such as an algorithm and key length, while a procedure gives the ordered steps someone follows to carry it out. The policy states intent and authority without technical settings, and a guideline is recommended practice that binds nobody, so neither can hold a mandatory key length.

    Ref QB-EFHCRYSource: CompTIA Security+ exam objectives, Security Program Management and Oversight, security governance (policies, standards, procedures and guidelines)Report a problem with this question

35. 35. A retailer hires an analytics firm to score customer records for churn risk. The retailer decides which data is collected and for what purpose; the firm runs the models strictly on instruction and retains nothing afterward. Under standard privacy terminology, how are the two parties classified?

    • A.Both are processors, since the customers themselves own the personal data at issue.
    • B.The analytics firm is the controller; the retailer is the processor on instruction.
    • C.Both are controllers, since each one holds and handles the same customer records.
    • D.The retailer is the controller; the analytics firm is the processor on instruction.✓ Answer

    The classification follows who decides, not who touches the data: the party that determines the purposes and means of processing is the controller, and a party that processes only on the controller's documented instruction is the processor. Holding the same records does not make both controllers, and the data subject's rights over personal data do not turn the controller into a processor.

    Ref QB-WXB76YSource: EU General Data Protection Regulation, Article 4 definitions of controller and processorReport a problem with this question

36. 36. A warehouse and its contents are valued at 4,000,000 dollars. A fire engineering study estimates that a single fire would destroy 35 percent of that value. What is the single loss expectancy for one fire?

    • A.350,000 dollars
    • B.1,400,000 dollars✓ Answer
    • C.2,600,000 dollars
    • D.4,000,000 dollars

    Single loss expectancy is asset value multiplied by the exposure factor, so 4,000,000 times 0.35 gives 1,400,000. Reading 35 percent as 3.5 percent produces 350,000, taking the surviving share instead of the lost share produces 2,600,000, and treating the exposure factor as total destruction produces the full asset value.

    Ref QB-DF62KXSource: CompTIA Security+ exam objectives, Security Program Management and Oversight, quantitative risk analysis (single loss expectancy and exposure factor)Report a problem with this question

37. 37. A model puts the single loss expectancy for a regional data-center flood at 800,000 dollars, and historical records show such a flood strikes once every four years. What is the annualized loss expectancy?

    • A.200,000 dollars✓ Answer
    • B.400,000 dollars
    • C.800,000 dollars
    • D.3,200,000 dollars

    The annualized rate of occurrence is expressed per year, so once every four years is 0.25, and annualized loss expectancy is single loss expectancy times that rate: 800,000 times 0.25 equals 200,000. Multiplying by four instead of dividing gives 3,200,000, and reporting the single loss expectancy unchanged answers a different question.

    Ref QB-VXYUYWSource: CompTIA Security+ exam objectives, Security Program Management and Oversight, quantitative risk analysis (annualized loss expectancy and annualized rate of occurrence)Report a problem with this question

38. 38. A retailer's register of risks shows an annualized loss expectancy of 96,000 dollars for card-terminal tampering, and the tampering occurs twice each quarter. What is the single loss expectancy for one incident?

    • A.768,000 dollars
    • B.48,000 dollars
    • C.192,000 dollars
    • D.12,000 dollars✓ Answer

    Twice each quarter annualizes to eight occurrences a year, and single loss expectancy is the annualized loss expectancy divided by that rate: 96,000 divided by 8 equals 12,000. Using two per year gives 48,000, multiplying instead of dividing gives 768,000, and doubling the annual figure gives 192,000.

    Ref QB-8FDCQRSource: CompTIA Security+ exam objectives, Security Program Management and Oversight, quantitative risk analysis (relationship of annualized loss expectancy, single loss expectancy and annualized rate of occurrence)Report a problem with this question

39. 39. A board resolution states that the company will enter new markets aggressively and will accept material technology risk to do so, while keeping a strict limit on any exposure that could interrupt payroll. Which reading of that resolution is correct?

    • A.A conservative appetite overall, with the tolerance band widened for new markets.
    • B.A neutral appetite overall, because the two statements offset each other exactly.
    • C.A tolerance statement only, because appetite is always expressed as a fixed limit.
    • D.An expansionary appetite overall, with the tolerance band set tightly on payroll.✓ Answer

    Risk appetite is the amount and kind of risk an organization is willing to take to pursue its objectives, and pursuing new markets while accepting material technology risk is the expansionary posture. Tolerance is the allowable variance around that appetite and can be set narrowly for one exposure, so a tight payroll limit coexists with an expansionary appetite rather than contradicting it.

    Ref QB-QX775RSource: CompTIA Security+ exam objectives, Security Program Management and Oversight, risk management process (risk appetite: expansionary, conservative, neutral; risk tolerance)Report a problem with this question

40. 40. A business impact analysis concludes that the order-entry system may lose no more than five minutes of recorded transactions in any failure, although staff can take orders on paper for several hours while it is rebuilt. Which requirement does the five-minute figure express, and what must be engineered to meet it?

    • A.The recovery time objective, which drives how quickly the platform is rebuilt.
    • B.The mean time to repair, which drives how the engineering roster is staffed.
    • C.The recovery point objective, which drives how often data is copied or replicated.✓ Answer
    • D.The mean time between failures, which drives how the hardware is selected.

    A limit on how much data may be lost is the recovery point objective, and it is met by the interval between backups or replication cycles, since anything written after the last copy is gone. The several hours of paper working describe the recovery time objective, while the two mean-time figures describe repair duration and failure frequency rather than tolerable loss.

    Ref QB-DUUH9ASource: NIST SP 800-34, Contingency Planning Guide for Federal Information Systems, business impact analysis (recovery point objective and recovery time objective)Report a problem with this question

41. 41. A claims platform carries a four-hour recovery time objective. Vendor figures give its storage array a mean time to repair of six hours and a mean time between failures of two years. What conclusion should the continuity manager draw?

    • A.The long interval between failures offsets the repair time, so the objective holds.
    • B.The objective should be raised to six hours so that it matches the vendor's figure.
    • C.Repair time exceeds the objective, so recovery cannot depend on repairing that one array.✓ Answer
    • D.Repair time is irrelevant here, since the objective governs only how much data is lost.

    The recovery time objective is a business requirement, while mean time to repair is the expected duration of a fix; six hours of repair against a four-hour objective means the design must fail over to redundant storage or an alternate site rather than wait for the array. Mean time between failures describes how often failures happen and cannot shorten any single outage, and lowering a business requirement to match a component is backwards.

    Ref QB-WB2QUASource: NIST SP 800-34, Contingency Planning Guide for Federal Information Systems, recovery time objective and maximum tolerable downtimeReport a problem with this question

42. 42. A company signs standing commercial terms with an integrator, covering liability, confidentiality and governing law, so that each future project needs only its own schedule of deliverables, dates and price. Which pair of instruments is being described?

    • A.A memorandum of agreement for the terms, and a service level agreement per project.
    • B.A master service agreement for the terms, and a statement of work per project.✓ Answer
    • C.A business partnership agreement for the terms, and a purchase order per project.
    • D.A non-disclosure agreement for the terms, and a memorandum of understanding per project.

    A master service agreement is the binding contract holding the standing terms so they are not renegotiated project by project, and the statement of work executed under it defines the specific deliverables, schedule and price. A memorandum of agreement is not a commercial contract, a service level agreement states performance targets, and confidentiality and partnership instruments cover different subject matter entirely.

    Ref QB-CUG749Source: CompTIA Security+ exam objectives, Security Program Management and Oversight, third-party risk (agreement types: master service agreement, statement of work and work order)Report a problem with this question

43. 43. Two hospital systems want a written statement that they intend to share threat information and to staff a joint exercise, with no binding obligation and no performance figures attached. Which instrument fits that need?

    • A.A memorandum of understanding, because it records shared intent and binds neither side.✓ Answer
    • B.A master service agreement, because it fixes the standing terms of a commercial tie.
    • C.A business partnership agreement, because it fixes how a shared venture is dissolved.
    • D.A service level agreement, because it fixes the response targets each side must meet.

    A memorandum of understanding records broad shared intent between parties and is generally not legally binding, which is exactly what is wanted when no obligation and no measurable commitment is to be created. A service level agreement exists to state measurable targets, a master service agreement is a binding commercial contract, and a partnership agreement governs the economics and dissolution of a joint venture.

    Ref QB-VBPCP9Source: CompTIA Security+ exam objectives, Security Program Management and Oversight, third-party risk (agreement types: memorandum of understanding and memorandum of agreement)Report a problem with this question

44. 44. A regulator requires one assessment that reproduces what an outsider with no inside knowledge could achieve, and a second that checks whether a specific application's authorization logic can be bypassed, with the testers given source code and test accounts. How are the two engagements named in current Security+ terminology?

    • A.Unknown environment for the first, and known environment for the second.✓ Answer
    • B.Partially known environment for the first, and unknown environment for the second.
    • C.Defensive engagement for the first, and integrated engagement for the second.
    • D.Passive reconnaissance for the first, and active reconnaissance for the second.

    Current objectives classify engagements by how much information the tester receives: unknown environment means the tester is given nothing, known environment means full disclosure including source code and accounts, and partially known sits between them. Offensive, defensive and integrated describe which side the team plays, and passive and active describe reconnaissance technique, not the level of disclosure.

    Ref QB-FUJ7MCSource: CompTIA Security+ exam objectives, Security Program Management and Oversight, penetration testing (known, partially known and unknown environment)Report a problem with this question

Practice questions based on the CompTIA Security+ SY0-701 exam objectives. This is an independent study tool, not affiliated with or endorsed by CompTIA, and does not grant certification. About Security+ →