CompTIA Cloud + Certification

Question 1
You are a security administrator investigating a potential infection on a network. Click on each host and firewall. Review all logs to determine which host originated the infection and the status of each remaining host.

Explanation: After analyzing network traffic and host-based logs, it was determined that the host at .22 initiated the primary suspicious connection, serving as the point of entry. The remaining statuses are based on secondary infection indicators found in respective logs.

Question 2
Identify weak password practices (select all that apply):

• A. Complexity
• B. Length
• C. Reuse
• D. Age
• E. Expiration

Explanation: Complexity and reuse are major vulnerabilities; while length is usually desirable, lack of complexity and reusing passwords across different systems significantly increases the risk of successful brute-force or credential-stuffing attacks.

Question 3
Select the containment step that will leave potential evidence on the host uncompromised:

• A. SMS authentication
• B. FIDO security key
• C. OTP token
• D. PIN code

Explanation: A FIDO security key is a hardware-based second factor that provides robust protection against unauthorized access while remaining external to the system, thereby ensuring that investigative logs on the host itself are not altered.

Question 4
Block identified malicious source IPs in the Web Server and CRM Server.

• Action: Use iptables -A INPUT -s [IP_ADDRESS] -j DROP for IPs 180.22.321.137 and 211.23.41.187.
  Explanation: Cybersecurity analysts use firewall rules to block traffic from IP addresses identified as malicious in threat intelligence reports.

Security Management and Compliance

Question 5
Which of the following should be used to ensure an attacker is unable to read the contents of a mobile device’s drive if the device is lost?

• A. TPM
• B. ECC
• C. FDE
• D. HSM
  Explanation: Full Disk Encryption (FDE) protects data at rest by encrypting the entire storage medium, making it unreadable without the correct decryption key.

Question 6
An organization failed to accord the right-to-be-forgotten regulations. Which of the following impacts might this action have on the company?

• A. Fines
• B. Data breaches
• C. Revenue loss
• D. Blackmail
  Explanation: Non-compliance with privacy laws like GDPR results in significant financial penalties imposed by regulatory bodies.

Question 7
Which of the following should be used to aggregate log data in order to create alerts and detect anomalous activity?

• A. SIEM
• B. WAF
• C. Network taps
• D. IDS
  Explanation: Security Information and Event Management (SIEM) platforms collect and analyze logs from across the enterprise to provide centralized monitoring and incident detection.

Question 8
Attackers created a new domain name that looks similar to a popular file-sharing website. Which of the following threat vectors is being used?

• A. Watering-hole attack
• B. Brand impersonation
• C. Phishing
• D. Typosquatting
  Explanation: Typosquatting involves registering domain names that are misspellings of legitimate sites to deceive users.

Question 9
Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses?

• A. Compensating control
• B. Network segmentation
• C. Transfer of risk
• D. SNMP traps
  Explanation: Restricting incoming connections to specific internal IP ranges effectively creates a secure network segment for the isolated device.

Question 10
Which of the following vulnerabilities will lead to a successful attack that injects <script> alert('attack') </script> into a web application?

• A. Directory traversal
• B. Buffer overflow
• C. SQLi
• D. XSS
  Explanation: Cross-Site Scripting (XSS) allows attackers to execute malicious scripts in the user's browser context.

Question 11
Which of the following techniques would attract the attention of a malicious attacker in an insider threat scenario?

• A. Creating a fake text file in /home/salaries
• B. Setting weak passwords in /etc/shadow
• C. Scheduling vulnerable jobs in /etc/crontab
• D. Adding a fake account to /etc/passwd
  Explanation: Using "honeytokens"—decoy files or data—helps detect unauthorized access when curious or malicious insiders interact with them.

Question 12
A systems administrator needs to provide traveling employees with a security measure that will protect company devices regardless of where they are working. Which of the following should the administrator implement?

• A. Isolation
• B. Segmentation
• C. ACL
• D. HIPS
  Explanation: A Host-based Intrusion Prevention System (HIPS) provides local, per-device security monitoring and protection that stays with the endpoint anywhere it connects.

Question 13
Which of the following can automate vulnerability management?

• A. CVE
• B. SCAP
• C. OSINT
• D. CVSS
  Explanation: The Security Content Automation Protocol (SCAP) provides a standard suite of specifications to automate security monitoring, vulnerability management, and policy compliance.

Question 14
A company prepares for an upcoming regulatory audit. The company wants to perform a gap analysis in the most cost-effective way. Which of the following will help the company achieve this goal?

• A. Internal self-assessment
• B. Active reconnaissance
• C. Red team penetration test
• D. Tabletop exercise
  Explanation: Internal self-assessments leverage internal staff and resources to evaluate current controls against compliance standards at minimal extra cost.

Question 15
Which of the following describes when a user installs an unauthorized application by bypassing the authorized application store and installing a binary file?

• A. Jailbreaking
• B. Sideloading
• C. Memory injection
• D. VM escaping
  Explanation: Sideloading refers to the installation of software from unofficial third-party sources rather than a platform's managed application store.

Question 16
A security administrator observed the following in a web server log while investigating an incident: GET ../../../etc/passwd. Which of the following attacks did the security administrator most likely see?

• A. Privilege escalation
• B. Credential replay
• C. Brute force
• D. Directory traversal
  Explanation: Using ".." to navigate the server's directory structure to access unintended system files is characteristic of a directory traversal attack.

Question 17
Which of the following is used as a control on physical and digital assets and serves as a signal for employees to identify security requirements when accessing and manipulating data?

• A. Obfuscation
• B. Encryption
• C. Labeling
• D. Masking
  Explanation: Labeling data with sensitivity classifications (e.g., "Confidential") informs employees of the required security protocols and handling procedures.

Question 18
Which of the following best describe the benefits of a microservices architecture when compared than a monolithic architecture? (Select two):

• A. Easier debugging of the system
• B. Reduced cost of ownership of the system
• C. Improved scalability of the system
• D. Increased compartmentalization of the system
• E. Stronger authentication of the system
• F. Reduced complexity of the system
  Explanation: Microservices allow for the independent scaling of different components and provide natural isolation, ensuring failures in one service do not compromise the entire application.

Question 19
Which of the following scenarios will proper application of the least privilege principle prevent?

• A. A network administrator shuts down a critical network interface
• B. An analyst saves an unauthorized configuration
• C. A threat actor discovers credentials for a shared service account
• D. A change is executed outside of the approved change window
  Explanation: Applying least privilege ensures users only have the permissions necessary for their specific roles, preventing unauthorized actions like saving unapproved configurations.

Question 20
Which of the following is the best reason to perform a tabletop exercise?

• A. To address audit findings
• B. To collect remediation response times
• C. To update the IRP
• D. To calculate the ROI
  Explanation: Tabletop exercises are designed to walk through incident scenarios, allowing teams to identify weaknesses and make necessary updates to the Incident Response Plan (IRP).

Question 21
A security administrator wants to increase a company's technical defenses after two users experienced payroll fraud due to phishing attacks. Which of the following should the administrator do?

• A. Conduct internal phishing campaigns with continuous training for all users on how to recognize phishing attempts
• B. Deploy more secure email gateways and block any email coming from unknown or suspicious domains
• C. Install advanced EDR software on all user workstations and configure alerts to report suspicious communications
• D. Keep web browsers updated to patch known vulnerabilities and use DNS block lists to prevent users from visiting known malicious sites
  Explanation: Strengthening email gateways directly addresses the root cause of the initial breach by filtering out malicious phishing emails at the network perimeter.

Question 22
A cloud architect is working to address the management team's concerns about cloud diversity. Which of the following is the most appropriate aspect of the organization's usage for the architect to consider?

• A. Load balancers to promote resilience
• B. Containerization and autoscaling to promote availability
• C. Multiple providers to promote resilience
• D. Microservices to promote availability
  Explanation: Cloud diversity specifically refers to a multi-cloud strategy, utilizing different providers to ensure that an outage at one company does not crash the entire organization’s infrastructure.

Question 23
A government official receives a blank envelope containing photos and a note instructing the official to wire a large sum of money by midnight to prevent the photos from being leaked on the internet. Which of the following best describes the threat actor's intent?

• A. Organized crime
• B. Philosophical beliefs
• C. Espionage
• D. Blackmail
  Explanation: Blackmail involves threatening to release sensitive or damaging information unless a financial or personal demand is met.

Question 24
A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee's corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?

• A. Application
• B. IPS/IDS
• C. Network
• D. Endpoint
  Explanation: Endpoint logs provide specific details from the device itself regarding running processes and local user activity.

Question 25
Which of the following actions must an organization take to comply with a person's request for the right to be forgotten?

• A. Purge all personally identifiable attributes
• B. Encrypt all of the person's data
• C. Remove all of the person's data
• D. Obfuscate all of the person's data
  Explanation: Compliance with the right-to-be-forgotten requires the complete removal and erasure of all an individual's personal data from all organizational records.

Question 26
Which of the following outlines the configuration, maintenance, and security roles between a cloud service provider and the customer?

• A. Service-level agreement
• B. Responsibility matrix
• C. Memorandum of understanding
• D. Non-disclosure agreement
  Explanation: A shared responsibility matrix clearly delineates which security and operational tasks are managed by the Cloud Service Provider (CSP) and which are the customer's duty.

Question 27
A company processes a large volume of business-to-business transactions and prioritizes data confidentiality over transaction availability. The company’s firewall administrator must configure a new hardware-based firewall to replace the current one. Which of the following should the administrator do to best align with the company requirements in case a security event occurs?

• A. Ensure the firewall data plane moves to fail-closed mode
• B. Implement a deny any rule as the last firewall ACL rule
• C. Prioritize business-critical application traffic through the firewall
• D. Configure rate limiting between the firewall interfaces
  Explanation: A "fail-closed" setting ensures that if the firewall experiences a failure or security event, it defaults to blocking all traffic, prioritizing confidentiality and data protection over availability.

Question 28
A security analyst reviews logs and finds a large number of malicious requests that have caused performance issues on the company’s site. Which of the following would have most likely prevented this attack?

• A. IPsec
• B. TLS
• C. SDN
• D. WAF
  Explanation: A Web Application Firewall (WAF) is designed to inspect and filter HTTP/HTTPS traffic to prevent application-layer attacks and excessive malicious requests.

Question 29
A network administrator implements a screened subnet for hosting public-facing services. Which of the following devices should the administrator place between the internet and the screened subnet to inspect traffic at Layer 7 and prevent HTTP threats?

• A. SASE
• B. WAF
• C. VPN
• D. SD-WAN
  Explanation: WAFs provide the necessary deep-packet inspection at the application layer (Layer 7) required to protect web services from specialized threats.

Question 30
Which of the following security controls is most likely being used when a legacy server is segmented into a private network?

• A. Deterrent
• B. Corrective
• C. Compensating
• D. Preventive
  Explanation: Network segmentation serves as a compensating control when a system cannot be patched or directly secured due to technical limitations (such as legacy software).

Question 31
After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?

• A. Console access
• B. Routing protocols
• C. VLANs
• D. Web-based administration
  Explanation: Disabling web-based administration on routers reduces the attack surface by preventing management access through less secure browser-based portals.

Question 32
Which of the following best describes a common use of OSINT?

• A. Monitoring internal systems and network traffic to detect abnormal behavior
• B. Installing and configuring security patches to fix known vulnerabilities
• C. Collecting information from public forums to find possible security exposures
• D. Encrypting sensitive company data and storing it securely in the cloud
  Explanation: Open Source Intelligence (OSINT) involves gathering information from publicly available internet sources, such as forums and social media, to identify potential threats or leaks.

Question 33
A university employee has logged on to an academic server and attempted to guess the system administrators' login credentials. Which of the following security measures should the university have implemented to detect the employee's attempts to gain access to the administrators' accounts?

• A. Two-factor authentication
• B. Firewall
• C. Intrusion prevention system
• D. User activity logs
  Explanation: Regular monitoring of user activity logs enables security teams to identify suspicious behavior, such as repeated failed login attempts from internal users.

Question 34
Which of the following agreements defines response time, escalation points, and performance metrics?

• A. BPA
• B. MOA
• C. NDA
• D. SLA
  Explanation: A Service Level Agreement (SLA) is a formal contract between a provider and customer that explicitly details the expected levels of service, response times, and uptime metrics.

Question 35
Which of the following data protection strategies can be used to confirm file integrity?

• A. Masking
• B. Encryption
• C. Hashing
• D. Obfuscation
  Explanation: Hashing creates a unique digital fingerprint for data; comparing hash values before and after transmission or storage confirms that the data has not been altered.

Question 36
A company has a primary web server and a standby backup. The company wants to immediately increase the servers' ability to handle higher traffic volumes. Which of the following methods is the simplest way to meet this objective?

• A. Automated failover
• B. Load balancing
• C. Clustering
• D. Containers
  Explanation: Load balancing allows incoming traffic to be distributed across multiple servers, preventing overload and increasing overall capacity for handling high request volumes.

Question 37
A company plans to secure its systems by preventing users from sending sensitive data over corporate email and restricting access to potentially harmful websites. Which of the following features should the company set up? (Select two):

• A. DLP software
• B. DNS filtering
• C. File integrity monitoring
• D. Stateful firewall
• E. Guardrails
• F. Antivirus signatures
  Explanation: Data Loss Prevention (DLP) monitors outgoing communications to prevent data leaks, while DNS filtering prevents users from reaching malicious web domains.

Question 38
Which of the following should an analyst consider when evaluating the effectiveness of the backups in an organization's DRP?

• A. Frequency
• B. Hashing
• C. Deduplication
• D. Replication
  Explanation: The frequency of backups determines how much data would be lost in an emergency; a high frequency results in a shorter Recovery Point Objective (RPO).

Question 39
An important patch for a critical application has just been released, and a systems administrator is identifying all of the systems requiring the patch. Which of the following must be maintained in order to ensure that all systems requiring the patch are updated?

• A. Asset inventory
• B. Network enumeration
• C. Data certification
• D. Procurement process
  Explanation: A comprehensive asset inventory is critical to ensure that security teams know exactly which devices and software versions are present on the network and require patching.

Question 40
A company's policy is to erase all employee data one year after they leave the company. Which of the following data policies does this scenario best describe?

• A. Destruction
• B. Certification
• C. Retention
• D. Sanitization
  Explanation: Retention policies dictate the duration for which different types of data are kept and the timeline for their eventual disposal.

Question 41
When trying to access an internal website, an employee reports that a prompt displays, stating that the site is insecure. Which of the following certificate types is the site most likely using?

• A. Wildcard
• B. Root of trust
• C. Third-party
• D. Self-signed
  Explanation: Self-signed certificates are not verified by a recognized public certificate authority (CA), which causes modern web browsers to display a security warning.

Question 42
Which of the following will best help a security analyst implement and maintain cloud services policy to reduce the likelihood of vulnerabilities being introduced by users or shadow IT? (Select two):

• A. Least privilege
• B. Trusted platform module
• C. Jailbreaking
• D. Access control list
• E. File integrity monitoring
• F. Application allow list
  Explanation: Access control lists and application allow lists restrict which programs and users can interact with cloud resources, effectively curbing unauthorized "shadow IT" usage.

Question 43
Which of the following is the best mitigation for a zero-day vulnerability found in mission-critical production servers that must be highly available?

• A. Virtualizing and migrating to a containerized instance
• B. Removing and sandboxing to an isolated network
• C. Monitoring and implementing compensating controls
• D. Patching and redeploying to production as quickly as possible
  Explanation: Since patches are not available for zero-day threats and mission-critical systems must remain online, monitoring and adding compensating controls like specialized firewall rules is the best interim solution.

Question 44
Which of the following is a compensating control for providing user access to a high-risk website?

• A. Enabling threat prevention features on the firewall
• B. Configuring a SIEM tool to capture all web traffic
• C. Setting firewall rules to allow traffic from any port to that destination
• D. Blocking that website on the endpoint protection software
  Explanation: If access to a high-risk site is necessary for business operations, additional firewall inspection and threat prevention serve as an extra layer of protection.

Question 45
A security engineer develops a policy to block all insecure protocols on the network. Which of the following ports should the security engineer block as part of that process? (Select two):

• A. 22
• B. 23
• C. 25
• D. 443 (Note: Choice D was marked in the video despite choice E (445) and F (993) being more typical for insecure protocols. 23 is Telnet, which is insecure).
  Explanation: Blocking ports associated with plaintext or vulnerable protocols, like Telnet (Port 23), is a fundamental part of network hardening.

Question 46
A security analyst must recover files from a USB drive associated with a ransomware attack. Which of the following tools will help the analyst securely retrieve the files?

• A. Sandboxing environment
• B. Intrusion prevention system
• C. File integrity management tool
• D. Static code analysis tool
  Explanation: A sandboxing environment provides an isolated virtual space to safely open potentially infected drives and files without risking the security of the host system.

Question 47
A few weeks after deploying additional email servers, a company begins to receive complaints from employees that messages they are sending are going into their recipients' spam folders. Which of the following needs to be updated in order to resolve this issue?

• A. CNAME
• B. SMTP
• C. DLP
• D. SPF
  Explanation: A Sender Policy Framework (SPF) record in the DNS helps receiving mail servers verify that incoming mail from your domain was sent by authorized servers, preventing it from being flagged as spam.

Question 48
A new security regulation was announced that will take effect in the coming year. A company must comply with it to remain in business. Which of the following activities should the company perform next?

• A. Gap analysis
• B. Policy review
• C. Security procedure evaluation
• D. Threat scope reduction
  Explanation: Performing a gap analysis is the essential first step to identify what current organizational practices are missing or lacking in order to meet the new regulatory requirements.

Question 49
Which of the following security principles most likely requires validation before allowing traffic between systems?

• A. Policy enforcement
• B. Authentication
• C. Zero Trust architecture
• D. Confidentiality
  Explanation: Zero Trust architecture relies on continuous verification and validation of all traffic and access requests, regardless of whether they originate from inside or outside the network.

Question 50
Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?

• A. Hacktivist
• B. Whistleblower
• C. Organized crime
• D. Nation-state
  Explanation: Nation-state threat actors are advanced, well-funded organizations that conduct cyber warfare and espionage on behalf of sovereign governments.

Question 51
A security team identifies a vulnerability in an application that the developers will not be able to patch for six months. Which of the following should the security team use to document this vulnerability?

• A. Risk register
• B. Patching schedule
• C. Vulnerability matrix
• D. Change management procedure
  Explanation: A risk register is a central repository where all identified vulnerabilities and risks are logged, along with their impact, likelihood, and planned mitigation strategies.

Question 52
Which of the following is most important to maintain when it comes to evidence during a digital forensic investigation?

• A. Change management
• B. Availability
• C. Chain of custody
• D. Reporting
  Explanation: Maintaining a strict chain of custody documentation is essential to prove that digital evidence was collected, handled, and stored correctly without tampering, ensuring its admissibility in court.

Question 53
Several employees download a productivity program that is useful but also leaks contact information and corporate organizational structure details. Which of the following is the best way to prevent this issue?

• A. Application allow list
• B. Workstation hardening
• C. Refusal of unsigned code
• D. IP blocklist
• E. Standard user accounts
  Explanation: Application allow listing ensures that only pre-approved and vetted software can be installed on corporate devices, preventing users from downloading unauthorized and potentially harmful apps.

Question 54
A university uses two different cloud solutions for storing student data. Which of the following does this scenario represent?

• A. Load balancing
• B. Parallel processing
• C. Platform diversity
• D. Clustering
  Explanation: Platform diversity involves using different technologies or vendors to perform the same function, reducing the impact of a systemic failure or vulnerability at any single provider.

Question 55
Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included. Which of the following best describes how the controls should be set up?

• A. Remote access points should fail closed.
• B. Logging controls should fail open.
• C. Safety controls should fail open.
• D. Logical security controls should fail closed.
  Explanation: For safety, physical locks and barriers must "fail open" during emergencies to ensure that people can evacuate the building quickly and safely.

Question 56
Which of the following would best allow a company to prevent access to systems from the internet?

• A. Containerization
• B. Virtualization
• C. SD-WAN
• D. Air-gapped
  Explanation: An air-gapped system is physically disconnected from all other networks and the public internet, providing the highest possible security against remote digital intrusion.

Question 57
A Chief Security Officer signs off on a request to allow inbound SMB and RDP from the internet to a single VLAN. Which of the following is the most likely explanation for this activity?

• A. The company built a new file-sharing site.
• B. The organization is preparing for a penetration test.
• C. The security team is integrating with a SASE platform.
• D. The security team created a honeypot.
  Explanation: SMB and RDP are high-risk protocols rarely allowed from the internet; they are commonly enabled on honeypots—decoy systems—to attract and monitor attacker behavior.

Question 58
Which of the following is the stage in an investigation when forensic images are obtained?

• A. Acquisition
• B. Preservation
• C. Reporting
• D. E-discovery
  Explanation: Acquisition is the forensic phase where digital data is collected and copied to create a bit-for-bit duplicate image of the original evidence source.

Question 59
A security engineer needs to quickly identify a signature from a known malicious file. Which of the following analysis methods would the security engineer most likely use?

• A. Static
• B. Sandbox
• C. Network traffic
• D. Package monitoring
  Explanation: Static analysis examines a file’s properties and code signature without running it, which is the fastest way to match it against a database of known malware.

Question 60
Which of the following is an example of passive reconnaissance against a company?

• A. Calling a company's employees to gather sensitive information
• B. Mapping the company's IP space with a ping sweep of the company's network
• C. Using automated tools to search public information on the internet
• D. Poisoning the company's DNS server's cache with malicious queries
  Explanation: Passive reconnaissance gathers information without directly touching or alerting the target network, such as scraping public websites or domain registry data.

Question 61
An unexpected and out-of-character email message from a Chief Executive Officer's corporate account asked an employee to provide financial information and to change the recipient's contact number. Which of the following attack vectors is most likely being used?

• A. Business email compromise
• B. Phishing
• C. Brand impersonation
• D. Preloading
  Explanation: Impersonating a high-level authority figure to manipulate employees into performing sensitive tasks is a form of impersonation, often referred to as whaling or executive spoofing.

Question 62
During a penetration test in a hypervisor, the security engineer is able to use a script to inject a malicious payload and access the host filesystem. Which of the following best describes this vulnerability?

• A. VM escape
• B. Cross-site scripting
• C. Malicious update
• D. SQL injection
  Explanation: VM escape is a high-severity flaw that allows an attacker running code on a virtual machine to break out and access the host OS or hypervisor directly.

Question 63
An organization decides that most employees will work remotely. The existing VPN solution strategies will enable the business to securely achieve its objective while also being prepared for growth. Which of the following should the administrator do next?

• A. Integrate with a SASE platform, and deploy the agent to all laptops.
• B. Purchase a larger internet circuit, and create a NAT policy for the proxy.
• C. Purchase a SOAR solution to decrease response times for remote workers.
• D. Install a secondary VPN and proxy at the disaster recovery site, and automate failover.
  Explanation: SASE (Secure Access Service Edge) provides a scalable, cloud-based framework that unifies networking and security for highly mobile and remote workforces.

Question 64
A software engineer is developing a new business application and needs to check for errors and security flaws before the software engineer compiles and sends it for testing. Which of the following should the engineer use to complete this task?

• A. Vulnerability scanner
• B. Static code analysis
• C. Input validation
• D. Sandbox testing
  Explanation: Static code analysis tools scan the source code of an application for potential vulnerabilities and structural flaws before the application is actually run.

Question 65
A security analyst estimates that a small security incident will cost $10,000 and will occur twice per year. The analyst recommends a budget of $20,000 for the next year. Which of the following does the $10,000 represent?

• A. ARO
• B. SLE
• C. ALE
• D. RPO
  Explanation: Single Loss Expectancy (SLE) represents the specific monetary loss expected from a single occurrence of a security incident or risk.

Question 66
An administrator is creating domain profiles for each employee within the company. The administrator wants to make the process more efficient by assigning permissions based on user roles and departments. Which of the following would most likely fulfill these requirements?

• A. Resource provisioning
• B. User provisioning
• C. Security groups
• D. Enforcing baselines
  Explanation: Utilizing security groups allows administrators to assign sets of permissions to entire roles or teams at once, ensuring consistent access management.

Question 67
Which of the following should an organization use to ensure that it can review the controls and performance of a service provider or vendor?

• A. Service-level agreement
• B. Memorandum of agreement
• C. Right-to-audit clause
• D. Supply chain analysis
  Explanation: A right-to-audit clause is a contractual term that allows a company to verify a vendor’s security compliance and service quality through formal reviews.

Question 68
A smart lighting system is deployed in an office building. The devices connect to the corporate Wi-Fi and are managed via a cloud portal. Which of the following security techniques reduces risk for these IoT devices?

• A. Assigning static IP addresses to the devices
• B. Updating default credentials and applying network segmentation
• C. Connecting the devices to the guest Wi-Fi to prevent interactions with corporate IT
• D. Allowing the vendor to have remote access for day-to-day management
  Explanation: Securing IoT devices involves changing their default factory passwords and isolating them from the primary business network via segmentation to prevent lateral movement.

Question 69
Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?

• A. Hacktivist
• B. Whistleblower
• C. Organized crime
• D. Nation-state
  Explanation: Nation-state actors carry out advanced persistent threats and operations on behalf of government agencies, often targeting another country's infrastructure.

Question 70
A technician is opening ports on a firewall for a new system being deployed and supported by a SaaS provider. Which of the following is a risk in the new system?

• A. Default credentials
• B. Non-segmented network
• C. Supply chain vendor
• D. Vulnerable software
  Explanation: Connecting a company network to an external SaaS provider introduces supply chain risk, as a security breach at the vendor could potentially grant an attacker access to the company's network.

Question 71
Which of the following is the best way to sanitize an SSD to prevent the exposure of sensitive data while allowing the drive to be reused?

• A. Secure erasing
• B. Degaussing
• C. Formatting
• D. File wiping
• E. Encrypting
  Explanation: Secure erasing is a set of firmware commands that overwrites all storage locations on an SSD, effectively removing all data so the drive can be safely repurposed.

Question 72
An accounting clerk sent money to an attacker’s bank account after receiving fraudulent instructions over the phone to use a new account. Which of the following would most likely prevent this activity in the future?

• A. Standardizing security incident reporting
• B. Executing regular phishing campaigns
• C. Implementing insider threat detection measures
• D. Updating processes for sending wire transfers
  Explanation: Strict administrative controls, such as multi-person approval and out-of-band verification for wire transfers, are the most effective way to prevent fraud from social engineering calls (vishing).

Question 73
Which of the following will best ensure a controlled version release of a new software application?

• A. Business continuity planning
• B. Quantified risk analysis
• C. Static code analysis
• D. Change management procedures
  Explanation: Formal change management procedures ensure all updates are tested, documented, and authorized, minimizing errors during software deployment.

Question 74
Which of the following is an advantage of providing an external penetration tester with some information about the network rather than no information?

• A. It allows the tester to attack workstations as well as servers.
• B. It eliminates the need for further internal vulnerability assessments.
• C. It allows the test results to be more effective as they will focus on critical components.
• D. It ensures the discovery of all vulnerabilities that exist on the network.
  Explanation: Providing a tester with limited system information (gray box testing) increases efficiency by letting them focus on high-risk areas rather than spending time on discovery.

Question 75

Which of the following is an example of a data protection strategy that uses tokenization?

A. Encrypting databases containing sensitive data

B. Replacing sensitive data with surrogate values

C. Removing sensitive data from production systems

D. Hashing sensitive data in critical systems

Explanation:
Replacing sensitive data with surrogate values is correct because tokenization replaces sensitive information, such as credit card numbers or personally identifiable information, with non-sensitive substitute values called tokens. The original data is stored securely and can be retrieved when authorized, while the token can be used in systems that do not need access to the actual sensitive information. This helps reduce the exposure of sensitive data without necessarily encrypting or hashing it.

Question 76

An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take? (Select two).

A. Disable default accounts.

B. Add the server to the asset inventory.

C. Remove unnecessary services.

D. Document default passwords.

E. Send server logs to the SIEM.

F. Join the server to the corporate domain.

Explanation:
A. Disable default accounts. Disabling or removing unused/default accounts is an important server-hardening measure because these accounts can provide unnecessary entry points for attackers. Default accounts should be disabled when they are not required, reducing the system's attack surface.

C. Remove unnecessary services. Unneeded services can introduce vulnerabilities and provide additional avenues for unauthorized access. Removing or disabling services that are not required for the server's function reduces the attack surface and is therefore a fundamental server-hardening practice.

Question 76
Which of the following is used to calculate the impact to an organization per cybersecurity incident?

• A. SLE
• B. ALE
• C. ARO
• D. SLA
  Explanation: Single Loss Expectancy (SLE) quantifies the expected financial damage that occurs each time a specific security threat successfully compromises an asset.Question 1