CompTIA Security + Certification

Question 1
Which of the following is the best reason to perform a tabletop exercise?
A. To address audit findings
B. To collect remediation response times
C. To update the IRP
D. To calculate the ROI

Explanation: Tabletop exercises are discussion-based sessions where team members review their roles and planned responses to emergency scenarios. A primary goal is to identify gaps and update incident response plans (IRP) based on these insights.

Question 2
Which of the following outlines the configuration, maintenance, and security rules between a cloud service provider and the customer?
A. Service-level agreement
B. Responsibility matrix
C. Memorandum of understanding
D. Non-disclosure agreement

Explanation: A shared responsibility matrix clearly defines which security tasks and configurations are the responsibility of the cloud provider and which belong to the customer.

Question 3
A company experiences a data loss event due to a stolen laptop. In order to prevent future similar events, a security analyst must implement a scalable solution to ensure all data on company laptops remains secure in the event of theft or loss. Which of the following should the analyst do next?
A. Configure the HSM for each device and store recovery keys centrally.
B. Implement LAPS to ensure secure password rotation for administrative accounts.
C. Use an MDM platform to manage the devices and force security configurations.
D. Ensure that each laptop has the secure enclave properly initialized in the BIOS.

Explanation: Mobile Device Management (MDM) platforms provide a scalable way to centrally manage security policies, such as mandating full-disk encryption and enabling remote wipe, directly mitigating data loss from lost or stolen hardware.

Question 4
Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?
A. Hacktivist
B. Whistleblower
C. Organized crime
D. Unskilled attacker

Explanation: Nation-states sometimes use third-party proxies, like organized crime groups, to carry out cyberattacks. This allows them to utilize advanced criminal capabilities while maintaining plausible deniability.

Question 5
An employee receives an email that appears to be from the IT department asking the employee to reset their password using a link that leads to a suspicious domain. Which of the following should the employee do first?
A. Report the email to the security team using the designated procedure.
B. Delete the email and ignore it.
C. Click the link using an incognito browser to check its legitimacy.
D. Forward the email to all team members as a warning.

Explanation: Reporting phishing attempts following established company procedures is the critical first step. It enables the security team to investigate and implement technical blocks to protect the wider organization.

Question 6
A security administrator must implement a solution that checks the endpoints for the following before authorizing a connection:

• Updated patches
• Installed antivirus and updated signatures
  Which of the following solutions will help the administrator meet these requirements?
  A. EDR
  B. DLP
  C. NAC
  D. WAF

Explanation: Network Access Control (NAC) is designed to perform posture assessments on devices attempting to connect, ensuring they meet specific security requirements, such as current patches and antivirus status, before granting network access.

Question 7
A security team identifies a vulnerability in an application that the developers will not be able to patch for six months. Which of the following should the security team use to document this vulnerability?
A. Risk register
B. Patching schedule
C. Vulnerability matrix
D. Change management procedure

Explanation: A risk register is a central document used to record all identified risks, their potential impact, and the planned mitigation strategies, ensuring that known vulnerabilities are properly tracked.

Question 8
Which of the following best describes a threat actor who can coordinate a cyberattack to disable sensors and execute kinetic effects?
A. Insider threat
B. Hacktivist
C. Organized criminal
D. Nation-state

Explanation: Cyberattacks resulting in "kinetic effects" (physical world consequences) typically require the extensive resources, high level of sophistication, and long-term planning characteristic of a nation-state actor.

Question 9
Which of the following is the best mitigation for a zero-day vulnerability found in mission-critical production servers that must be highly available?
A. Virtualizing and migrating to a containerized instance
B. Removing and sandboxing to an isolated network
C. Monitoring and implementing compensating controls
D. Patching and redeploying to production as quickly as possible

Explanation: Because no patch exists yet for a zero-day vulnerability, and the server must remain available, the best immediate course of action is to implement compensating security controls (like specific WAF rules) combined with rigorous monitoring.

Question 10
Which of the following will a global company doing business in the European Union need to be concerned with to avoid legal privacy implications?
A. ISO 27001
B. PCI DSS
C. GDPR
D. SOC 2

Explanation: The General Data Protection Regulation (GDPR) is the primary legal framework governing data privacy and protection for individuals within the European Union.

Question 11
A technician is opening ports on a firewall for a new system being deployed and supported by a SaaS provider. Which of the following is a risk in the new system?
A. Default credentials
B. Non-segmented network
C. Supply chain vendor
D. Vulnerable software

Explanation: Using a SaaS provider introduces supply chain risk, as the organization's overall security becomes dependent on the security practices and posture of that third-party vendor.

Question 12
Which of the following data protection strategies can be used to confirm file integrity?
A. Masking
B. Encryption
C. Hashing
D. Obfuscation

Explanation: Hashing creates a unique mathematical "fingerprint" of a file. If the file is altered in any way, its hash value will change, providing a reliable way to verify its integrity.

Question 13
Which of the following is an example of passive reconnaissance against a company?
A. Calling a company's employees to gather sensitive information
B. Mapping the company IP space with a ping sweep of the company's network
C. Using automated tools to search public information on the internet
D. Poisoning the company's DNS server's cache with malicious queries

Explanation: Passive reconnaissance involves gathering information about a target from publicly available records (OSINT) without directly interacting with or alerting the target's systems.

Question 14
A few weeks after deploying additional email servers, a company begins to receive complaints from employees that messages they send are going into their recipients' spam folders. Which of the following needs to be updated in order to resolve this issue?
A. CNAME
B. SMTP
C. DLP
D. SPF

Explanation: Sender Policy Framework (SPF) records in DNS list the authorized IP addresses allowed to send email for a domain. When new servers are added, the SPF record must be updated to prevent outbound emails from being flagged as spam.

Question 15
An important patch for a critical application has just been released, and a systems administrator is identifying all of the systems requiring the patch. Which of the following must be maintained in order to ensure that all systems requiring the patch are updated?
A. Asset inventory
B. Network enumeration
C. Data certification
D. Procurement process

Explanation: Maintaining a complete and accurate asset inventory is vital for security management, as it allows administrators to know exactly which systems require patching when vulnerabilities are announced.

Question 16
Which of the following would best allow a company to prevent access to systems from the internet?
A. Containerization
B. Virtualization
C. SD-WAN
D. Air-gapped

Explanation: An air-gapped system is physically disconnected from any external network, including the internet, providing the most robust isolation against remote cyber threats.

Question 17
Which of the following is most likely part of offboarding?
A. Setting up email forwarding to a shared mailbox
B. Deleting an account
C. Resetting the passwords of all user accounts
D. Revoking access to all systems

Explanation: A primary goal of the offboarding process when an employee leaves is to ensure all their system access and privileges are promptly revoked to maintain security.

Question 18
Which of the following techniques would attract the attention of a malicious attacker in an insider threat scenario?
A. Creating a fake text file in /docs/salaries
B. Setting weak passwords in /etc/shadow
C. Scheduling vulnerable jobs in /etc/crontab
D. Adding a fake password to /etc/passwd

Explanation: Creating files with sensitive-sounding names (like "salaries") that shouldn't be accessed acts as a "honeytoken" or "honeyfile" to detect unauthorized curiosity or malicious intent.

Question 19
A university employee has logged on to an academic server and attempted to guess the system administrators' login credentials. Which of the following security measures should the university have implemented to detect the employee's attempts to gain access to the administrators' accounts?
A. Two-factor authentication
B. Firewall
C. Intrusion prevention system
D. User activity logs

Explanation: Analyzing user activity logs allows security teams to identify suspicious patterns, such as multiple failed login attempts against privileged accounts, which indicates a credential guessing attack.

Question 20
Which of the following helps acquire an attacker's details?
A. Adaptive identity
B. Steganography
C. Control plane
D. Honeypot

Explanation: A honeypot is a decoy system set up specifically to be attacked. It allows security teams to monitor attacker behavior and gather intelligence about their source and methods.

Question 21
Several employees download a productivity program that is useful but also leaks contact information and corporate organizational structure details. Which of the following is the best way to prevent this issue?
A. Application allow list
B. Workstation hardening
C. Refusal of unsigned code
D. IP blocklist

Explanation: If the unauthorized software is known to exfiltrate data to specific external locations, implementing an IP blocklist can prevent the program from communicating with its malicious servers.

Question 22
Which of the following should be used to ensure an attacker is unable to read the contents of a mobile device's drive if the device is lost?
A. TPM
B. ECC
C. FDE
D. HSM

Explanation: Full Disk Encryption (FDE) protects data at rest by encrypting the entire storage medium, rendering the data inaccessible without the correct decryption key if the physical hardware is lost.

Question 23
Which of the following can automate vulnerability management?
A. CVE
B. SCAP
C. OSINT
D. CVSS

Explanation: The Security Content Automation Protocol (SCAP) provides a standardized way to communicate software flaws and security configurations, enabling automated scanning and vulnerability management across different tools.

Question 24
A security administrator wants to increase a company's technical defenses after two users experienced payroll fraud due to phishing attacks. Which of the following should the administrator do next?
A. Conduct internal phishing campaigns with continuous training for all users on how to recognize phishing attempts.
B. Deploy more secure email gateways and block any email coming from unknown or suspicious domains.
C. Install advanced EDR software on all user workstations and configure alerts to report suspicious communications.
D. Keep web browsers updated to patch known vulnerabilities and use DNS block lists to prevent users from visiting known malicious sites.

Explanation: Enhancing the security of email gateways is a technical control that filters out phishing emails at the network level before they can reach and potentially trick end-users.

Question 25
Which of the following security controls is most likely being used when a critical legacy server is segmented into a private network?
A. Deterrent
B. Corrective
C. Compensating
D. Preventive

Explanation: When a primary security control (like patching) cannot be used on an older legacy system, network segmentation acts as a compensating control to mitigate the risk by isolating the vulnerable machine.

Question 26
Which of the following should an analyst consider when evaluating the effectiveness of the backups in an organization's DRP?
A. Frequency
B. Hashing
C. Deduplication
D. Replication

Explanation: Hashing is used to verify that the data within a backup has not been altered or corrupted, ensuring its integrity and reliability for a disaster recovery plan (DRP).

Question 27
An organization failed to account for the right-to-be-forgotten regulations. Which of the following impacts might this action have on the company?
A. Fines
B. Data breaches
C. Revenue loss
D. Blackmail

Explanation: Failure to comply with legal requirements like the "right to be forgotten" under GDPR can lead to significant financial penalties and fines from regulatory bodies.

Question 28
A security administrator observed the following in a web server log while investigating an incident:
GET ../../../../../../etc/passwd
Which of the following attacks did the security administrator most likely see?
A. Privilege escalation
B. Credential replay
C. Brute force
D. Directory traversal

Explanation: The use of ../ sequences in a URL is a classic sign of a directory traversal attack, where an attacker attempts to move outside the web root to access sensitive system files.

Question 29
A security engineer needs to quickly identify a signature from a known malicious file. Which of the following analysis methods would the security engineer most likely use?
A. Static
B. Sandbox
C. Network traffic
D. Package monitoring

Explanation: Static analysis involves examining a file's code or properties (like its hash) without actually running it, which is an efficient way to identify known malware signatures.

Question 30
Which of the following should be used to aggregate log data in order to create alerts and detect anomalous activity?
A. SIEM
B. WAF
C. Network taps
D. IDS

Explanation: Security Information and Event Management (SIEM) systems centralize and correlate log data from many different sources to detect security threats and generate alerts for the security team.

Question 31
Which of the following is an explanation of a data protection strategy that uses tokenization?
A. Encrypting databases containing sensitive data
B. Replacing sensitive data with surrogate values
C. Removing sensitive data from production systems
D. Hashing sensitive data in critical systems

Explanation: Tokenization protects sensitive data by replacing it with a non-sensitive equivalent (a token). The original data is stored securely in a vault, and the token is used for business processes.

Question 32
An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take? (Select two).
A. Disable default accounts.
B. Add the server to the asset inventory.
C. Remove unnecessary services.
D. Document default passwords.
E. Send server logs to the SIEM.
F. Join the server to the corporate domain.

Explanation: Hardening involves reducing the attack surface. Disabling unneeded services (C) is a standard practice. Joining a domain (F) allows for the application of centralized, consistent security policies.

Question 33
Which of the following best describe the benefits of a microservices architecture when compared to a monolithic architecture? (Select two).
A. Easier debugging of the system
B. Reduced cost of ownership of the system
C. Improved scalability of the system
D. Increased compartmentalization of the system
E. Stronger authentication of the system
F. Reduced complexity of the system

Explanation: Microservices allow individual parts of an application to be scaled independently (C). Because they are modular, they also provide better compartmentalization (D), preventing a failure in one area from crashing the whole system.

Question 34
Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included. Which of the following best describes how the controls should be set up?
A. Remote access points should fail closed.
B. Logging controls should fail open.
C. Safety controls should fail open.
D. Logical security controls should fail closed.

Explanation: Safety controls (like door locks) must "fail open" to allow people to escape safely during an emergency (like a fire), even if this compromises building security.

Question 35
Which of the following is the best way to sanitize an SSD to prevent the exposure of sensitive data while allowing the drive to be reused?
A. Secure erasing
B. Degaussing
C. Formatting
D. File wiping
E. Encrypting

Explanation: Secure erasing uses a built-in firmware command to completely clear data from an SSD's flash memory. Unlike degaussing (which only works for magnetic media) or formatting, it ensures the data is irrecoverable while leaving the drive usable.

Question 36
Which of the following security principles most likely requires validation before allowing traffic between systems?
A. Policy enforcement
B. Authentication
C. Zero Trust architecture
D. Confidentiality

Explanation: The fundamental concept of a Zero Trust architecture is "never trust, always verify." No traffic is allowed until it has been explicitly validated and authorized.

Question 37
Which of the following describes when a user installs an unauthorized application by bypassing the authorized application store and installing a binary file?
A. Jailbreaking
B. Sideloading
C. Memory injection
D. VM escaping

Explanation: Sideloading is the practice of manually installing an application from an unofficial source (like a downloaded APK or IPA file), bypassing the device's official app store.

Question 38
An unexpected and out-of-character email message from a Chief Executive Officer's corporate account asked an employee to provide financial information and to change the recipient's contact number. Which of the following attack vectors is most likely being used?
A. Business email compromise
B. Phishing
C. Brand impersonation
D. Pretexting

Explanation: Business Email Compromise (BEC) is a specific type of social engineering where an attacker impersonates a company executive to trick an employee into performing fraudulent actions.

Question 39
An accounting clerk sent money to an attacker's bank account after receiving fraudulent instructions over the phone to use a new account. Which of the following would most likely prevent this activity in the future?
A. Standardizing security incident reporting
B. Executing regular phishing campaigns
C. Implementing insider threat detection measures
D. Updating processes for sending wire transfers

Explanation: Strengthening organizational procedures, such as requiring secondary verification for wire transfer requests, is a process-based control that directly guards against this kind of social engineering fraud.

Question 40
A software engineer is developing a new business application and needs to check for errors and security flaws before the software engineer compiles and sends it for testing. Which of the following should the engineer use to complete this task?
A. Vulnerability scanner
B. Static code analysis
C. Input validation
D. Sandbox testing

Explanation: Static code analysis tools scan an application's source code for potential vulnerabilities and bugs during the development phase, before the code is even compiled or run.

Question 41
An administrator is creating domain profiles for each employee within the company. The administrator wants to make the process more efficient by assigning permissions based on user roles and departments. Which of the following would most likely fulfill these requirements?
A. Resource provisioning
B. User provisioning
C. Security groups
D. Enforcing baselines

Explanation: Managing user access through security groups (Role-Based Access Control) allows an administrator to assign a set of permissions to a group rather than to individual users, significantly increasing efficiency.

Question 42
Which of the following will best ensure a controlled release version of a new software application?
A. Business continuity planning
B. Quantified risk analysis
C. Static code analysis
D. Change management procedures

Explanation: Change management provides a structured, formal process for documenting, testing, and approving new software versions before they are released into a production environment.

Question 43
Which of the following should an organization use to ensure that it can review the controls and performance of a service provider or vendor?
A. Service-level agreement
B. Memorandum of agreement
C. Right-to-audit clause
D. Supply chain analysis

Explanation: Including a "right-to-audit" clause in a contract gives an organization the legal authority to inspect a vendor's operations and security controls to ensure they are meeting their obligations.

Question 44
A company prepares for an upcoming regulatory audit. The company wants to perform a gap analysis in the most cost-effective way. Which of the following will help the company achieve this goal?
A. Internal self-assessment
B. Active reconnaissance
C. Red team penetration test
D. Tabletop exercise

Explanation: Performing an internal self-assessment is the most budget-friendly method for identifying security gaps, as it utilizes in-house expertise rather than expensive outside consultants or intensive testing.

Question 45
After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?
A. Console access
B. Routing protocols
C. VLANs
D. Web-based administration

Explanation: To harden a network device, you should disable unnecessary and potentially insecure management interfaces. Disabling web-based administration reduces the ways an attacker could attempt to compromise the router.

Question 46
Which of the following best describes a common use of OSINT?
A. Monitoring internal systems and network traffic to detect abnormal behavior
B. Installing and configuring security patches to fix known vulnerabilities
C. Collecting information from public platforms to find possible security exposures
D. Encrypting sensitive company data and storing it securely in the cloud

Explanation: Open-Source Intelligence (OSINT) refers to the process of gathering and analyzing information from publicly available sources (social media, public databases, etc.) to uncover potential security risks.

Question 47
Which of the following agreements defines response time, escalation points, and performance metrics?
A. BPA
B. MOA
C. NDA
D. SLA

Explanation: A Service Level Agreement (SLA) is a contract that specifies the performance standards and responsibilities expected from a service provider, including metrics like uptime and response times.

Question 48
A security analyst reviews logs and finds a large number of malicious requests that have caused performance issues on the company's site. Which of the following would have most likely prevented this attack?
A. IPSec
B. TLS
C. SDN
D. WAF

Explanation: A Web Application Firewall (WAF) is specifically designed to inspect web traffic and block malicious application-layer requests that could degrade site performance or lead to a compromise.

Question 49
Which of the following scenarios will proper application of the least privilege principle prevent?
A. A network administrator shuts down a critical network interface.
B. An analyst saves an unauthorized configuration.
C. A threat actor discovers credentials for a shared service account.
D. A change is executed outside of the approved change window.

Explanation: The principle of least privilege ensures users only have the permissions they need for their job. If applied correctly, an analyst wouldn't have the high-level permission required to save a configuration change.

Question 50
A Chief Security Officer signs off on a request to allow inbound SMB and RDP from the internet to a single VLAN. Which of the following is the most likely explanation for this activity?
A. The company built a new file-sharing site.
B. The organization is preparing for a penetration test.
C. The security team is integrating with an SASE platform.
D. The security team created a honeynet.

Explanation: Deliberately opening highly vulnerable ports like SMB and RDP to the internet is a common tactic when building a honeynet—a system designed to lure in attackers so their methods can be studied.

Question 51
A company processes a large volume of business-to-business transactions and prioritizes data confidentiality over transaction availability. The company's firewall administrator must configure a new hardware-based firewall to replace the current one. Which of the following should the administrator do to best align with the company's requirements in case a security event occurs?
A. Ensure the firewall data plane moves to a fail-closed mode.
B. Implement a deny all rule as the last firewall ACL rule.
C. Prioritize business-critical application traffic through the firewall.
D. Configure rate limiting between the firewall interfaces.

Explanation: Because confidentiality is more important than availability, a "fail-closed" setting ensures that if the firewall fails, all traffic stops. This prevents any sensitive data from passing through unprotected while the security system is down.

Question 52
An organization decides that most employees will work remotely. The existing VPN solution does not have adequate bandwidth, and the content filtering proxy is on premises. Which of the following strategies will enable the business to securely achieve its objective while also being prepared to quickly scale for growth?
A. Integrate with an SASE platform, and deploy the agent to all laptops.
B. Purchase a larger internet circuit, and create a NAT policy for the proxy.
C. Purchase a SOAR solution to decrease response times for remote workers.
D. Install a secondary VPN and proxy at the disaster recovery node, and automate failover.

Explanation: Secure Access Service Edge (SASE) is a cloud-based security model that provides secure network access for remote users. It scales easily and eliminates the bottleneck of routing all remote traffic back through an on-premises proxy.

Question 53
Attackers created a new domain name that looks similar to a popular file-sharing website. Which of the following threat vectors is being used?
A. Watering-hole attack
B. Brand impersonation
C. Phishing
D. Typosquatting

Explanation: Typosquatting (or URL hijacking) involves registering a domain name that is a common misspelling of a popular site, hoping users will land there by mistake and be exposed to malware or phishing.

Question 54
Which of the following is most important to maintain when it comes to evidence during a digital forensic investigation?
A. Change management
B. Availability
C. Chain of custody
D. Reporting

Explanation: Maintaining a strict chain of custody—a complete, documented record of who handled the evidence and when—is essential for ensuring that digital evidence is valid and admissible in a court of law.

Question 55
A security engineer develops a policy to block all insecure protocols on the network. Which of the following ports should the security engineer block as part of that process? (Select two).
A. 22
B. 23
C. 25
D. 443
E. 993
F. 995

Explanation: Telnet (Port 23) and standard SMTP (Port 25) are considered insecure because they transmit data in plaintext. SSH (Port 22), HTTPS (Port 443), and encrypted email protocols (Ports 993 and 995) are secure alternatives.

Question 56
A new security regulation was announced that will take effect in the coming year. A company must comply with it to remain in business. Which of the following activities should the company perform next?
A. Gap analysis
B. Policy review
C. Security procedure evaluation
D. Threat scope reduction

Explanation: A gap analysis allows a company to compare its current security practices with the requirements of the new regulation to determine exactly what changes need to be made for compliance.

Question 57
Which of the following is the stage in an investigation when forensic images are obtained?
A. Acquisition
B. Preservation
C. Reporting
D. E-discovery

Explanation: Acquisition is the forensics phase where an exact bit-for-bit duplicate (an image) of digital evidence is created for analysis, ensuring the original data remains untouched.

Question 58
Which of the following vulnerabilities will lead to a successful attack that injects <IMG src="http://attackersite.net/mycode.sh"> into a web application?
A. Directory traversal
B. Buffer overflow
C. SQLi
D. XSS

Explanation: Cross-Site Scripting (XSS) is a vulnerability where an attacker can inject malicious client-side scripts (often using HTML tags like <img> or <script>) into web pages viewed by other users.

Question 59
Which of the following will best help a security analyst implement and maintain a cloud services policy to reduce the likelihood of vulnerabilities being introduced by users or shadow IT? (Select two).
A. Least privilege
B. Trusted platform module
C. Jailbreaking
D. Access control list
E. File integrity monitoring
F. Application allow list

Explanation: Least privilege (A) limits user permissions so they can't install unauthorized software. An application allow list (F) strictly defines which programs are permitted to run, effectively blocking shadow IT applications.

Question 60
When trying to access an internal website, an employee reports that a prompt displays, stating that the site is insecure. Which of the following certificate types is the site most likely using?
A. Wildcard
B. Root of trust
C. Third-party
D. Self-signed

Explanation: Browsers flag self-signed certificates as "insecure" because they have not been verified and signed by a trusted third-party Certificate Authority (CA).

Question 61
A security analyst estimates that a small security incident will cost $10,000 and will occur twice per year. The analyst recommends a budget of $20,000 for next year. Which of the following does the $10,000 represent?
A. ARO
B. SLE
C. ALE
D. RPO

Explanation: Single Loss Expectancy (SLE) is the estimated financial loss for one occurrence of a risk event. In this case, the $10,000 cost for a single incident is the SLE.

Question 62
Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses?
A. Compensating control
B. Network segmentation
C. Transfer of risk
D. SNMP traps

Explanation: By restricting access so that a system only communicates with a pre-defined set of internal addresses, the administrator has implemented a form of network segmentation to protect that host.

Question 63
During a penetration test in a hypervisor, the security engineer is able to use a script to inject a malicious payload and access the host filesystems. Which of the following best describes this vulnerability?
A. VM escape
B. Cross-site scripting
C. Malicious update
D. SQL injection

Explanation: VM escape is a critical vulnerability that allows an attacker on a virtual machine (the guest) to break out and access the host machine's hardware, operating system, or hypervisor.

Question 64
Which of the following is used to calculate the impact to an organization per cybersecurity incident?
A. SLE
B. ALE
C. ARO
D. SLA

Explanation: Single Loss Expectancy (SLE) is the standard metric used in risk management to quantify the expected financial impact of a single cybersecurity incident.

Question 65
A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee's corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?
A. Application
B. IPS/IDS
C. Network
D. Endpoint

Explanation: Endpoint logs provide granular detail about what is happening on a specific device, including which programs (executables) are running, which is what the analyst needs for this investigation.

Question 66
Which of the following actions must an organization take to comply with a person's request for the right to be forgotten?
A. Purge all personally identifiable attributes.
B. Encrypt all of the person's data.
C. Remove all of the person's data.
D. Obfuscate all of the person's data.

Explanation: Under the GDPR "right to be forgotten," an organization is legally required to completely delete and remove all personal data they hold about an individual upon their request.

Question 67
A vendor prepares to release a patch for a previously unknown vulnerability that is now being actively exploited in the wild. Which of the following best describes this vulnerability?
A. Zero-day
B. SQL injection
C. Race condition
D. Use after free

Explanation: A zero-day vulnerability is one that is unknown to the software creator and has no available fix (patch) at the time it is discovered or exploited by attackers.

Question 68

A security operation team detects multiple unsuccessful login attempts on a jump server used by remote workers. Which of the following options could be deployed to best mitigate these attacks?

A. VPN
B. IDS
C. WAF
D. SD-WAN

Explanation: A VPN provides a secure, authenticated connection for remote workers accessing internal resources. However, for detecting and responding specifically to multiple unsuccessful login attempts, an IDS or other authentication/security monitoring control may be more directly applicable.

Question 69

Which of the following is a compensating control for providing user access to a high-risk website?

A. Enabling threat prevention features on the firewall
B. Configuring a SIEM tool to capture all web traffic
C. Setting firewall rules to allow traffic from any port to that destination
D. Blocking that website on the endpoint protection software

Explanation: A compensating control is an alternative security measure used to reduce risk when the preferred control cannot be implemented. Enabling threat-prevention capabilities on a firewall can provide additional protection while allowing access to a higher-risk website.

Question 70

Which of the following is used as a control on physical and digital assets and serves as a signal for employees to identify security requirements when accessing and manipulating data?

A. Obfuscation
B. Encryption
C. Labeling
D. Masking

Explanation: Labeling identifies the sensitivity or classification of information and communicates the security requirements associated with handling that information. For example, labels such as Confidential or Restricted can tell employees how data should be accessed, stored, and shared.

Question 71

A university uses two different cloud solutions for storing student data. Which of the following does this scenario represent?

A. Load balancing
B. Parallel processing
C. Platform diversity
D. Clustering

Explanation: Platform diversity refers to using different platforms, technologies, or providers to reduce dependence on a single platform. Using two different cloud solutions for storing student data is an example of platform diversity.

Question 72

A company plans to secure its systems by:

• Preventing users from sending sensitive data over corporate email
• Restricting access to potentially harmful websites

Which of the following features should the company set up? (Select two.)

A. DLP software
B. DNS filtering
C. File integrity monitoring
D. Stateful firewall
E. Guardrails
F. Antivirus signatures

Explanation: DLP (Data Loss Prevention) software helps prevent sensitive information from being transmitted through channels such as corporate email. DNS filtering can restrict access to known malicious or potentially harmful websites. Therefore, the two selected controls address the two security requirements described in the scenario.