Security+ SY0-701
Practice Tests & Exam Prep

A facilities team wants to stop vehicles from being driven into the front of a data center lobby while still allowing employees to walk through the area. Which control best fits that need?

Correct: B. Bollards are physical barriers designed to stop or slow vehicle entry. Guards and badge systems can help with access control, but they do not provide the same vehicle-resistant barrier.

During an audit, reviewers find the company has strong written policy but no evidence that required controls are actually deployed. What did the auditors identify?

Correct: A. A control gap is the difference between the expected control state and what is actually in place. It is commonly found during gap analysis or audit work.

A security architect says every access request must be evaluated as if it came from an untrusted network. Which principle is being applied?

Correct: D. Zero trust assumes breach, verifies explicitly, and grants least privilege. It avoids trusting users or devices simply because they are inside a network boundary.

A badge reader opens the first door of a small room, but the second door will not unlock until the first door closes. What is this control primarily designed to prevent?

Correct: C. An access control vestibule helps prevent tailgating and piggybacking by allowing only controlled movement through interlocking doors.

A developer needs to prove that a driver package came from the claimed vendor and was not altered after release. What should the vendor use?

Correct: C. Code signing provides software integrity and publisher verification. A wildcard certificate protects multiple hostnames, not downloadable code.

A database team wants encryption for database files, logs, and backups without changing the application code. Which solution is the best fit?

Correct: D. Transparent data encryption protects database files, logs, and backups at rest without requiring application changes. TLS protects data in transit.

A company keeps its root certificate authority powered off except during planned certificate operations. Why is this done?

Correct: A. An offline root CA reduces the chance that the root private key is compromised. Issuing CAs can handle day-to-day certificate operations.

A cloud workload uses a managed identity to access a storage account instead of embedding a password in code. Which concept is being used?

Correct: B. Systems and services can authenticate with their own identities. Managed identities reduce secret exposure and support accountability.

A network camera records the loading dock after hours and also makes intruders think twice before entering. Which statement is most accurate?

Correct: B. A single control can serve multiple purposes. Video surveillance can deter activity and also detect or record events for later review.

A change request for a firewall update is missing a rollback procedure. Which change management element is absent?

Correct: A. A backout plan documents how to restore the prior state if a change fails. Without it, outages and security exposure can last longer.

A politically motivated group defaces a public website to protest a company policy. Which threat actor best matches the scenario?

Correct: D. Hacktivists use cyber activity to advance political or social beliefs. Defacement and data leaks are common tactics for public pressure.

Employees begin using an unsanctioned cloud file-sharing app because the approved tool feels slow. What risk does this create?

Correct: C. Shadow IT is the use of unauthorized technology outside normal IT governance. It can expose data because security controls may not be applied.

An attacker waits until a web application checks file permissions, then swaps the target file before the application uses it. Which vulnerability is this?

Correct: C. Time-of-check/time-of-use is a race condition where a resource changes between permission checking and actual use.

A hospital is hit with ransomware from a group focused on extortion and repeatable profit. Which actor is the best match?

Correct: D. Organized crime groups commonly run ransomware and extortion campaigns for financial gain. Their operations are often structured and repeatable.

A user receives a text message claiming to be from payroll and asking them to verify their password. What type of attack is this?

Correct: A. Smishing is phishing through SMS or text messages. Vishing uses voice calls.

A web app places unsanitized user input directly into a database query. Which attack is most likely?

Correct: B. SQL injection occurs when untrusted input changes the structure of a database query. Parameterized queries and input validation reduce the risk.

A cloud customer discovers an API key was copied from a public repository and used to create expensive resources. Which cloud risk does this best illustrate?

Correct: B. Stolen credentials or keys can let attackers take over cloud accounts or resources. Strong IAM, secret management, and monitoring reduce the risk.

A legacy application cannot be patched but must remain online for a few months. Which mitigation best limits damage if it is compromised?

Correct: A. Segmentation isolates risky systems and limits lateral movement. Logging, least privilege, and compensating controls should also be kept in place.

A phone in discoverable Bluetooth mode has data copied without the owner approving the transfer. Which attack is described?

Correct: D. Bluesnarfing involves unauthorized data theft over Bluetooth. Bluejacking is typically unsolicited messaging.

A cloud provider reassigns storage hardware from one tenant to another. Which risk is most directly addressed by encrypting the previous tenant data?

Correct: C. Resource reuse can leave residual data behind if media is not properly sanitized. Encryption helps make recovered remnants unreadable.

A company runs virtual machines on a cloud platform. Who is normally responsible for securing the guest operating system in an IaaS model?

Correct: C. In IaaS, the provider manages the physical infrastructure while the customer usually secures the guest OS, applications, identities, and data.

A manufacturer needs equipment to keep running safely with very predictable timing. Which environment is most likely involved?

Correct: D. Real-time operating systems are common in ICS and embedded environments where predictable timing and reliability matter.

A company wants to define cloud networks, security groups, and compute resources in repeatable template files. Which approach is being used?

Correct: A. Infrastructure as code uses templates or code to deploy standard infrastructure consistently. It supports repeatability and configuration control.

A SaaS provider hosts the application, but the customer must decide which employees can access it and what data should be retained. What does this show?

Correct: B. SaaS shifts many technical duties to the provider, but the customer still manages users, access, data governance, and many configuration choices.

A company uses one public cloud for analytics and another for customer-facing applications. What is the main tradeoff?

Correct: B. Multicloud can improve choice, pricing, and resilience, but it increases complexity in governance, monitoring, skills, and integration.

A security team wants to prevent malware on one workstation from reaching database servers. Which design helps the most?

Correct: A. Logical segmentation separates systems or workloads and restricts traffic. It reduces lateral movement after a compromise.

An organization needs the fastest restoration from backup after a server failure. Which backup type is generally fastest to restore?

Correct: D. A full backup is generally fastest to restore because it does not require rebuilding from multiple incremental pieces.

A service must fail over automatically when one node fails, with users seeing minimal interruption. Which architecture goal is most relevant?

Correct: C. High availability uses redundancy and failover to keep services running with minimal interruption.

A company stores critical backups in another region and keeps copies encrypted. Which risk is this mainly addressing?

Correct: C. Encrypted offsite backups support recovery when local systems are destroyed, corrupted, or encrypted by ransomware.

A power outage lasts longer than the server room UPS can support. Which control is designed for longer sustained power?

Correct: D. A UPS supports short-term power and graceful shutdown. A generator can provide longer alternate power for critical facilities.

A company deploys mobile devices that are corporate-owned but allowed for personal use. Which model is this?

Correct: A. Corporate-owned, personally enabled means the company owns the device while permitting personal use within policy.

A wireless rollout is planned for a warehouse with metal racks and dead zones. What should be done before final access point placement?

Correct: B. A site survey and heat map help identify coverage, interference, and placement needs before wireless deployment.

A developer reviews source code for insecure functions before the application is compiled. Which technique is this?

Correct: B. Static code analysis reviews source or compiled code without running the application. It helps catch flaws early in development.

A SOC tool receives alerts from SIEM, enriches them, and automatically disables a compromised account. What capability is this?

Correct: A. SOAR automates and orchestrates response workflows across tools. It can reduce response time for repeatable actions.

Analysts need packet-level detail to determine whether an exploit payload crossed the network. Which data source is best?

Correct: D. Packet captures show protocol-level details and packet contents. They are useful when logs do not provide enough detail.

During incident response, a laptop drive is imaged, hashed, sealed, and every transfer is documented. What is being protected?

Correct: C. Chain of custody documents who handled evidence and when. Hashing and controlled storage help preserve integrity.

An alert is reviewed and confirmed to be a real compromise before isolation begins. Which incident response phase is this?

Correct: C. Analysis determines whether detected events represent an actual incident and defines scope before containment decisions.

A SIEM correlates failed logins, endpoint alerts, and firewall denies from the same host. What is the main benefit?

Correct: D. SIEM correlation combines data from many sources so analysts can understand sequence, scope, and related activity.

A security team discovers user logins have timestamps from systems using different clocks. What will this hurt the most?

Correct: A. Accurate timestamps are critical for correlating events and building a reliable incident timeline.

A board asks for a document that sets the overall direction and expectations for security across the organization. Which document is most appropriate?

Correct: B. A security policy sets the high-level vision and requirements. Standards and procedures provide more detailed implementation guidance.

An IT administrator implements controls chosen by senior management for a regulated dataset. Which role is the administrator most likely performing?

Correct: B. A data custodian handles storage, transport, and technical control implementation. The data owner decides control requirements and remains accountable.

A risk team estimates annualized loss expectancy using asset value, exposure factor, and annualized rate of occurrence. Which method is being used?

Correct: A. Quantitative analysis uses numeric values such as SLE, ARO, and ALE to estimate financial exposure.

A business accepts a low-impact risk because mitigation would cost more than the expected loss. Which response is this?

Correct: D. Risk acceptance means leadership knowingly allows the risk to remain, often because treatment is not justified by the expected impact.

A contract allows the customer to review whether a supplier is meeting agreed security obligations. Which clause is this?

Correct: C. A right-to-audit clause gives the customer a contractual path to verify supplier compliance with agreed requirements.

A vendor sends a yearly questionnaire claiming all controls are still in place, but no independent evidence is attached. How should this be treated?

Correct: C. Questionnaires are useful but are self-attestations. Independent assessments, audit reports, or evidence reviews provide stronger assurance.

A customer employee owns stock in a vendor being evaluated and pushes that vendor despite weak controls. What issue should be raised?

Correct: D. Financial interests can bias vendor selection. Conflict of interest controls help keep decisions objective and defensible.

A privacy request asks the company to erase personal data when there is no valid retention requirement. Which right is involved?

Correct: A. The right to be forgotten relates to erasing personal data when legal and regulatory conditions allow it.

An external regulator reviews whether a company complies with a required law. What type of activity is this?

Correct: B. Regulatory audits or examinations are external reviews required by a regulator or government body.

A penetration test is performed with no internal network diagrams or credentials provided to the testers. Which testing approach is this?

Correct: B. Unknown environment testing gives testers little or no internal knowledge, similar to an outside attacker perspective.

Employees are taught to report emails with urgent language, unexpected attachments, and suspicious links. Which awareness topic is being emphasized?

Correct: A. Phishing awareness trains users to spot red flags and report suspicious messages through the approved process.

Remote employees are reminded not to use public charging cables or unknown USB drives with company laptops. Which training topic is this?

Correct: D. Removable media and public cables can introduce malware or data theft risk. Awareness training should explain approved handling.

A manager wants a required checklist that tells admins exactly how to harden new Linux servers. Which document should they use?

Correct: C. A standard defines mandatory technical requirements, such as baseline settings for a server build.

A help desk tech follows a step-by-step process to disable a terminated employee account. What is that document called?

Correct: C. A procedure gives specific steps for carrying out a task consistently.

A security lead publishes optional advice for safer home Wi-Fi use by remote staff. Which document type is this?

Correct: D. Guidelines are recommended practices rather than mandatory requirements.

An organization wants to make sure no one person can create a vendor and approve that same vendor payment. Which control is most relevant?

Correct: B. Separation of duties splits sensitive tasks so one person cannot complete a critical process alone.

A payroll clerk should only view payroll records for the employees they support. Which concept applies?

Correct: A. Need to know limits information access to people with a legitimate business reason.

An admin account is granted only enough rights to restart a service and read logs. Which principle is being used?

Correct: A. Least privilege gives subjects only the permissions required to perform assigned tasks.

A company requires two people to approve production firewall changes. What risk is this control reducing?

Correct: D. Dual approval helps prevent unauthorized, poorly reviewed, or accidental production changes.

A sign on a fence warns that the property is monitored. What type of control is the sign primarily?

Correct: C. A deterrent control discourages unwanted activity before it happens.

A backup restore returns a corrupted file server to normal operation. What type of control is this?

Correct: B. Corrective controls restore normal operation after an unwanted event.

A company cannot deploy MFA on an old app, so it limits access to a jump host and logs every session. What is the jump host arrangement?

Correct: A. A compensating control provides an alternate way to reduce risk when the preferred control is not feasible.

A written rule tells employees they must lock laptops when leaving a conference room. What control type is this?

Correct: D. Directive controls guide or require behavior through rules, policies, signs, or instructions.

An IDS sends an alert when traffic matches a known exploit pattern. What control type is this?

Correct: C. Detective controls identify suspicious or unwanted activity.

A firewall blocks inbound traffic to a database subnet. What type of control is it primarily acting as?

Correct: D. Preventive controls stop or block unwanted activity before it succeeds.

An app proves a user is who they claim to be by validating a password and MFA prompt. Which AAA function is this?

Correct: B. Authentication verifies identity before access is granted.

After login, a system checks whether a user can approve invoices. Which AAA function is this?

Correct: A. Authorization determines what an authenticated subject is allowed to do.

A VPN server records who connected, when they connected, and how long the session lasted. Which AAA function is this?

Correct: C. Accounting records activity for audit trails and accountability.

A file owner decides which coworkers can read a shared document. Which access model is this?

Correct: D. Discretionary access control allows object owners to grant or deny access.

A firewall applies the same allow and deny logic to traffic based on IP and port. Which model does this best describe?

Correct: A. Rule-based access control uses predefined rules or filters to make access decisions.

Users receive access through job functions such as analyst, manager, or auditor. Which model is being used?

Correct: B. Role-based access control maps permissions to roles instead of assigning every permission individually.

A system uses classification labels to prevent users from reading files above their clearance. Which model is this?

Correct: C. Mandatory access control enforces system-controlled access based on labels or classifications.

A website proves a transaction cannot be plausibly denied by the sender later. Which concept is this?

Correct: D. Nonrepudiation provides evidence that a party performed an action, often through digital signatures.

A finance app must ensure balances are not changed without authorization. Which part of the CIA triad is emphasized?

Correct: B. Integrity protects data from unauthorized or improper modification.

A hospital scheduling system must stay reachable during clinic hours. Which CIA objective is most important?

Correct: A. Availability ensures systems and data are accessible when needed.

A legal team requires contract files to be readable only by approved staff. Which CIA objective is the focus?

Correct: D. Confidentiality limits disclosure to authorized parties.

A zero trust system changes the MFA requirement based on device health and location. What capability is this?

Correct: C. Adaptive identity changes authentication and access requirements using context and risk.

In a zero trust design, which component actually allows, blocks, or terminates the connection?

Correct: C. The policy enforcement point applies access decisions at the connection or resource boundary.

In a zero trust design, where is the access decision made based on user, device, and risk context?

Correct: D. The policy decision point evaluates context and decides whether to allow, deny, or require more controls.

A team removes broad internal network trust and narrows what a compromised user can reach. What zero trust outcome is this?

Correct: B. Threat scope reduction limits the blast radius of a breach.

A short fence is added mainly to discourage casual trespassers. What control type is the fence acting as?

Correct: A. Fencing is a physical control and often acts as a deterrent.

A facility wants to detect footsteps near a restricted door after hours. Which sensor type best fits?

Correct: A. Pressure sensors detect changes in pressure, such as someone stepping on a mat or floor area.

A motion detector uses heat signatures to detect people in a dark hallway. Which sensor is this?

Correct: D. Infrared sensors detect heat signatures from people or objects.

A system emits high-frequency sound and measures the return signal to detect motion. Which sensor type is this?

Correct: C. Ultrasonic sensors use high-frequency sound waves and reflections.

A security team plants a fake payroll spreadsheet to alert if attackers touch it. What is this?

Correct: B. A honeyfile is a decoy file designed to trigger detection when accessed.

A fake API key is placed in a repository to catch unauthorized use. What is it?

Correct: A. A honeytoken is a decoy value or credential used to detect misuse.

Several fake vulnerable servers are deployed to study attacker behavior. What is this environment?

Correct: D. A honeynet is a network of decoy systems used for deception and monitoring.

A proposed database upgrade lists affected apps, owners, and possible outage effects. Which change step is this?

Correct: C. Impact analysis reviews how a change may affect systems, users, dependencies, and security.

A database migration is scheduled for Sunday at 2 a.m. to reduce user impact. What is this called?

Correct: D. A maintenance window is a planned period for changes that minimizes business disruption.

A release ticket includes test evidence from a staging environment. Why is that useful?

Correct: B. Testing provides evidence that a change should work as intended before production rollout.

A change is not closed until network diagrams and runbooks are updated. What practice is being enforced?

Correct: A. Change management should keep diagrams, procedures, and configuration records current.

A source code platform tracks who changed a file and allows teams to compare revisions. What is this?

Correct: C. Version control tracks code or configuration changes and supports rollback and conflict review.

A company stores API keys and database passwords in a managed cloud vault. What is the vault protecting?

Correct: D. Secrets include passwords, API keys, tokens, certificates, and cryptographic keys.

A hardware device is used to generate and protect cryptographic keys for a payment system. What is it?

Correct: A. A hardware security module is purpose-built to protect and manage cryptographic keys.

A motherboard chip stores keys used by full-disk encryption and secure boot. What is this chip?

Correct: B. A trusted platform module can store keys and support full-disk encryption and secure boot.

A laptop drive encrypts data using hardware on the drive controller. What type of drive is this?

Correct: C. Self-encrypting drives perform hardware-based storage encryption.

A developer hashes a downloaded installer and compares it to the publisher value. What property is checked?

Correct: D. Hashes are commonly used to verify that data has not changed.

A user hides a secret message inside an image file. Which technique is this?

Correct: B. Steganography hides information inside another file or medium.

A payment app replaces a credit card number with a random substitute value. Which technique is this?

Correct: A. Tokenization substitutes sensitive data with a token that has no useful value by itself.

A report shows only the last four digits of Social Security numbers. What is being used?

Correct: D. Data masking obscures sensitive values while preserving limited usability.

Personal data is transformed so it can no longer identify the original person. What is this?

Correct: C. Anonymization removes identifying details so the original subject cannot be determined.

A TLS certificate is trusted because each certificate links back to a trusted root. What is this called?

Correct: C. Certificate chaining builds trust from an end-entity certificate back to a trusted root CA.

A browser checks whether a certificate has been revoked by querying a responder. Which protocol is used?

Correct: D. Online Certificate Status Protocol provides certificate revocation status checks.

A web server provides a recent certificate status response during the TLS handshake. What feature is this?

Correct: B. OCSP stapling lets the server provide certificate status without the client separately querying the CA.

A company pins a known certificate for a host to detect unexpected certificate changes. What is this?

Correct: A. Certificate pinning helps detect fraudulent or unexpected certificates for a known host.

A certificate request is generated before being sent to a CA for signing. What is the request called?

Correct: A. A certificate signing request contains information needed by a CA to issue a certificate.

A certificate secures mail.example.com and vpn.example.com with one entry of *.example.com. What type is it?

Correct: D. A wildcard certificate covers multiple hostnames under the same domain level.

A certificate issued by the same server using it is cheap but not broadly trusted. What is it?

Correct: C. Self-signed certificates are not validated by a trusted external CA.

An attacker uses limited tools from the internet to scan random targets for old vulnerabilities. Which actor best fits?

Correct: B. Unskilled attackers often rely on available tools and well-known vulnerabilities.

A foreign intelligence service steals defense research over several months. Which actor is most likely?

Correct: A. Nation-state actors often have advanced resources and may conduct espionage.

A staff member with valid access copies customer data before resigning. Which threat actor is this?

Correct: D. Insider threats misuse authorized access intentionally or accidentally.

An attacker demands payment to avoid releasing stolen executive emails. What motivation is this?

Correct: C. Blackmail uses threatened disclosure or harm to pressure a victim.

A competitor hires criminals to steal product design documents. What motivation is most likely?

Correct: D. Espionage involves stealing secrets, intellectual property, or sensitive information.

A botnet floods a public site until customers cannot reach it. What motivation or outcome is shown?

Correct: B. Service disruption attacks aim to interrupt normal operations or availability.

A fake login page uses the company logo and a lookalike domain. Which technique is involved?

Correct: A. Brand impersonation abuses a trusted brand to make malicious pages or messages seem legitimate.

An attacker registers examp1e.com to catch users who mistype example.com. What is this?

Correct: C. Typosquatting uses lookalike or mistyped domains to mislead users.

A malicious site compromises visitors after being placed where employees commonly browse. What attack is this?

Correct: D. A watering hole attack compromises a site likely to be visited by targeted users.

An attacker calls the help desk pretending to be the CFO and asks for a password reset. What is this?

Correct: A. Impersonation is pretending to be someone else to gain trust or access.

An email thread from a spoofed vendor asks accounting to change bank details. What attack is likely?

Correct: B. Business email compromise targets business payment or communication processes through deception.

A caller invents a story about an urgent audit to persuade an employee to disclose files. What is this?

Correct: C. Pretexting uses a fabricated scenario to manipulate a victim.

A news article full of false claims is spread to influence employee decisions. What is this?

Correct: D. Misinformation and disinformation use false or misleading content to influence people.

A malicious document exploits an old PDF reader when opened. Which vector is this?

Correct: B. File-based vectors use attachments or downloaded files to deliver malicious content or exploits.

A fake voicemail directs employees to call a number and enter credentials. Which vector is this?

Correct: A. Voice-based attacks use calls or voicemail to manipulate users.

A malicious QR image sends users to a credential harvesting page. Which vector best fits?

Correct: D. Image-based vectors can use images or QR codes to lure users or conceal malicious activity.

A USB drive left in a parking lot installs malware when opened. Which vector is this?

Correct: C. Removable media can deliver malware or move data outside controls.

An unsupported operating system is left on the network after vendor support ends. What is the primary issue?

Correct: C. Unsupported systems become risky because security updates are no longer provided.

A service is exposed on the internet even though nobody uses it. What should be done first?

Correct: D. Unneeded ports and services increase attack surface and should be disabled or filtered.

A browser script steals session data because user input was displayed without sanitization. Which attack is this?

Correct: B. XSS occurs when untrusted script runs in a user browser through a vulnerable site.

An attacker uses ../ sequences in a URL to read files outside the web root. Which attack is this?

Correct: A. Directory traversal attempts to access restricted file paths through path manipulation.

A server processes a URL supplied by a user and is tricked into reaching internal metadata services. What is this?

Correct: A. Server-side request forgery abuses a server into making unintended requests.

An application crashes after a user sends more data than a memory buffer can hold. Which vulnerability is likely?

Correct: D. A buffer overflow occurs when input exceeds allocated memory space.

A calculation stores a number too large for the variable and wraps unexpectedly. Which flaw is this?

Correct: C. Integer overflow occurs when a numeric result exceeds the allowed storage range.

An attacker installs a malicious firmware update that affects the boot process. What area is compromised?

Correct: B. Firmware attacks target low-level device code and can affect boot or hardware behavior.

An attacker breaks out of a guest VM and reaches the hypervisor. What is this?

Correct: A. VM escape is when code leaves the virtual machine boundary and affects host or other guests.

A mobile user installs apps outside the official app store to bypass platform protections. What is this called?

Correct: D. Sideloading installs applications from outside approved distribution channels.

A phone is modified to remove vendor security restrictions. What is this?

Correct: C. Jailbreaking or rooting bypasses platform controls and increases device risk.

A vulnerability is being exploited before the vendor has released a patch. What is it?

Correct: D. A zero-day is unknown or unpatched by the vendor when attackers can exploit it.

A scanner shows several hosts missing a critical update released last month. Which mitigation is most direct?

Correct: B. Patch management evaluates, approves, deploys, and verifies security updates.

A team removes default passwords and disables sample accounts before production. Which mitigation is this?

Correct: A. Hardening reduces attack surface by securely configuring systems.

Only approved executables can run on a workstation. Which control is this?

Correct: C. Application allow listing permits only explicitly approved software to execute.

A firewall rule blocks traffic from known malicious countries but allows everything else. What is this approach?

Correct: D. A deny list blocks known-bad items while allowing anything not explicitly denied.

A host firewall blocks inbound SMB on laptops. Which hardening control is this?

Correct: A. A host-based firewall filters traffic on an individual endpoint.

Endpoint software detects suspicious behavior and isolates the host. What technology is this?

Correct: B. Endpoint detection and response detects and responds to endpoint threats.

A security platform correlates endpoint, cloud, identity, and network signals. What is it?

Correct: C. Extended detection and response combines telemetry across multiple security layers.

A local endpoint tool blocks suspicious activity before it executes. What is this?

Correct: D. Host intrusion prevention systems can detect and block threats on a host.

A company divides workloads into very small policy zones to limit lateral movement. What is this?

Correct: B. Microsegmentation applies granular controls to individual workloads or small groups.

A cloud network has public and private subnets with security rules around database access. What concept is being used?

Correct: A. Segmentation separates resources and controls traffic between zones.

A virtual firewall controls traffic for cloud VMs using port and IP rules. What is this often called?

Correct: D. Network security groups provide cloud-level traffic filtering for resources.

A BYOD phone separates business mail from personal apps and prevents copy/paste to personal storage. What is this?

Correct: C. MAM protects corporate app data without necessarily managing the entire device.

A noncompliant laptop is placed on a restricted network until it is patched. Which control does this?

Correct: C. NAC can assess device posture and quarantine devices that do not meet requirements.

A private cloud keeps data in a company-controlled data center for compliance reasons. What benefit is highlighted?

Correct: D. Private cloud can provide greater control over compliance, architecture, and upgrade timing.

An application keeps sensitive records on-premises but bursts web traffic into public cloud during peak season. What model is this?

Correct: B. Hybrid cloud combines private/on-premises resources with public cloud services.

Several hospitals share a cloud environment designed for their common regulatory needs. What model is this?

Correct: A. Community cloud is shared by organizations with common requirements or concerns.

A company uses two public cloud providers to reduce dependence on one vendor. What model is this?

Correct: A. Multicloud uses services from more than one cloud provider.

A cloud function runs code only when triggered and the provider manages the server layer. What architecture is this?

Correct: D. Serverless abstracts server management and runs code on demand.

An app is split into small independent services with their own APIs. What architecture is this?

Correct: C. Microservices break applications into smaller independently deployable services.

A container image includes vulnerable libraries and is deployed unchanged across clusters. What should be scanned?

Correct: B. Container images should be scanned for vulnerable packages and insecure configuration.

A control network is physically separated from all other networks. What is this called?

Correct: A. An air gap provides physical isolation between networks.

Network control is handled through centralized software rather than manual device-by-device changes. What is this?

Correct: D. SDN separates control logic from network forwarding and enables centralized management.

Security decisions are made by local business units with central oversight. What governance model is this?

Correct: C. Decentralized governance delegates some decisions to business units while retaining oversight.

All security architecture decisions come from one central security office. What governance model is this?

Correct: D. Centralized governance manages security decisions and standards from a central team.

A system is designed to recover quickly after failure and keep operating through disruption. What quality is this?

Correct: B. Resilience is the ability to withstand and recover from disruption.

A company accepts the vendor’s SOC 2 report instead of directly auditing a hyperscale cloud data center. Why?

Correct: A. Major CSPs typically provide independent assurance reports because direct customer audits are not practical.

A backup copy is stored in the same server room as the original system. What is the main weakness?

Correct: C. Onsite backups are convenient but can be lost with the primary site during local incidents.

A storage system writes changes to a transaction log so a database can roll forward. What is this?

Correct: D. Journaling records changes so systems can recover to a consistent point.

A backup captures the exact state of a VM at a point in time. What is this?

Correct: A. Snapshots preserve point-in-time state for recovery or rollback.

Data is continuously copied to another region to support recovery. What is this?

Correct: B. Replication creates copies of data in another location for redundancy and recovery.

A DR metric states how much data loss the business can tolerate. What is it?

Correct: C. Recovery point objective defines the maximum acceptable data loss measured in time.

A DR metric states how quickly a service must be restored. What is it?

Correct: D. Recovery time objective defines the target time to restore service.

A metric tracks average time needed to repair a failed system. What is it?

Correct: B. Mean time to repair measures average restoration time after failure.

A metric estimates average time between failures for a component. What is it?

Correct: A. Mean time between failures estimates reliability over time.

A recovery site has power and space but no current hardware installed. What type of site is this?

Correct: D. A cold site has facilities but requires hardware and data restoration before use.

A recovery site has equipment and some data but still needs final restoration. What is it?

Correct: C. A warm site is partially prepared and can be brought online faster than a cold site.

A recovery site is fully operational and ready for rapid failover. What is it?

Correct: C. A hot site is highly ready and can take over quickly.

A disaster recovery test runs systems at the recovery site alongside production without cutting over. What is this?

Correct: D. Parallel processing validates recovery systems while production continues running.

A discussion-based exercise walks leadership through a ransomware scenario. What is this?

Correct: B. Tabletop exercises discuss roles and decisions without affecting production systems.

A realistic exercise has teams perform incident tasks in a controlled scenario. What is it?

Correct: A. Simulations test incident or recovery processes in a practiced scenario.

A Wi-Fi network uses SAE and stronger protections than WPA2-Personal. Which standard is this?

Correct: A. WPA3 improves wireless security compared with older personal wireless standards.

Enterprise Wi-Fi sends authentication requests to a central server. What service is commonly used?

Correct: D. RADIUS commonly supports centralized AAA for enterprise network access.

A team checks whether an area has coverage gaps before installing access points. What is this work?

Correct: C. A site survey helps plan wireless placement and coverage.

A visual map shows weak signal areas in a building. What is it?

Correct: B. Wireless heat maps visualize signal coverage and dead zones.

An organization lets employees use personally owned phones for work email. Which deployment model is this?

Correct: A. Bring your own device allows personally owned devices for work use.

Employees choose from approved laptop models that the company buys and manages. Which model is this?

Correct: D. Choose your own device lets users pick from approved corporate device options.

A field tablet uses cellular service when outside company facilities. Which connection method is this?

Correct: C. Cellular connectivity uses mobile carrier networks.

A headset pairs wirelessly over short range with a laptop. Which connection is used?

Correct: D. Bluetooth provides short-range wireless peripheral connectivity.

A web form rejects unexpected characters before sending data to the database. Which secure coding practice is this?

Correct: B. Input validation checks data before processing to reduce injection and logic flaws.

A cookie is marked so browser scripts cannot read it. Which attribute is this?

Correct: A. HttpOnly helps protect cookies from client-side script access.

A cookie is sent only over HTTPS. Which attribute is this?

Correct: C. The Secure cookie attribute restricts cookie transmission to HTTPS.

A cookie is restricted to reduce cross-site request abuse. Which attribute is most relevant?

Correct: D. SameSite helps control whether cookies are sent with cross-site requests.

A package is digitally signed before deployment so tampering can be detected. What is this?

Correct: A. Code signing verifies publisher identity and code integrity.

A scanner checks systems weekly and emails missing-patch reports. Which data source is this?

Correct: B. Vulnerability scans identify missing patches and weaknesses.

An automated daily report ranks risky alerts for analysts. What source is this?

Correct: C. Automated reports summarize security tool findings and can prioritize investigation.

A dashboard shows a sudden spike in blocked outbound connections. Why is it useful?

Correct: D. Dashboards show trends, spikes, and metrics that can point analysts toward issues.

A firewall log shows a blocked connection from a host to a known command-and-control address. What kind of log is this?

Correct: B. Firewall logs show allowed or blocked network traffic based on rules.

A web app log shows a user attempted to access /admin repeatedly. What log type is this?

Correct: A. Application logs record actions and errors inside a specific application.

A Windows event log shows failed logons and privilege use. What source is this?

Correct: D. Operating system security logs record login and security-related events.

A laptop EDR log shows a suspicious PowerShell command. What source is this?

Correct: C. Endpoint logs capture activity on individual workstations or servers.

An IPS record says a known exploit was blocked. What source is this?

Correct: C. IPS logs include detected and often blocked network threats.

Router syslog shows interface changes and traffic events. What source is this?

Correct: D. Network logs from routers, switches, and other devices help reconstruct activity.

Email headers show sender path, recipient, timestamps, and message IDs. What kind of evidence is this?

Correct: B. Metadata is data about data, such as timestamps, owners, routes, or identifiers.

An analyst needs raw packet contents to confirm a protocol downgrade attempt. Which source is best?

Correct: A. Packet captures provide detailed packet and protocol data.

The incident team isolates affected hosts to stop spread. Which phase is this?

Correct: A. Containment limits damage and prevents further spread during an incident.

Malware is removed and vulnerable persistence mechanisms are cleaned up. Which phase is this?

Correct: D. Eradication removes the root cause, malware, or attacker foothold.

Systems are rebuilt and returned to normal service after compromise. Which phase is this?

Correct: C. Recovery restores affected systems and services to operation.

After an incident, the team updates playbooks based on what went wrong. Which phase is this?

Correct: B. Lessons learned improves future response after the incident.

An organization writes plans, assigns roles, and configures logging before an incident. Which phase is this?

Correct: A. Preparation establishes people, process, and technology before incidents occur.

Monitoring tools alert on possible compromise. Which phase begins?

Correct: D. Detection identifies suspicious events that may become incidents.

Counsel instructs the company not to delete emails related to an investigation. What is this?

Correct: C. Legal hold preserves potentially relevant evidence for legal or regulatory matters.

A forensic analyst creates a bit-for-bit copy of a drive. What is this?

Correct: D. Acquisition collects forensic evidence such as disk images in a defensible way.

Evidence is kept in locked storage with access tracking and hashes. What concern is addressed?

Correct: B. Evidence preservation protects integrity and custody of forensic material.

A company must produce stored messages for a lawsuit. What process is this?

Correct: A. E-discovery identifies and produces electronically stored information for legal matters.

A SOC playbook automatically enriches an IP address and opens a ticket. What tool category is likely?

Correct: C. SOAR orchestrates and automates security workflows.

Automating baseline server configuration mainly improves what?

Correct: D. Automation helps enforce consistent secure configurations at scale.

Too much brittle automation creates scripts no one can maintain. What concern is this?

Correct: A. Automation can introduce technical debt if it is not supportable and maintained.

A central automation platform goes down and response workflows stop. What concern is this?

Correct: B. Critical automation platforms can become single points of failure if not designed resiliently.

A security team uses repeatable automation to handle routine alerts faster. What benefit is this?

Correct: C. Automation can reduce response time for common, repeatable tasks.

A document states what employees may and may not do with company systems. What policy is this?

Correct: D. An acceptable use policy defines permitted and prohibited use of organizational resources.

A plan describes how the company will keep critical services running during disruption. What is it?

Correct: B. Business continuity focuses on continuing essential business operations.

A plan focuses on restoring IT systems after a major outage. What is it?

Correct: A. Disaster recovery focuses on restoring technology services and data.

A policy covers how software is securely designed, tested, and released. What area is this?

Correct: D. Secure SDLC policies guide security through the software development lifecycle.

A process removes access and retrieves equipment when an employee leaves. What is this?

Correct: C. Offboarding revokes access and handles assets when personnel leave.

A new hire receives role-based access and security training. What process is this?

Correct: C. Onboarding grants appropriate access and introduces required policies and training.

A SOC document gives exact steps for handling a phishing report. What is it?

Correct: D. Playbooks provide repeatable steps for responding to specific events.

A group reporting to the board oversees internal audit independence. What is this?

Correct: B. Audit committees oversee audit activities and help preserve independence.

Senior leadership legally owns decisions for a sensitive dataset. Which role is this?

Correct: A. Data owners are accountable for data and control decisions.

A cloud provider processes customer data according to the customer’s instructions. Which privacy role is this?

Correct: A. A processor handles personal data on behalf of the controller.

A company decides why and how customer data will be processed. Which role is this?

Correct: D. A controller determines the purpose and means of processing personal data.

The person whose personal information is being processed is called what?

Correct: C. A data subject is the individual the personal data is about.

A database lists where sensitive data is stored, who owns it, and retention rules. What is this?

Correct: B. A data inventory tracks data locations, owners, classification, and handling requirements.

A policy says records must be kept seven years and then disposed of. What is this?

Correct: A. Retention defines how long data is kept and when it should be disposed of.

A company asks employees to formally confirm they understand the security handbook. What is this?

Correct: D. Acknowledgement records that people received and accepted policy requirements.

An executive signs a statement that controls operated during the audit period. What is this?

Correct: C. Attestation is a formal assertion about controls, compliance, or facts.

A company evaluates a vendor’s finances, reputation, and security before signing. What is this?

Correct: D. Due diligence is investigation and analysis before making a decision.

A company acts on vendor findings by requiring stronger controls. What is this?

Correct: B. Due care is taking reasonable action based on known risks and obligations.

A risk response buys cyber insurance. What response type is this?

Correct: A. Risk transfer shifts some financial impact to another party, such as an insurer.

A company stops offering a risky public service entirely. What response is this?

Correct: C. Avoidance eliminates the activity causing the risk.

A company applies MFA and segmentation to reduce likely breach impact. What response is this?

Correct: D. Mitigation reduces likelihood or impact of risk.

Leadership defines the maximum risk level the company is willing to tolerate. What is this?

Correct: A. Risk threshold or appetite defines the level of risk leadership will accept.

A metric warns that privileged access exceptions are increasing. What is it?

Correct: B. Key risk indicators provide warning signs of changing risk levels.

The person accountable for managing a specific risk is the what?

Correct: C. Risk owners are accountable for tracking and treating assigned risks.

Asset value is $100,000 and exposure factor is 25 percent. What is SLE?

Correct: D. Single loss expectancy equals asset value multiplied by exposure factor.

SLE is $20,000 and ARO is 3. What is ALE?

Correct: B. Annualized loss expectancy equals SLE multiplied by annualized rate of occurrence.

A risk review is performed every quarter. What assessment frequency is this?

Correct: A. Recurring assessments happen on a defined schedule.

A quick risk review is performed after a suspicious outage. What type is this?

Correct: D. Ad hoc assessments are informal or event-driven.

Risk scoring is built into daily vulnerability and configuration monitoring. What approach is this?

Correct: C. Continuous risk assessment is ongoing and integrated into operations.

A risk workshop uses high, medium, and low ratings instead of dollars. Which analysis is this?

Correct: C. Qualitative analysis uses descriptive ratings instead of numeric financial values.

A risk model estimates probability, loss, and dollar impact. Which analysis is this?

Correct: D. Quantitative analysis uses numeric values and financial estimates.

A contract defines uptime targets and penalties for missing them. What agreement is this?

Correct: B. A service level agreement defines service performance expectations.

A document states two organizations intend to cooperate but is less formal than a contract. What is this?

Correct: A. A memorandum of understanding records mutual intent and understanding.

A formal agreement defines responsibilities between two parties working together. What is this?

Correct: A. A memorandum of agreement is generally more formal and action-oriented than an MOU.

A long-term vendor contract sets general legal and security terms for future projects. What is this?

Correct: D. A master service agreement sets broad terms that later work orders or SOWs can use.

A project document describes exact deliverables, schedule, and work to be performed. What is it?

Correct: C. A statement of work defines project scope, deliverables, and expectations.

A short document authorizes a specific task under an existing agreement. What is this?

Correct: B. A work order authorizes specific work, often under a larger agreement.

A vendor is prohibited from sharing proprietary information. What agreement is this?

Correct: A. A nondisclosure agreement restricts sharing of confidential information.

A healthcare partner agreement defines responsibilities around protected health information. What is this?

Correct: D. Business partner agreements define responsibilities when partners handle regulated or sensitive data.

A vendor review maps subcontractors that could affect service security. What assessment is this?

Correct: C. Supply chain analysis identifies risk from vendors, subcontractors, and dependencies.

A vendor provides a recent independent audit report. What assurance source is this?

Correct: D. Independent assessments provide stronger assurance than self-reported answers.

A company visits a vendor facility and interviews staff before approval. What assessment method is this?

Correct: B. On-site assessments inspect operations directly through observation and interviews.

A vendor is asked to send policies and evidence for review. What method is this?

Correct: A. Document exchange and review evaluates vendor controls through requested evidence.

A penetration test contract defines allowed targets, dates, and constraints. What is this?

Correct: C. Rules of engagement set scope, timing, boundaries, and expectations for testing.

A company faces fines and license loss after ignoring a privacy law. What issue is this?

Correct: D. Noncompliance can lead to fines, sanctions, reputational damage, contractual impact, or license loss.

A compliance report is sent to regulators as required by law. What reporting type is this?

Correct: A. External reporting is submitted to regulators, auditors, or other outside entities.

Compliance status is briefed to executives before an audit. What reporting type is this?

Correct: B. Internal reporting informs leadership and stakeholders about compliance posture.

A company automates evidence collection for configuration compliance. What benefit is this?

Correct: C. Automation can collect evidence, monitor controls, and speed compliance reporting.

A privacy law applies because customers live in another country. What concern is this?

Correct: D. Privacy requirements can depend on where data subjects, companies, and processors are located.

A regulation requires breach notification within a defined time. Where should this duty appear for vendors?

Correct: B. Vendor contracts should include breach notification and security obligations.

A company keeps customer data confidential but also gives people rights over how their data is used. What distinction is shown?

Correct: A. Privacy concerns individual control over personal data; confidentiality protects data from unauthorized access.

An employee reports a suspicious message using the approved button instead of forwarding it normally. What program area is this?

Correct: D. Awareness programs should teach how to report suspicious messages safely.

A phishing email uses urgent payment language and a mismatched sender domain. What should training emphasize?

Correct: C. Training should help users spot urgency, suspicious links, attachments, and sender anomalies.

An employee downloads tools from an untrusted website. What behavior category is this?

Correct: C. Risky behavior increases the chance of compromise or data exposure.

A user logs in at 3 a.m. and downloads unusual volumes of sensitive data. What behavior category is this?

Correct: D. Unexpected behavior differs from normal patterns and may indicate compromise or insider risk.

A user accidentally emails sensitive files to the wrong recipient. What behavior category is this?

Correct: B. Unintentional behavior causes risk through mistakes rather than malicious intent.

Training warns staff not to reuse passwords across personal and work sites. What topic is this?

Correct: A. Password management training covers strong passwords, reuse avoidance, and password managers.

Training explains that a coworker may misuse legitimate access to steal data. What topic is this?

Correct: A. Insider threat awareness teaches users to recognize misuse of trusted access.

Remote staff are taught to secure home Wi-Fi and avoid public computers for work. What topic is this?

Correct: D. Remote work training covers home networks, work data handling, and public access risks.

A training program starts with a baseline quiz before lessons begin. What is this?

Correct: C. Initial assessment measures current awareness before training.

Employees receive updated phishing training every quarter. What is this?

Correct: B. Recurring training reinforces behavior and addresses evolving threats.

A company measures which teams report simulated phish and adjusts lessons. What is this?

Correct: A. Reporting and monitoring identify gaps and improve training programs.

A tester researches public job postings without touching company systems. What reconnaissance is this?

Correct: D. Passive reconnaissance gathers information without directly interacting with target systems.

A tester scans target hosts to discover open ports. What reconnaissance is this?

Correct: C. Active reconnaissance interacts with target systems and is more detectable.

Defenders run scans and blue-team exercises to find weaknesses. What type of assessment is this?

Correct: D. Defensive assessments evaluate and improve protective capabilities.

A red team attempts to exploit systems under approved scope. What assessment type is this?

Correct: B. Offensive assessments simulate attacker behavior to identify exploitable weaknesses.

An assessment combines policy review, technical testing, and physical checks. What type is this?

Correct: A. Integrated assessments combine multiple assessment approaches or domains.

Testers receive network diagrams and credentials before starting. What environment is this?

Correct: C. Known environment testing gives testers detailed target information.

Testers receive limited information, such as a few user accounts but no full diagrams. What is this?

Correct: D. Partially known testing provides some information but not full knowledge.

A breach reduces customer trust and sales even after systems recover. What consequence is this?

Correct: A. Security and compliance failures can cause reputational damage that lasts beyond technical recovery.

A regulator restricts a business from processing data after repeated violations. What consequence is this?

Correct: B. Sanctions are regulatory or legal penalties that can restrict operations.

A contract is terminated because a vendor failed required security controls. What consequence is this?

Correct: C. Noncompliance can create contractual penalties or termination.

A business loses permission to operate in a regulated sector. What consequence is this?

Correct: D. Serious noncompliance can result in license or permit loss.

A company chooses a conservative risk appetite after entering healthcare. What does that mean?

Correct: B. A conservative risk posture accepts less risk and usually requires stronger controls.

A startup accepts more uncertainty to grow quickly. What risk appetite is this?

Correct: A. An expansionary posture accepts more risk in pursuit of growth or opportunity.

Leadership balances control cost and business speed without favoring extremes. What posture is this?

Correct: D. A neutral posture balances risk-taking and risk reduction.

A company documents a temporary approval to violate a standard because of a business need. What is this?

Correct: C. An exception is a documented temporary deviation from a requirement.

A system is permanently not subject to a control due to approved scope. What is this?

Correct: C. An exemption removes a system or case from a requirement, usually through formal approval.

A record of risks, owners, scores, and treatment plans is maintained. What is this?

Correct: D. A risk register tracks identified risks and treatment decisions.

A business impact analysis identifies which process must be restored first. What does BIA support?

Correct: B. A BIA identifies critical processes and impacts to support continuity priorities.

An attacker captures a valid authentication exchange and reuses it later. What attack is this?

Correct: A. Replay attacks reuse captured authentication or transaction data.

An attacker sits between a user and website to intercept traffic. What attack is this?

Correct: A. On-path attackers intercept or alter communications between parties.

A DNS record is altered so users are sent to an attacker site. What attack is this?

Correct: D. DNS poisoning manipulates name resolution to redirect users.

A domain registrar account is compromised and name server settings are changed. What attack is this?

Correct: C. Domain hijacking changes control or configuration of a domain.

A cryptographic protocol negotiation is forced to use a weaker version. What attack is this?

Correct: B. Downgrade attacks force weaker cryptographic options.