Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 2121Question →

An enterprise financial organization is conducting a quantitative risk analysis for its core transaction processing database. The asset has an estimated Asset Value (AVAV) of $2,000,000\$2,000,000. Historical threat intelligence indicates an Exposure Factor (EFEF) of 0.400.40 (40%40\%) from ransomware incidents, with an Annual Rate of Occurrence (AROARO) of 0.500.50 (once every two years).

To address this exposure, the Chief Information Security Officer (CISO) evaluates a dual-layer risk management proposal:
1. Deploying an automated air-gapped immutable backup architecture costing $50,000\$50,000 annually, which reduces the EFEF to 0.100.10 (10%10\%).
2. Purchasing a specialized cybersecurity liability insurance policy costing $30,000\$30,000 annually that provides coverage up to $500,000\$500,000 per incident.

Based on quantitative risk assessment principles and risk response definitions, which of the following statements correctly classify the risk response strategies and numerical metrics for this organization? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Purchasing cyber liability insurance represents a risk transference strategy to shift financial loss, while deploying immutable backups represents a risk mitigation strategy to lower impact severity.; Deploying the automated immutable backup solution reduces the baseline Single Loss Expectancy (SLESLE) from $800,000\$800,000 to $200,000\$200,000, yielding an Annual Loss Expectancy (ALEALE) reduction of $300,000\$300,000.

Answer

The correct statements are that purchasing insurance acts as risk transference while backups act as risk mitigation, and that the backup solution reduces baseline SLESLE from $800,000\$800,000 to $200,000\$200,000, resulting in an ALEALE reduction of $300,000\$300,000.
Purchasing cyber liability insurance shifts financial loss responsibility to an insurer, which is the definition of risk transference. Technical controls like immutable backups decrease loss magnitude during a ransomware event, which represents risk mitigation. Mathematically, the baseline Single Loss Expectancy (SLESLE) is $2,000,000×0.40=$800,000\$2,000,000 \times 0.40 = \$800,000, yielding a baseline Annual Loss Expectancy (ALEALE) of $800,000×0.50=$400,000\$800,000 \times 0.50 = \$400,000. With the backup control reducing EFEF to 0.100.10, the new SLESLE becomes $2,000,000×0.10=$200,000\$2,000,000 \times 0.10 = \$200,000, and the new ALEALE becomes $200,000×0.50=$100,000\$200,000 \times 0.50 = \$100,000. Subtracting the new ALEALE from the baseline ALEALE gives an ALEALE reduction of $300,000\$300,000.

Step-by-Step Solution

1
Calculate the baseline Single Loss Expectancy (SLESLE) and Annual Loss Expectancy (ALEALE).
Baseline SLE=AV×EFbaseline=$2,000,000×0.40=$800,000SLE = AV \times EF_{baseline} = \$2,000,000 \times 0.40 = \$800,000. Baseline ALE=SLEbaseline×ARO=$800,000×0.50=$400,000ALE = SLE_{baseline} \times ARO = \$800,000 \times 0.50 = \$400,000.
Establishing baseline metrics is necessary to quantify potential financial impact before controls are implemented.
2
Calculate the post-mitigation SLESLE and ALEALE following the backup solution deployment.
New SLE=AV×EFnew=$2,000,000×0.10=$200,000SLE = AV \times EF_{new} = \$2,000,000 \times 0.10 = \$200,000. New ALE=SLEnew×ARO=$200,000×0.50=$100,000ALE = SLE_{new} \times ARO = \$200,000 \times 0.50 = \$100,000.
The backup solution lowers the Exposure Factor (EFEF) from 40%40\% to 10%10\% while the AROARO remains 0.500.50.
3
Determine the total ALEALE reduction achieved by the mitigation strategy.
ALEALE Reduction = Baseline ALEALE - Post-mitigation ALEALE = $400,000−$100,000=$300,000\$400,000 - \$100,000 = \$300,000.
Quantifying ALEALE reduction provides the annual monetary risk benefit of the technical control.
4
Categorize the risk response strategies conceptually.
Insurance transfers financial risk to a third party (Risk Transference). Backups reduce potential damage severity (Risk Mitigation).
Risk response types are defined by how they modify risk ownership, likelihood, or impact.

Key Concept

Quantitative Risk Assessment and Risk Response Classification
Question 2122Question →

Match each organizational compliance scenario to the specific regulatory mandate or statutory framework that governs its security and privacy controls.

Click a left item, then click its matching right item

Items

A defense contractor developing satellite control software must restrict remote technical data access exclusively to U.S. persons to avoid illegal export of sensitive cryptographic source code.
A non-bank financial service provider must designate a Qualified Individual to oversee its information security program and mandate multi-factor authentication for accessing customer financial records.
A European financial institution must conduct threat-led penetration testing and enforce comprehensive security risk oversight over critical third-party information technology service providers.
A consumer platform operating in California must provide users with an explicit statutory right to opt out of having their personal profiles sold or shared for cross-context behavioral advertising.

Matches

Show answer & explanation

Answer

Each enterprise compliance requirement maps directly to its statutory or regulatory framework: restriction of defense software technical data to U.S. persons maps to ITAR; governance of non-bank financial customer data overseen by a Qualified Individual maps to the GLBA Safeguards Rule; European financial sector ICT resilience and third-party risk oversight maps to DORA; and state-level consumer opt-out rights for data selling/sharing maps to CCPA/CPRA.
Each organizational requirement aligns strictly with its governing framework: defense satellite technical data falls under ITAR; non-bank customer record security under the GLBA Safeguards Rule; EU financial sector ICT operational resilience under DORA; and consumer privacy rights allowing opt-out of data selling under CCPA/CPRA.

Step-by-Step Solution

1
Analyze the technical defense software access control requirement
Identified defense article technical data export restrictions limiting access strictly to U.S. persons
ITAR controls technical data and source code associated with defense technology items under the U.S. Munitions List.
2
Evaluate the non-bank financial institution governance scenario
Matched mandatory Qualified Individual designation and access control enforcement
The FTC GLBA Safeguards Rule establishes explicit security program governance requirements for financial institutions.
3
Evaluate the EU financial sector operational resilience and third-party risk scenario
Identified ICT operational resilience and security testing obligations
DORA enforces binding digital operational resilience standards across European financial entities.
4
Evaluate the consumer privacy data transfer opt-out requirement
Matched statutory opt-out rights for consumer personal data processing and advertising sales
CCPA/CPRA mandates clear mechanisms for consumers to restrict the selling or sharing of personal data.

Key Concept

Organizational Compliance Mandates and Regulatory Framework Alignment
Question 2123Question →

During a vulnerability assessment of an enterprise infrastructure, a scanner flags a critical unpatched remote code execution vulnerability on a core database server. The system administrator requests to mark the finding as risk-accepted without patching, citing that an inline Network Intrusion Prevention System (NIPS) is active on the network segment. Which of the following best describes the primary operational risk of relying on this compensating control instead of applying the vendor patch?

Show answer & explanation

Answer: Attackers who gain access to the internal network can potentially bypass the intrusion prevention system using encrypted channels or lateral movement, leaving the unpatched flaw exposed.

Answer

Attackers who gain access to the internal network can potentially bypass the intrusion prevention system using encrypted channels or lateral movement, leaving the unpatched flaw exposed.
Relying on a Network Intrusion Prevention System (NIPS) as a compensating control reduces exposure but does not remediate the vulnerability. If threat actors establish a presence within the network or encrypt their exploit payloads, the NIPS may fail to block the attack, allowing the unpatched server to be compromised.

Step-by-Step Solution

1
Analyze the proposed risk response
The administrator proposes using an inline NIPS as a compensating control instead of remediating the software vulnerability with a vendor patch.
Compensating controls provide temporary risk reduction but do not address the root cause of a vulnerability.
2
Evaluate the limitations of network compensating controls
NIPS devices inspect traffic based on signatures and plain-text patterns; they can be bypassed via encryption, novel evasion techniques, or local attack vectors inside the network boundary.
Vulnerabilities remain active on the host as long as the underlying software code remains unpatched.
3
Determine the primary operational risk
Relying solely on NIPS leaves the host exposed if an attacker achieves internal position or uses encrypted channels to bypass network inspection.
Effective vulnerability management prioritizes patching root-cause flaws over relying exclusively on perimeter or inline filtering.

Key Concept

Vulnerability Remediation vs. Compensating Controls
Estimated Time:1m 30s
Question 2124Question →

An organization recently launched simulated phishing exercises to evaluate its human risk management program. Rather than relying solely on training completion rates, the security team wants to assess active employee engagement during a simulated attack. Which of the following metrics best indicates a positive security awareness outcome?

Show answer & explanation

Answer: An increase in the percentage of employees who report simulated phishing emails using the reporting tool

Answer

An increase in the percentage of employees who report simulated phishing emails using the reporting tool
High reporting rates of simulated phishing emails indicate that users recognize social engineering indicators and know how to report suspicious activity promptly, directly mitigating human risk.

Step-by-Step Solution

1
Identify the primary objective of measuring human risk management in security awareness programs.
Effective security awareness metrics evaluate positive behavioral changes, such as threat recognition and rapid reporting.
Tracking user reporting behavior measures active security participation during simulated phishing attacks.
2
Differentiate human behavioral metrics from technical security controls.
Promptly reporting suspicious emails via an automated button directly proves employee vigilance.
Technical controls like firewalls or antivirus software operate independently of end-user security awareness.

Key Concept

Security Awareness Program Metrics and Phishing Reporting
Estimated Time:1m 0s
Question 2125Question →

An organization relies on end-user reporting to reduce human risk and mitigate phishing attacks. Place the following steps in the correct sequential order from initial end-user reporting to security awareness program escalation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with employee reporting, followed by automated threat verification, enterprise inbox purging, and updating security awareness training.
The correct sequence follows logical security lifecycle operations: end-user detection and reporting, technical analysis and verification, enterprise-wide technical containment, and continuous feedback into the security awareness training program.

Step-by-Step Solution

1
Identify the initial reporting action.
The employee recognizes suspicious email indicators and reports the email.
Reporting procedures start with end-user recognition and submission.
2
Determine the technical analysis stage.
Automated tools analyze and verify the reported payload.
Technical analysis must immediately validate the report before broader incident containment actions occur.
3
Identify the technical containment response.
Security operations purges matching messages from all user inboxes.
Containment prevents other employees from interacting with the active threat.
4
Identify the program improvement feedback loop.
The security awareness team updates ongoing training based on the real-world attack vector.
Continuous feedback closes the loop by improving future human risk resilience against real-world tactics.

Key Concept

Incident Reporting and Security Awareness Feedback Loop
Question 2126Question →

A security operations team configures an isolated decoy server populated with simulated confidential files on an internal subnet. The server is designed to attract unauthorized intruders who have breached the perimeter, allowing analysts to log their activities and gather telemetry on their attack techniques without exposing production data. Which of the following security control classifications correctly identifies both the category and functional type of this deployment?

Show answer & explanation

Answer: Technical category and Detective functional type

Answer

Technical category and Detective functional type
A decoy server (honeypot) is built using software tools and system configurations, placing it squarely in the Technical control category. Its core functional objective is to capture attacker activity and issue alerts when accessed, which classifies it as a Detective control.

Step-by-Step Solution

1
Determine the security control category based on implementation method.
Since the decoy server is deployed using operating systems, software services, and network configurations, it falls under the Technical (Logical) control category.
Technical controls are implemented using hardware, software, or firmware mechanisms.
2
Determine the functional control type based on the primary objective of the deployment.
The primary goal is to observe, record, and alert on unauthorized intruder activity within the environment, which defines a Detective control type.
Detective controls operate to identify and log unauthorized activities during or after an intrusion attempt.

Key Concept

Security Control Categories and Functional Types
Question 2127Question →

A multinational logistics enterprise headquartered in the United States processes payment card transactions for international shipments, manages personal data of European Union residents, and reports internal audit controls as a publicly traded company. The chief information security officer (CISO) is updating the enterprise regulatory compliance matrix following a cloud migration. Which of the following operational obligations directly apply to this organization? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Establishing a lawful basis for processing personal data and enforcing data minimization principles for European customer records.; Isolating the cardholder data environment (CDE) with strict network segmentation and conducting periodic vulnerability assessments.

Answer

The organization must establish a lawful processing basis with data minimization under GDPR and maintain a secure, segregated cardholder data environment under PCI DSS.
Because the enterprise processes personal data belonging to EU residents, it falls directly within the extra-territorial scope of GDPR, necessitating a defined lawful processing basis and data minimization controls. Additionally, because the company directly processes payment cards for online orders, it is bound by PCI DSS mandates to isolate the Cardholder Data Environment (CDE) and run regular security scans.

Step-by-Step Solution

1
Analyze the regulatory jurisdictions and data types present in the scenario.
Identified EU PII (governed by GDPR), payment card data (governed by PCI DSS), and publicly traded US financial reporting (governed by SOX).
Regulatory applicability is determined by geography, data classification, and corporate governance structure.
2
Evaluate compliance obligations for European Union resident data.
GDPR applies extra-territorially, requiring a lawful basis (e.g., consent or contractual necessity) and adherence to data minimization principles.
Organizations processing EU residents' PII must comply with GDPR regardless of corporate headquarters location.
3
Evaluate compliance obligations for credit card processing systems.
PCI DSS requires securing and isolating the cardholder data environment (CDE) using segmentation and vulnerability testing.
Any organization handling account numbers or cardholder details must comply with PCI DSS technical standards.
4
Examine distractors for shared responsibility and regulatory scope misclassifications.
Disqualified CSP delegation of SOX liability (SOX accountability stays with corporate officers) and HHS breach notification (HIPAA applies strictly to PHI).
Cloud contracts cannot transfer legal compliance duties for financial reporting, and HIPAA governs healthcare data, not credit cards.

Key Concept

Regulatory Compliance Scope, Data Classification, and Extraterritorial Jurisdiction
Estimated Time:2m 0s
Question 2128Question →

An enterprise security analyst is configuring an automated vulnerability scanner to conduct routine compliance assessments across internal production database servers. To ensure accurate vulnerability identification while preventing system downtime or account lockouts, which of the following configuration options should the analyst implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provide read-only service account credentials to allow host-based local package and configuration inspection.; Configure rate throttling and non-intrusive scan settings to limit concurrent query loads on target systems.

Answer

The analyst should provide read-only service account credentials for host-based package inspection and configure rate throttling with non-intrusive scan settings to protect target systems.
Credentialed (authenticated) scanning gives the scanner low-privilege access to target OS and software inventories, producing accurate vulnerability reports without generating high risk. Simultaneously, employing rate throttling and non-intrusive scan modules ensures that production services remain stable and operational throughout the assessment window.

Step-by-Step Solution

1
Determine the optimal scan authorization mode for accurate results.
Using low-privilege audit credentials allows safe internal package and configuration audits without relying on risky or inaccurate external network banner guessing.
Credentialed scanning dramatically reduces false positives and provides deeper visibility into system patch levels.
2
Establish scan performance and safety controls.
Enabling non-intrusive checks and throttling request rates prevents resource exhaustion on delicate production databases.
Vulnerability assessments in production environments must minimize operational impact.

Key Concept

Vulnerability Scanning Methods and Configuration Controls
Estimated Time:1m 30s
Question 2129Question →

A field technician working at a remote facility discovers several corporate-branded USB flash drives left on tables in the facility's cafeteria. Each drive is labeled with the text "Q3 Executive Compensation & Bonus Allocations - Confidential." Driven by curiosity, the technician plugs one of the drives into a corporate network workstation to view the contents, triggering an automatic payload execution that harvests local account credentials. Which type of social engineering attack vector did the threat actor utilize in this scenario?

Show answer & explanation

Answer: Baiting

Answer

Baiting is the social engineering vector utilized when an attacker leaves infected physical media in accessible locations, exploiting human curiosity to induce victims to insert the media into target systems.
Baiting involves leaving a malware-infected physical device (such as a USB drive) in a location where target users are likely to find it. The attacker relies on victim curiosity (heightened by enticing labels like confidential financial documents) to prompt them to connect the device to an enterprise computer.

Step-by-Step Solution

1
Analyze the attack medium and delivery mechanism described in the scenario.
The attack relies on physical media (labeled USB flash drives) intentionally placed in a public/accessible employee area.
Identifying the medium (physical storage device vs. web browser vs. physical door) narrows down the social engineering category.
2
Evaluate the psychological psychological trigger exploited by the threat actor.
The label 'Q3 Executive Compensation' appeals directly to employee curiosity and greed.
Social engineering tactics manipulate specific human psychological factors; curiosity piqued by high-value labeled media is characteristic of baiting.
3
Match the attack indicators to the specific CompTIA Security+ social engineering taxonomy definition.
Leaving malicious hardware media for an unsuspecting victim to find and insert into a workstation defines a baiting attack.
Distinguishing baiting from watering hole or pretexting ensures accurate vector identification.

Key Concept

Baiting Attack Vector
Estimated Time:1m 0s
Question 2130Question →

An aerospace communications operator is updating its cybersecurity governance framework to ensure clear alignment across strategic leadership, system administrators, and third-party operational contractors. Match each governance document type on the left with its corresponding organizational scope and operational requirement on the right.

Click a left item, then click its matching right item

Items

Acceptable Use Policy (AUP)
Technical Security Standard
Security Baseline
Security Guideline

Matches

Show answer & explanation

Answer

Acceptable Use Policy matches the high-level mandatory executive policy governing user behavioral constraints. Technical Security Standard matches the mandatory technical directive specifying explicit controls like cipher suites. Security Baseline matches the mandatory minimum configuration benchmark for system hardening. Security Guideline matches the discretionary document offering best practices and recommendations.
Each governance document type fulfills a distinct level in the governance hierarchy: Policies set high-level executive rules and user boundaries (Acceptable Use Policy); Standards define mandatory technical and cryptographic requirements; Baselines define minimum secure build configurations for systems; and Guidelines provide optional, discretionary recommendations and best practices.

Step-by-Step Solution

1
Analyze the high-level management layer document (Acceptable Use Policy).
Identify that policies are high-level, mandatory executive statements governing organizational usage and user expectations.
Policies set overarching intent and legal/operational boundaries for personnel.
2
Differentiate between mandatory technical requirements and minimum hardening states.
Map Technical Security Standard to mandatory specific cryptographic/technical requirements, and Security Baseline to minimum system configuration benchmarks.
Standards dictate explicit mandatory implementations, whereas baselines establish the minimum hardening bar.
3
Evaluate discretionary documentation versus mandatory documentation.
Map Security Guideline to the discretionary document containing recommended best practices.
Guidelines are unique within policy governance as they are non-mandatory advice rather than enforced requirements.

Key Concept

Security Governance Policy Hierarchy and Document Categorization
Question 2131Question →

An organization's security operations center observes that newly provisioned virtual servers in a public cloud environment consistently lack mandatory security monitoring agents and feature non-standard firewall configurations. An investigation reveals that system administrators are manually launching instances from legacy local image templates instead of using approved central images. Which of the following operational practices should the organization implement to MOST effectively prevent future configuration drift?

Show answer & explanation

Answer: Enforcing automated deployment pipelines that instantiate virtual machines exclusively from version-controlled Infrastructure as Code (IaC) baseline templates

Answer

Enforcing automated deployment pipelines that instantiate virtual machines exclusively from version-controlled Infrastructure as Code (IaC) baseline templates
Automating virtual machine provisioning through version-controlled Infrastructure as Code (IaC) templates ensures that all new cloud instances adhere to predefined, tested security baselines and automatically include required monitoring agents upon deployment.

Step-by-Step Solution

1
Analyze the root cause of the configuration drift identified in the scenario.
The root cause is manual provisioning from unapproved, legacy templates.
Manual processes allow administrators to bypass baseline configurations and deploy non-compliant virtual machines.
2
Evaluate potential solutions against the goal of preventing future drift.
Automated provisioning using Infrastructure as Code (IaC) eliminates manual template selection and enforces baseline compliance across all builds.
IaC defines target state configurations as code, ensuring consistent, repeatable deployments containing all required agents and security settings.

Key Concept

Patch and Configuration Management
Question 2132Question →

A financial firm is onboarding a cloud-based Software-as-a-Service (SaaS) provider to process confidential customer transactions. To maintain governance, the security team needs to contractually enforce defined operational uptime thresholds and mandate strict compliance with data handling responsibilities. Which TWO of the following agreements or contractual components should the firm execute to achieve these specific objectives?

Select all that apply

Show answer & explanation

Answer: Service Level Agreement (SLA); Data Processing Agreement (DPA)

Answer

The correct selections are the Service Level Agreement (SLA) and the Data Processing Agreement (DPA).
Executing both a Service Level Agreement and a Data Processing Agreement directly addresses the organization's requirements. The Service Level Agreement defines quantitative operational metrics such as system uptime and incident response SLAs. The Data Processing Agreement governs privacy responsibilities, subprocessor boundaries, and regulatory compliance obligations regarding sensitive customer data.

Step-by-Step Solution

1
Identify the contractual mechanism required to enforce technical operational metrics such as uptime thresholds.
The Service Level Agreement (SLA) is designed specifically to specify quantitative service availability, response times, and failure penalties.
SLA contracts hold vendors accountable to measurable performance benchmarks.
2
Identify the agreement required to mandate regulatory compliance for privacy and customer data protection.
The Data Processing Agreement (DPA) regulates how sensitive personal data is managed, stored, and processed by the vendor.
DPA terms establish legal boundaries and technical safeguard requirements for customer data processing.

Key Concept

Third-Party Contractual Governance and Risk Agreements
Question 2133Question →

A publicly traded digital media enterprise experiences an unauthenticated API breach exposing non-sensitive server telemetry logs. During incident containment, security analysts discover that the threat actor attempted lateral movement toward backend financial databases, causing a temporary three-hour outage of the core subscription billing microservice before being isolated. The incident response team confirms no customer PII or financial data was exfiltrated. The corporate legal and compliance committee is evaluating reporting requirements under Securities and Exchange Commission (SEC) cyber disclosure mandates. Which of the following factors primary determines whether the enterprise must report this incident on Form 8-K within the required four-business-day timeframe?

Show answer & explanation

Answer: The determination by the organization that the incident has a material financial or operational impact on investors.

Answer

The decision to disclose a cyber incident under SEC regulations hinges on the enterprise's determination of materiality—whether there is a substantial likelihood that a reasonable investor would consider the incident's financial or operational impacts important.
Under SEC cybersecurity disclosure regulations for publicly traded companies, organizations must file a Form 8-K within four business days after determining that a cybersecurity incident is material. Materiality is evaluated based on whether there is a substantial likelihood that a reasonable investor would consider the information important in making an investment decision, taking into account financial, operational, and reputational impacts.

Step-by-Step Solution

1
Identify the relevant regulatory authority and rule context.
The scenario asks about disclosure obligations for a publicly traded company under United States Securities and Exchange Commission (SEC) rules.
SEC cybersecurity rules mandate standardized reporting requirements for publicly traded entities.
2
Analyze the statutory disclosure trigger for SEC Form 8-K Item 1.05.
Public companies are required to disclose any cybersecurity incident within four business days once the organization determines the incident is 'material.'
Materiality considers both quantitative (financial losses, operational costs) and qualitative factors (operational disruption, reputational harm) that affect investor decisions.
3
Evaluate the scenario specifics against the correct regulatory threshold.
Even though no PII was stolen, the operational billing outage and lateral movement attempt must be evaluated for materiality. The determination of materiality itself triggers the 4-day clock.
Technical details (log size, intrusion depth) feed into the materiality assessment but are not the legal trigger itself.

Key Concept

Regulatory Compliance and Legal Requirements Management
Estimated Time:2m 0s
Question 2134Question →

A healthcare organization is reviewing third-party compliance documentation for a cloud-based medical billing platform. The compliance team specifically requires independent verification that the vendor's internal controls over financial reporting (ICFR) operating within the platform are effectively designed and operating as intended over time. Which of the following audit reports should the organization request to satisfy this requirement?

Show answer & explanation

Answer: SOC 1 Type II report

Answer

SOC 1 Type II report
The SOC 1 Type II report is specifically designed to assess a third-party service provider's controls that are relevant to a user entity's internal control over financial reporting (ICFR). The Type II designation confirms that an independent auditor evaluated both the suitability of the control design and its operating effectiveness over a specified testing window.

Step-by-Step Solution

1
Analyze the compliance requirement scope
The scenario requires evaluation of internal controls over financial reporting (ICFR).
Distinguishing financial reporting controls from general cybersecurity criteria determines the appropriate audit standard.
2
Select the correct SOC report category
SOC 1 reports (SSAE 18) are specifically designated for service organization controls impacting financial reporting.
SOC 2 and SOC 3 focus on operational security trust criteria rather than financial accounting controls.
3
Determine the required report depth
A Type II report validates both design suitability and operating effectiveness over a period of time.
The scenario specifically demands proof that controls operated effectively over time.

Key Concept

SOC 1 vs SOC 2 Scope and Attestation Types
Question 2135Question →

An enterprise organization is enhancing its supply chain security and vendor governance program to address risks associated with third-party software, hardware, and service providers. Match each vendor oversight mechanism or contractual control on the left to its corresponding supply chain risk management purpose on the right.

Click a left item, then click its matching right item

Items

Fourth-Party Subprocessor Flow-Down Clause
Hardware Origin and Provenance Verification
Software Bill of Materials (SBOM)
Right-to-Audit Contractual Provision

Matches

Show answer & explanation

Answer

The correct pairings align each third-party risk management mechanism with its supply chain oversight objective: Fourth-Party Subprocessor Flow-Down Clause matches enforcing security requirements across downstream sub-tier service providers; Hardware Origin and Provenance Verification matches preventing counterfeit parts and hardware modifications via chain-of-custody tracking; Software Bill of Materials (SBOM) matches providing visibility into software components and dependencies; and Right-to-Audit Contractual Provision matches granting authority to perform independent security reviews and physical inspections.
Each vendor oversight control targets a distinct vector in supply chain risk management: subprocessor flow-down provisions manage downstream fourth-party risk; hardware provenance verification prevents physical counterfeit and tampering threats; SBOMs provide transparency into application software dependencies; and right-to-audit terms permit formal assessment of vendor compliance.

Step-by-Step Solution

1
Analyze third-party software inventory and component visibility controls.
Identify that a Software Bill of Materials (SBOM) lists software libraries and dependencies to help track supply chain vulnerabilities.
SBOMs exist to provide comprehensive transparency into nested software dependencies.
2
Evaluate downstream contract management and auditing rights.
Match the Fourth-Party Subprocessor Flow-Down Clause to extending security mandates to downstream subcontractors, and the Right-to-Audit Clause to granting audit rights.
Flow-down clauses manage fourth-party (vendor's vendor) exposure while audit clauses establish legal rights to inspect primary vendors.
3
Examine physical supply chain integrity mechanisms for network devices and components.
Link Hardware Origin and Provenance Verification to anti-counterfeit measures and chain-of-custody tracking.
Hardware provenance focuses on verifying authentic component sourcing and preventing hardware tampering in transit.

Key Concept

Supply Chain Oversight and Third-Party Governance Controls
Question 2136Question →

A security administrator is refining the Public Key Infrastructure (PKI) deployment for an enterprise RADIUS server supporting 802.1X EAP-TLS authentication. Mobile clients connecting over high-latency cellular links experience frequent authentication timeouts caused by real-time Certificate Revocation List (CRL) downloads. To optimize client authentication performance and ensure secure server identity verification, which of the following mechanisms or configurations should the administrator implement? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Enable OCSP stapling on the RADIUS server to deliver signed revocation status directly within the TLS handshake.; Configure the server certificate with Subject Alternative Name (SAN) extensions and Server Authentication Extended Key Usage (EKU) attributes.

Answer

The correct configurations are enabling OCSP stapling on the server to provide direct revocation status during the TLS handshake, and configuring the server certificate with proper Subject Alternative Name (SAN) and Extended Key Usage (EKU) attributes.
Enabling OCSP stapling shifts the burden of fetching revocation status to the server, which attaches a time-stamped OCSP response signed by the CA directly inside the TLS handshake, eliminating out-of-band client network requests. Additionally, configuring Subject Alternative Name (SAN) and Extended Key Usage (EKU) attributes ensures that clients can validate server identity and authorized usage roles per EAP-TLS standards.

Step-by-Step Solution

1
Identify performance bottleneck in PKI revocation checking for mobile clients.
Real-time CRL downloads cause network overhead and connection timeouts on high-latency links.
Downloading complete CRL files requires separate client-side HTTP/LDAP requests.
2
Select server-side status optimization technique.
OCSP stapling caches a signed revocation assertion on the server and includes it during the TLS handshake.
This removes the requirement for the client to contact an external OCSP responder or download large CRLs.
3
Ensure server certificate configuration supports 802.1X identity validation.
Proper SAN entries and EKU attributes (Server Authentication) allow clients to verify server identity without certificate validation errors.
EAP-TLS clients strictly validate server purpose and hostname alignment.

Key Concept

Public Key Infrastructure, OCSP Stapling, and Certificate Extensions
Question 2137Question →

A financial technology firm's executive board issues a high-level directive requiring all employee remote access connections to utilize multi-factor authentication. To implement this directive across the organization, the security operations team must publish a mandatory document that defines the specific technical controls and required configuration rules for all remote access gateways. Which governance document type should the team publish to establish these mandatory requirements?

Show answer & explanation

Answer: Security Standard

Answer

Security Standard
A security standard translates high-level policy objectives into specific, mandatory technical rules and configuration requirements that technical teams must adhere to.

Step-by-Step Solution

1
Analyze the scenario requirements
The requirement demands a mandatory governance document that defines specific technical requirements and configuration rules to fulfill an executive policy directive.
Governance document types exist in a strict hierarchy based on authority, enforcement status, and technical granularity.
2
Evaluate the distinction between policy hierarchy documents
Policies state high-level management intent. Standards translate high-level policies into mandatory, non-negotiable technical requirements and configuration rules.
Technical teams require enforceable standards to ensure consistent application of mandatory security controls across all systems.

Key Concept

Security Standards vs. Guidelines, Policies, and Procedures
Question 2138Question →

A security analyst is classifying enterprise defense mechanisms according to CompTIA Security+ implementation categories (Technical, Managerial, Operational, Physical) and functional control types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive). Match each security scenario on the left with its primary dual-axis security control classification on the right.

Click a left item, then click its matching right item

Items

Deploying an automated web application firewall (WAF) to inspect and block malicious payload traffic before reaching internal web servers
Posting prominent warning notices detailing legal prosecution along the perimeter fence of a secure datacenter
Performing manual data restoration procedures from clean off-site backups following a ransomware compromise
Establishing a corporate security administrative policy requiring employees to sign an Acceptable Use Policy (AUP) during onboarding

Matches

Show answer & explanation

Answer

Web Application Firewall (WAF) filtering maps to Technical / Preventive; Warning notices along the perimeter fence map to Physical / Deterrent; Data restoration from backups maps to Operational / Corrective; Acceptable Use Policy (AUP) onboarding requirement maps to Managerial / Directive.
Each mechanism aligns precisely with standard CompTIA Security+ SY0-701 definitions: WAF operates logically in software to prevent attacks (Technical/Preventive); perimeter signs are tangible physical measures designed to deter trespassers (Physical/Deterrent); restoring backups requires personnel operational procedures to fix post-attack damage (Operational/Corrective); and AUP requirements represent managerial policy governance that directs compliant user behavior (Managerial/Directive).

Step-by-Step Solution

1
Analyze the web application firewall (WAF) deployment.
Identified as a logic/software control (Technical) that blocks attack vectors before impact (Preventive).
Technical controls utilize hardware/software mechanisms, while preventive controls proactively halt threat execution.
2
Analyze the warning signage along the perimeter fence.
Identified as a tangible real-world control (Physical) designed to discourage intruders (Deterrent).
Physical controls exist in the physical environment, while deterrent controls aim to dissuade potential attackers through psychological disincentives.
3
Analyze the data restoration process from backups post-ransomware.
Identified as a human-driven operational procedure (Operational) that restores system state after an incident (Corrective).
Operational controls depend on day-to-day human execution and workflows, while corrective controls mitigate damage and restore operations.
4
Analyze the onboarding Acceptable Use Policy (AUP) requirement.
Identified as administrative governance (Managerial) enforcing mandatory behavior (Directive).
Managerial controls center on security governance, risk assessment, and policies, while directive controls mandate specific conduct.

Key Concept

CompTIA Security+ dual-axis classification framework categorizes security controls by implementation method (Technical, Managerial, Operational, Physical) and functional purpose (Preventive, Deterrent, Detective, Corrective, Compensating, Directive).
Question 2139Question →

A manufacturing enterprise is performing a quantitative risk assessment on its automated build pipeline server fleet. The fleet has an Asset Value (AVAV) of $350,000\$350,000. A risk analysis team determines that a supply chain compromise would yield an Exposure Factor (EFEF) of 30%30\%. Threat intelligence estimates the Annualized Rate of Occurrence (AROARO) for such an attack to be 0.500.50 (occurring once every two years).

What is the Annual Loss Expectancy (ALEALE) in dollars for this asset?

Show answer & explanation

Answer: 52500

Answer

The Annual Loss Expectancy (ALE) is $52,500.
To calculate the Annual Loss Expectancy (ALEALE), first determine the Single Loss Expectancy (SLE=AV×EFSLE = AV \times EF). With an Asset Value (AVAV) of $350,000\$350,000 and an Exposure Factor (EFEF) of 30%30\% (0.300.30), SLE=$350,000×0.30=$105,000SLE = \$350,000 \times 0.30 = \$105,000. Multiplying SLESLE by the Annualized Rate of Occurrence (ARO=0.50ARO = 0.50) gives ALE=$105,000×0.50=$52,500ALE = \$105,000 \times 0.50 = \$52,500.

Step-by-Step Solution

1
Calculate the Single Loss Expectancy (SLE)
$105,000
SLE measures the dollar loss expected each time a risk event occurs by multiplying Asset Value (AVAV) by Exposure Factor (EFEF): $350,000×0.30=$105,000\$350,000 \times 0.30 = \$105,000.
2
Calculate the Annual Loss Expectancy (ALE)
$52,500
ALE represents the overall annual financial impact of the risk by multiplying Single Loss Expectancy (SLESLE) by the Annualized Rate of Occurrence (AROARO): $105,000×0.50=$52,500\$105,000 \times 0.50 = \$52,500.

Key Concept

Quantitative Risk Assessment (ALE Calculation)
Estimated Time:1m 30s
Question 2140Question →

A satellite communications provider is formalizing its enterprise security oversight framework following a regulatory audit. Security analysts must properly categorize governance artifacts to establish clear organizational hierarchy. Match each security governance document type on the left with its defining operational characteristic on the right.

Click a left item, then click its matching right item

Items

Security Policy
Security Standard
Security Baseline
Security Guideline

Matches

Show answer & explanation

Answer

Security Policy matches the high-level executive directive; Security Standard matches mandatory uniform technical requirements; Security Baseline matches minimum configuration state; Security Guideline matches discretionary recommendations.
In security governance hierarchy, policies dictate high-level executive intent, standards enforce mandatory technical specifications, baselines define minimum technical system configurations, and guidelines provide non-mandatory best practices.

Step-by-Step Solution

1
Identify top-level authority documents.
Map Security Policy to high-level management directives establishing strategic goals.
Policies represent high-level managerial intent and set foundational security scope.
2
Distinguish mandatory requirements from minimum system states.
Map Security Standard to mandatory technical requirements/metrics and Security Baseline to minimum deployment configuration states.
Standards dictate mandatory rules, while baselines set specific platform configuration minimums.
3
Identify non-mandatory governance elements.
Map Security Guideline to discretionary recommendations and operational advice.
Guidelines provide non-binding recommendations where flexibility is permitted.

Key Concept

Hierarchy of Security Governance Documents
Estimated Time:1m 30s
PreviousPage 107 / 112Next
All practice questions — CompTIA Security+ | Examkin