All practice questions

2232 questions

All types2,232 Multiple choice1,151 Multiple select509 Numeric21 Matching378 Ordering173

A security analyst is reviewing the transport layer cryptographic configuration for a high-security financial microservice. The service requirements dictate that even if an adversary compromises the server's long-term private key in the future, previously intercepted session traffic must remain unencrypted and unreadable. Which cryptographic mechanism should be implemented to satisfy this requirement?

Perfect Forward Secrecy utilizing ephemeral key exchange mechanisms such as ECDHE

Symmetric bulk data encryption using AES-256 in Cipher Block Chaining (CBC) mode

Cryptographic hash functions using SHA-256 to ensure data integrity

Static RSA certificate generation via a Certificate Signing Request to a trusted CA

Show answer & explanation

Answer: Perfect Forward Secrecy utilizing ephemeral key exchange mechanisms such as ECDHE

Answer

Perfect Forward Secrecy utilizing ephemeral key exchange mechanisms such as ECDHE

The correct option specifies Perfect Forward Secrecy (PFS) with ephemeral key exchange (such as ECDHE). PFS ensures that session keys are generated dynamically for each communication session and deleted afterwards. Even if an attacker obtains the server's long-term private key in the future, they cannot calculate past session keys or decrypt previously intercepted traffic.

Step-by-Step Solution

Analyze the core security requirement stated in the scenario

Identified requirement: Protecting past recorded traffic from decryption if long-term server private keys are compromised in the future.

This requirement specifically describes the property of Perfect Forward Secrecy (PFS).

Evaluate cryptographic mechanisms against the PFS requirement

Ephemeral Diffie-Hellman key exchanges (e.g., ECDHE) generate temporary, single-session keys that are discarded after use, ensuring that compromised long-term private keys cannot decrypt past sessions.

Static key exchange algorithms (like RSA static exchange) decrypt secrets directly using the long-term private key, failing the requirement.

Select the option that implements ephemeral key exchange

The option specifying Perfect Forward Secrecy utilizing ephemeral key exchange mechanisms (ECDHE) directly fulfills the requirement.

It prevents retrospective decryption of intercepted communication streams.

Key Concept

Perfect Forward Secrecy (PFS) and Ephemeral Key Exchange

Question 1762Question →

During a routine compliance audit, a security team discovers that network edge firewalls across several branch offices frequently deviate from approved hardening standards. Investigation reveals that local technicians frequently perform out-of-band emergency modifications to resolve service outages, which are never synchronized back to the central repository. Which of the following technical and procedural controls should the security team implement to resolve configuration drift and ensure ongoing baseline compliance? (Select TWO.)

Select all that apply

Deploy an automated configuration management tool to continuously monitor appliances and enforce authorized baseline templates.

Implement host-based intrusion prevention agents on the edge firewalls to block local administrative access attempts during outages.

Establish a formal change management procedure requiring emergency modifications to undergo post-implementation review and baseline updates.

Reclassify configuration baseline documentation from mandatory operational standards to non-binding security guidelines.

Configure access control lists on perimeter firewalls to block all inbound administrative traffic from remote management subnets.

Show answer & explanation

Answer: Deploy an automated configuration management tool to continuously monitor appliances and enforce authorized baseline templates.; Establish a formal change management procedure requiring emergency modifications to undergo post-implementation review and baseline updates.

Answer

The organization should implement automated configuration management to continuously monitor baseline compliance and establish a formal change management procedure for documenting emergency hotfixes.

Remediating uncoordinated configuration drift requires a combination of technical automation and governance. Deploying automated configuration management software continuously validates device states against defined templates and remediates unauthorized drift. Concurrently, establishing a formal change management process ensures emergency hotfixes undergo retroactive review so valid changes are synchronized back into baseline configurations.

Step-by-Step Solution

Identify technical controls capable of detecting and remediating configuration drift across distributed devices.

Automated configuration management tools provide continuous auditing and enforcement against standardized baselines.

Automation eliminates reliance on manual audits and ensures devices remain aligned with baseline security templates.

Identify administrative controls to manage out-of-band maintenance activities.

A mandatory change management review process reconciles emergency manual fixes with official central configuration records.

Procedural alignment ensures authorized operational changes are captured in future baseline revisions.

Key Concept

Configuration Drift and Remediation Controls

Estimated Time:1m 30s

Question 1763Question →

A Chief Information Security Officer (CISO) at a global logistics firm is updating the corporate cybersecurity governance framework to clarify the enforceability of various security documents. Which of the following governance document types establish MANDATORY compliance requirements that enterprise personnel must follow? (Select TWO)

Select all that apply

Information Security Policy defining acceptable data handling and employee security responsibilities

Enterprise Encryption Standard specifying approved algorithms, minimum key lengths, and cipher suites

Remote Work Best Practices Guideline outlining recommended home network configurations for teleworkers

Incident Response Playbook detailing step-by-step technical execution steps for firewall isolation

Privileged Access Authorization Matrix mapping individual user permissions to administrative roles

Show answer & explanation

Answer: Information Security Policy defining acceptable data handling and employee security responsibilities; Enterprise Encryption Standard specifying approved algorithms, minimum key lengths, and cipher suites

Answer

The governance document types that establish mandatory compliance requirements are the Information Security Policy defining acceptable data handling and the Enterprise Encryption Standard specifying approved algorithms and key lengths.

In security governance frameworks, both policies and standards carry mandatory compliance obligations. An Information Security Policy serves as an executive mandate that sets high-level organizational security goals and expectations. An Enterprise Encryption Standard establishes compulsory technical specifications (such as mandatory key lengths and approved algorithms) required to achieve the policy objectives.

Step-by-Step Solution

Analyze the hierarchy of governance documentation and determine the intent of each document type.

Identify that policies provide high-level management directives, standards provide mandatory technical/operational specifications, guidelines provide discretionary recommendations, and procedures provide step-by-step execution instructions.

Understanding document authority distinguishes compulsory compliance items from optional or procedural references.

Evaluate the choices to isolate documents with mandatory status across the enterprise.

Information Security Policies and Enterprise Encryption Standards both carry compulsory compliance requirements.

Policies and standards are explicitly enforceable across organizational boundaries, whereas guidelines are discretionary and playbooks are task-level procedures.

Key Concept

Security Governance Hierarchy (Policies and Standards as Mandatory Directives vs Guidelines and Procedures)

Question 1764Question →

A security analyst at a financial institution is conducting a vendor risk assessment for a prospective software-as-a-service (SaaS) human resources platform. The vendor provides a SOC 1 Type II report to demonstrate financial reporting integrity. However, the analyst must verify the operational effectiveness of the vendor's data encryption, system availability, and confidentiality controls over the past 12 months. Which attestation deliverable should the analyst request from the vendor?

SOC 2 Type II report

SOC 1 Type I report

SOC 2 Type I report

SOC 3 report

Show answer & explanation

Answer: SOC 2 Type II report

Answer

The analyst should request a SOC 2 Type II report.

A SOC 2 Type II report assesses a service organization's controls based on the AICPA Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) and verifies their operational effectiveness over a sustained period of time (typically 6 to 12 months).

Step-by-Step Solution

Identify the evaluation scope required by the analyst.

The requirement focuses on data encryption, system availability, and confidentiality controls (Trust Services Criteria), not internal controls over financial reporting.

This rules out SOC 1 reports, which focus exclusively on financial reporting controls.

Determine the time period requirement for the evaluation.

The requirement calls for verifying operational effectiveness over the past 12 months (a specified period).

Type I reports only assess design suitability at a single point in time, whereas Type II reports test operational effectiveness over a period of time.

Select the deliverable that contains detailed technical testing results.

A SOC 2 Type II report provides detailed testing procedures, results, and operational effectiveness evaluation for security criteria over a period.

SOC 3 reports are high-level summary documents intended for public distribution and lack the detailed technical testing evidence needed for vendor security vetting.

Key Concept

SOC 2 Type II Attestation Reports

Question 1765Question →

A biotechnology firm operates an automated gene-sequencing platform with an estimated Asset Value ( $AV$ ) of $\$1,500,000$ . Security analysts assess that a major malware incident would result in an Exposure Factor ( $EF$ ) of $0.30$ . Threat intelligence estimates the Annual Rate of Occurrence ( $ARO$ ) for such an incident to be $0.20$ (once every 5 years). What is the expected Annual Loss Expectancy ( $ALE$ ) associated with this risk?

\$90,000

\$300,000

\$450,000

\$2,250,000

Show answer & explanation

Answer: $\$90,000$

Answer

The Annual Loss Expectancy (

ALE

) is

\$90,000

The correct calculation follows quantitative risk assessment formulas: first, find Single Loss Expectancy using

SLE = AV \times EF = \$1,500,000 \times 0.30 = \$450,000

. Next, calculate Annual Loss Expectancy using

ALE = SLE \times ARO = \$450,000 \times 0.20 = \$90,000

Step-by-Step Solution

Calculate Single Loss Expectancy (SLE)

SLE = AV \times EF = \$1,500,000 \times 0.30 = \$450,000

SLE represents the total monetary loss expected each time a specific threat is realized against the asset.

Calculate Annual Loss Expectancy (ALE)

ALE = SLE \times ARO = \$450,000 \times 0.20 = \$90,000

ALE provides the expected financial loss per year by factoring in how frequently the incident occurs annually.

Key Concept

Quantitative Risk Assessment (ALE Calculation)

Question 1766Question →

An enterprise organization is updating its software supply chain oversight procedures. To prevent vulnerable open-source dependencies from entering its production environment, the security team requires third-party software providers to submit a formal, machine-readable inventory detailing all sub-components, libraries, and module versions included in their software releases. Which of the following artifacts should the security administrator mandate from vendors to satisfy this requirement?

Software Bill of Materials (SBOM)

Business Associate Agreement (BAA)

Service Level Agreement (SLA)

Hardware Security Module (HSM) attestation

Show answer & explanation

Answer: Software Bill of Materials (SBOM)

Answer

The Software Bill of Materials (SBOM) is the required artifact because it provides a complete, machine-readable inventory of software components and third-party dependencies.

Requiring a Software Bill of Materials (SBOM) provides the organization with a standard, machine-readable manifest listing all software components, third-party libraries, and dependencies. This enables security teams to quickly query and assess supply chain risk when new vulnerabilities are reported in shared libraries.

Step-by-Step Solution

Analyze the organizational requirement for third-party supply chain oversight.

The requirement specifies obtaining a machine-readable nested inventory of sub-components, libraries, and module versions within vendor software releases.

Tracking software dependencies is essential to identify zero-day or inherited open-source vulnerabilities across the supply chain.

Evaluate third-party agreement and operational documentation types against this specific requirement.

A Software Bill of Materials (SBOM) explicitly serves as a comprehensive manifest of all components and dependencies built into a software product.

Other artifacts focus on legal compliance (BAA), operational availability (SLA), or hardware cryptoprocessing (HSM attestation) rather than software composition analysis.

Key Concept

Software Bill of Materials (SBOM) for Supply Chain Oversight

Question 1767Question →

A security engineer is updating the organization's cryptographic policy to cover emerging operational scenarios including IoT deployments, cloud analytics, secure password storage, and covert communication detection. Match each cryptographic concept on the left with its primary operational characteristic or security use case on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Key Stretching matches with intentionally increasing CPU/memory costs to slow down brute-force attacks; Homomorphic Encryption matches with executing computations directly on ciphertext without decryption; Lightweight Cryptography matches with optimizing ciphers for resource-constrained IoT devices; Steganography matches with concealing secret data within innocuous carrier files.

Key Stretching intentionally adds computational cost to mitigate password cracking; Homomorphic Encryption enables computations on ciphertext without prior decryption; Lightweight Cryptography reduces hardware and power requirements for IoT devices; Steganography hides payloads inside innocent carrier files.

Step-by-Step Solution

Analyze the operational objective of Key Stretching.

Identify that functions like PBKDF2 or bcrypt introduce computational delay (work factor) during key generation or hashing to thwart offline dictionary attacks.

Slowing down hash calculations directly mitigates rapid brute-forcing.

Analyze Homomorphic Encryption capabilities.

Recognize that it preserves confidentiality during data processing by enabling mathematical operations directly on encrypted values.

This secures data-in-use during cloud analytics.

Analyze Lightweight Cryptography constraints.

Identify that algorithms such as ASCON or PRESENT are tailored specifically for small silicon footprints and microcontrollers with low memory and power availability.

Standard ciphers like AES-256 can be too resource-intensive for small embedded hardware.

Analyze Steganography features.

Determine that steganography hides data within cover media (e.g., LSB insertion in images) to prevent observation of the transmission.

Unlike standard encryption which makes data unreadable, steganography hides the presence of the data altogether.

Key Concept

Cryptographic Concepts and Specialized Implementation Paradigms

Estimated Time:1m 30s

Question 1768Question →

An enterprise facility installs biometric fingerprint readers on all access doors leading into its main server room to explicitly prevent unauthorized personnel from physically touching server hardware. How should the security team classify this access mechanism based on CompTIA Security+ control category and functional type definitions?

Physical category and Preventive functional type

Physical category and Detective functional type

Technical category and Preventive functional type

Managerial category and Directive functional type

Show answer & explanation

Answer: Physical category and Preventive functional type

Answer

Physical category and Preventive functional type

The classification as Physical and Preventive is correct because physical door access hardware restricts tangible access to facilities (Physical category) and actively blocks unauthorized personnel from gaining entry (Preventive functional type).

Step-by-Step Solution

Determine the security control category based on implementation domain

Because fingerprint scanners are physical hardware devices securing tangible facility infrastructure (server room doors), the control falls into the Physical category.

Control categories distinguish between Technical (logical/software), Managerial (administrative/policy), Operational (human processes), and Physical (facility/tangible) security elements.

Determine the functional control type based on intended operation

Because the mechanism actively denies entry to unauthenticated individuals, it serves a Preventive function.

Preventive controls aim to deter or actively stop security breaches before they occur, unlike Detective controls which identify active or past incidents.

Key Concept

Classification of security controls by category (Technical, Managerial, Operational, Physical) and functional type (Preventive, Detective, Corrective, Deterrent, Compensating, Directive).

Question 1769Question →

Following an infrastructure update, a security team conducts an external unauthenticated vulnerability scan against an enterprise web server. The report highlights several critical kernel vulnerabilities based on the software version header returned by the web service. However, host-based agent logs confirm the operating system was fully patched, and the service header was intentionally customized for version obfuscation. Which of the following best accounts for the high-severity findings in the external scan report?

The unauthenticated scan relied on banner grabbing, producing a false positive due to modified version headers.

The web server firewall acted as a compensating control that dynamically patched the kernel during the external test.

The host-based agent misclassified the network service as a client-side script execution vulnerability.

The external vulnerability scanner operated as a detective control that actively exploited the host memory.

Show answer & explanation

Answer: The unauthenticated scan relied on banner grabbing, producing a false positive due to modified version headers.

Answer

The external scan produced a false positive because unauthenticated banner grabbing inferred vulnerabilities from customized version headers rather than actual system patch levels.

Unauthenticated vulnerability scans perform banner grabbing to infer software versions from service responses. When version headers are customized or obfuscated for security through obscurity, the scanner misinterprets the header as an unpatched release, creating a false positive. Authenticated scans or local agent audits provide accurate verification by directly checking installed software patches.

Step-by-Step Solution

Analyze the scan methodology and findings

The external scan was unauthenticated and relied on remote service responses (banner grabbing).

Unauthenticated scanners assess remote targets by inspecting exposed software headers and protocol responses.

Compare external findings with authenticated host agent logs

The host-based agent verified that all kernel patches were applied, while the external banner was customized.

Credentialed host agents verify patch status directly from system configuration and file metadata rather than network banners.

Determine the root cause of the discrepancy

Obfuscated banner headers caused the external scanner to report false positive vulnerabilities.

Discrepancies between remote version headers and underlying patch levels frequently trigger false positive alerts in unauthenticated assessments.

Key Concept

Credentialed vs. Unauthenticated Scanning and False Positive Identification

Question 1770Question →

An enterprise cloud service provider assesses a critical customer database system with an estimated Asset Value ( $AV$ ) of $\$1,200,000$ . Quantitative risk analysis indicates that an unmitigated database security breach has an Annual Rate of Occurrence ( $ARO$ ) of $0.40$ and results in an Annual Loss Expectancy ( $ALE$ ) of $\$144,000$ . What is the Exposure Factor ( $EF$ ), expressed as a percentage, for this potential security incident?

Show answer & explanation

Answer: 30

Answer

The Exposure Factor (

EF

) for this security incident is

30\%

To calculate the Exposure Factor (

EF

), apply the core quantitative risk equations:

ALE = SLE \times ARO

and

SLE = AV \times EF

. Substituting the known variables into

SLE = \frac{ALE}{ARO}

yields

SLE = \frac{\$144,000}{0.40} = \$360,000

. Next, substitute

SLE

into

EF = \frac{SLE}{AV}

to obtain

EF = \frac{\$360,000}{\$1,200,000} = 0.30

, or

30\%

Step-by-Step Solution

Calculate Single Loss Expectancy (SLE) from ALE and ARO.

SLE = \frac{\$144,000}{0.40} = \$360,000

The standard formula for Annual Loss Expectancy is

ALE = SLE \times ARO

. Rearranging the equation to isolate

SLE

yields

SLE = \frac{ALE}{ARO}

Calculate Exposure Factor (EF) using Asset Value (AV) and SLE.

EF = \frac{\$360,000}{\$1,200,000} = 0.30 = 30\%

Single Loss Expectancy is calculated as

SLE = AV \times EF

. Rearranging to solve for

EF

gives

EF = \frac{SLE}{AV}

Key Concept

Quantitative Risk Assessment (Calculating Exposure Factor from ALE, ARO, and AV)

Question 1771Question →

An enterprise security risk manager for a municipal smart grid utility is finalizing Business Impact Analysis (BIA) parameters and recovery strategies for two key systems: the real-time SCADA control network and the customer metering telemetry database. Which of the following statements accurately characterize the operational metrics or recovery dependencies established during this assessment? (Select TWO.)

Select all that apply

Establishing a Recovery Point Objective (RPO) of near-zero for the SCADA control network ensures that operational state changes and switching logs suffer minimal to no data loss during an unannounced failover.

Defining a Maximum Tolerable Downtime (MTD) for the telemetry database establishes the maximum timeframe the organization can sustain an outage before experiencing irreversible loss or regulatory failure.

Setting a Recovery Time Objective (RTO) of 15 minutes for the telemetry database guarantees that no transaction records created during the 15 minutes prior to a failure will be lost.

Deploying an automated redundant failover site for the control management application serves as a preventive control designed to reduce the inherent likelihood of primary site physical disruptions.

Show answer & explanation

Answer: Establishing a Recovery Point Objective (RPO) of near-zero for the SCADA control network ensures that operational state changes and switching logs suffer minimal to no data loss during an unannounced failover.; Defining a Maximum Tolerable Downtime (MTD) for the telemetry database establishes the maximum timeframe the organization can sustain an outage before experiencing irreversible loss or regulatory failure.

Answer

The correct options state that establishing a near-zero Recovery Point Objective (RPO) minimizes data loss for real-time SCADA logs, and that defining Maximum Tolerable Downtime (MTD) sets the absolute upper threshold of acceptable system outage duration before severe impact occurs.

The statements highlighting near-zero RPO for SCADA logs and the boundary role of MTD are correct. RPO specifies the temporal threshold of data loss an enterprise can tolerate, making near-zero RPO appropriate for volatile real-time SCADA state logs. MTD establishes the absolute maximum operational downtime permissible before catastrophic consequences occur.

Step-by-Step Solution

Analyze the definitions and functions of core BIA metrics (RPO, RTO, MTD) within enterprise continuity planning.

Identified that RPO addresses acceptable data loss timeframes, while MTD defines maximum operational outage limits.

Accurate metrics categorization is required to evaluate BIA recovery targets.

Evaluate the statement regarding near-zero RPO for SCADA logs.

Confirmed true: RPO dictates maximum allowable data loss timeframe, which for high-priority SCADA state changes must be near zero.

SCADA systems require continuous transaction state retention to avoid dangerous operational desynchronization.

Evaluate the statement regarding MTD for the telemetry database.

Confirmed true: MTD represents the maximum allowable outage time before severe, irreparable business damage occurs.

MTD establishes the overarching time limit that bounds both RTO and Work Recovery Time (WRT).

Examine distractors for conceptual errors.

Rejected the RTO data loss statement because RTO measures recovery speed after an event, not pre-event data loss (which is RPO). Rejected the redundant site classification statement because failover clustering is a corrective/recovery control rather than a preventive control that reduces disaster probability.

Distractors confuse recovery timing definitions and security control categories.

Key Concept

Business Impact Analysis Metrics and Recovery Controls

Question 1772Question →

A security analyst is investigating a multi-vector social engineering campaign targeting an organization's accounting department. The incident report highlights two distinct activities: first, an attacker placed a direct phone call to a payroll clerk, posing as an executive and demanding an immediate wire transfer; second, several accountants received SMS text messages on their corporate mobile devices containing links to a fraudulent login page designed to harvest credentials. Which of the following social engineering attack vectors were executed during this campaign? (Select TWO.)

Select all that apply

Vishing (voice phishing) targeting the payroll clerk via direct telephone communications.

Smishing (SMS phishing) targeting accounting staff through text messages.

Watering hole attack compromising a third-party payroll vendor website.

Typosquatting utilizing fraudulent domain names to misdirect web browser traffic.

Show answer & explanation

Answer: Vishing (voice phishing) targeting the payroll clerk via direct telephone communications.; Smishing (SMS phishing) targeting accounting staff through text messages.

Answer

Vishing (voice phishing) targeting the payroll clerk via direct telephone communications, and Smishing (SMS phishing) targeting accounting staff through text messages.

The campaign incorporated vishing because the attacker initiated telephone calls to impersonate an executive, leveraging voice communication. Additionally, smishing was executed through SMS text messages delivered to employee mobile devices containing malicious credential harvesting links.

Step-by-Step Solution

Analyze the first incident activity involving telephone communications.

The attacker used direct voice calls to impersonate an executive, which corresponds directly to vishing (voice phishing).

Vishing specifies telephone or voice-based social engineering.

Analyze the second incident activity involving text messages sent to mobile phones.

The attacker sent SMS messages with credential-harvesting links, which corresponds directly to smishing (SMS phishing).

Smishing is defined by using SMS messages as the primary delivery vector.

Key Concept

Distinguishing social engineering vectors based on communication medium (voice vs. SMS text message)

Estimated Time:1m 30s

Question 1773Question →

A network security monitoring sensor positioned at a cloud perimeter captures the following HTTP payload in a triggered NIDS alert log:

http
POST /api/v1/auth/login HTTP/1.1
Host: portal.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

user=admin%27%20OR%20%271%27%3D%271&pass=secret

The NIDS rule signature incorrectly labeled the alert as a generic client-side scripting event. Which of the following correctly identifies the actual threat vector represented by this payload and its primary objective?

Cross-Site Scripting (XSS) attempting to execute malicious client-side scripts inside the administrative user browser session.

SQL Injection attempting to alter backend database query logic to bypass authentication controls.

A network-level buffer overflow attempting to corrupt web server process memory to execute arbitrary shellcode.

A deception honeypot interaction attempting to capture credentials for threat intelligence collection.

Show answer & explanation

Answer: SQL Injection attempting to alter backend database query logic to bypass authentication controls.

Answer

SQL Injection attempting to alter backend database query logic to bypass authentication controls.

The correct option accurately identifies the payload `admin' OR '1'='1` as a SQL injection attack. URL decoding `%27` reveals single quotation marks used to break out of the SQL data field context and force the query statement to evaluate as true, thereby bypassing authentication logic at the database layer.

Step-by-Step Solution

Decode the HTTP POST body payload from URL encoding.

The decoded string reads `user=admin' OR '1'='1&pass=secret`.

URL encoding hides character syntax such as `%27` representing a single quote `'` and `%20` representing spaces.

Analyze the structural intent of the decoded payload against web attack types.

The insertion of `' OR '1'='1` forces an inline database SQL query statement to always evaluate as true.

This signature is characteristic of SQL Injection targeting relational database backend verification rather than browser-rendered scripts (XSS).

Key Concept

Identifying SQL Injection alert signatures in network traffic monitoring

Question 1774Question →

An enterprise security team is establishing formal documentation for employee mobile devices connecting to the corporate network. Management mandates a technical document that defines enforced minimum security parameters, including mandatory AES-256 storage encryption, minimum operating system patch levels, and a mandatory 12-character passcode length. Which type of security governance document should be published to enforce these mandatory minimum technical configurations?

A security baseline

A security guideline

An acceptable use policy

A standard operating procedure

Show answer & explanation

Answer: A security baseline

Answer

A security baseline is the governance document used to specify mandatory minimum configuration standards and technical benchmarks across systems or devices.

A security baseline establishes compulsory minimum configuration requirements and security benchmarks that systems or devices must meet prior to network deployment.

Step-by-Step Solution

Identify the nature of the requirements described in the scenario

The scenario requires establishing mandatory minimum technical settings (encryption algorithm, OS version, password length) for endpoints.

Security governance documents are categorized by whether they set high-level directives, operational steps, mandatory technical benchmarks, or discretionary suggestions.

Map the technical requirement to the correct governance hierarchy tier

Minimum technical configurations and security hardening settings correspond directly to a security baseline.

Baselines serve as the mandatory threshold for system builds and hardware provisioning across an organization.

Key Concept

Security Baselines and Policy Hierarchy

Question 1775Question →

An organization wants to reduce employee vulnerability to social engineering attacks where attackers impersonate internal IT support over the phone to collect passwords. Which of the following procedures should be emphasized during security awareness training to best mitigate this risk?

Instruct employees to verify the caller's identity via an official internal directory using an out-of-band communication channel before disclosing sensitive information.

Configure workstation host firewalls to inspect incoming voice packets for spoofed telephone numbers.

Forward suspicious phone calls to the perimeter email security gateway for automated link scanning.

Treat identity verification requirements as optional guidance during high-priority IT outages.

Show answer & explanation

Answer: Instruct employees to verify the caller's identity via an official internal directory using an out-of-band communication channel before disclosing sensitive information.

Answer

Instruct employees to verify the caller's identity via an official internal directory using an out-of-band communication channel before disclosing sensitive information.

Out-of-band verification requires employees to contact the requester using a trusted, independent method (such as dialing a verified internal extension from an enterprise directory) before sharing sensitive data. This procedure effectively neutralizes phone impersonation attacks.

Step-by-Step Solution

Identify the threat vector described in the scenario.

The attack involves phone-based social engineering (vishing) targeting human trust.

Recognizing that human interaction is the vector helps select human-centric mitigation controls.

Evaluate the administrative and procedural awareness controls.

Establishing mandatory out-of-band verification via official internal contact channels prevents unauthorized credential disclosure.

Independent verification breaks the attacker's chain of trust and mitigates impersonation risks.

Key Concept

Out-of-band authentication and verification procedures in human risk management

Question 1776Question →

A security operations team is preparing to remediate a newly disclosed critical vulnerability affecting enterprise application servers. In what order should the team execute the patch management lifecycle steps from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with testing the patch in a non-production staging environment, followed by submitting a formal change request to the Change Advisory Board, deploying the patch to production during the approved maintenance window, and concluding with post-deployment auditing and verification scanning.

Effective patch and configuration management follows a structured lifecycle: evaluating and testing patches in non-production environments first, securing formal approval from the Change Advisory Board, deploying updates during authorized windows, and performing post-implementation auditing to verify that vulnerability remediation was successful and configuration baselines remain intact.

Step-by-Step Solution

Test the patch in staging

Patch compatibility and roll-back steps are confirmed without risking production downtime.

Non-production testing validates stability and provides required evidence for formal change approval.

Obtain Change Advisory Board (CAB) approval

Formal authorization and scheduled maintenance windows are established.

Change governance prevents uncoordinated production updates and mitigates enterprise risk.

Deploy to production systems

The patch is applied across production application servers.

Execution must align strictly with approved maintenance schedules.

Audit and verify baseline compliance

Vulnerability scanning confirms patch installation and baseline integrity.

Post-deployment validation proves successful remediation and ensures system baselines remain secure.

Key Concept

Patch Management Lifecycle and Change Control Governance

Question 1777Question →

An organization is updating its credential storage architecture to protect user account passwords against offline precomputed table attacks. System analysis reveals that many users select identical plaintext passwords, which currently results in identical stored hash values within the credential database. Which of the following cryptographic techniques should the security administrator implement to ensure that identical passwords produce distinct stored hashes?

Salting each password with a unique, randomly generated value prior to running the hashing algorithm

Encrypting the database password hashes using asymmetric RSA public keys

Digitally signing each password hash using the user's private key to ensure non-repudiation

Generating a Certificate Signing Request for each user to bind their hash to an authenticated X.509 certificate

Show answer & explanation

Answer: Salting each password with a unique, randomly generated value prior to running the hashing algorithm

Answer

Salting each password with a unique, randomly generated value prior to running the hashing algorithm ensures that identical plaintext passwords produce distinct hash values.

Salting involves appending a unique, random value to a password before hashing. This ensures that even if two users choose the exact same plaintext password, their resulting stored hashes will be completely different. Consequently, precomputed rainbow table attacks become ineffective because the attacker would need to build a distinct precomputed table for every unique salt value.

Step-by-Step Solution

Identify the primary threat described in the scenario

The system is vulnerable to offline precomputed table (rainbow table) attacks because identical plaintext passwords yield identical stored hashes.

Precomputed tables rely on looking up known hash outputs for common plaintext strings.

Evaluate the mechanism required to randomize hash output for identical inputs

Cryptographic salting appends a unique, random string of bits to each password input before the hashing function executes.

Because the input to the hash function becomes unique per user account (

Password + Salt

), two identical passwords will result in completely different hash digest values.

Select the cryptographic technique matching the requirement

Cryptographic salting directly resolves duplicate hash entries and renders precomputed rainbow tables useless.

An attacker would have to compute a separate table for every unique salt value, making precomputation computationally infeasible.

Key Concept

Cryptographic Salting and Hashing

Estimated Time:1m 15s

Question 1778Question →

An enterprise security team is auditing organizational controls against the CompTIA Security+ framework. Match each implemented security control on the left to its corresponding dual-axis classification (Control Category / Functional Type) on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The controls are correctly matched as follows: Inline Web Application Firewall matches Technical / Preventive; Enterprise risk assessments and security policy updates match Managerial / Directive; Automated endpoint re-imaging scripts match Technical / Corrective; Biometric retina scanners on facility doors match Physical / Preventive.

Each security mechanism aligns with its specific framework classification: Technical controls utilize hardware/software technologies, Managerial controls establish administrative policies and risk frameworks, and Physical controls protect facilities and tangible assets. Functionally, Preventive controls impede security events, Directive controls specify mandatory actions, and Corrective controls repair damage or restore functionality.

Step-by-Step Solution

Determine the primary control category (Technical, Managerial, Operational, Physical) for each item.

Inline WAF and endpoint restoration scripts use technology (Technical); policies and risk assessments use administration/governance (Managerial); retina scanners on physical doors protect tangible property (Physical).

Control categories reflect how a control is implemented within an environment.

Determine the functional control type (Preventive, Deterrent, Detective, Corrective, Compensating, Directive) for each item based on its operational purpose.

Inline WAF blocks traffic before entry (Preventive); policies establish required behaviors (Directive); re-imaging scripts repair compromised systems (Corrective); retina scanners stop physical entry (Preventive).

Functional types describe what goal the control accomplishes in response to security risk.

Combine category and functional type to form dual-axis pairs and match to right-hand items.

All left items map uniquely to their corresponding dual-axis right-side designations.

Proper classification requires accurate pairing of implementation axis and functional goal.

Key Concept

Security Control Categories and Types

Question 1779Question →

A municipal water authority operates a SCADA telemetry gateway with an Asset Value ( $AV$ ) of $\$400,000$ . A quantitative risk assessment identifies that an unmitigated malware attack carries an Exposure Factor ( $EF$ ) of $0.50$ with an estimated Annual Rate of Occurrence ( $ARO$ ) of $0.25$ . The CISO is evaluating an industrial endpoint monitoring control that costs $\$15,000$ annually to deploy, which would reduce the Exposure Factor ( $EF$ ) to $0.10$ . What is the net annual financial benefit of implementing this security control?

\$25,000

\$35,000

\$40,000

\$10,000

Show answer & explanation

Answer: $\$25,000$

Answer

The net annual financial benefit of implementing the security control is

\$25,000

The net annual financial benefit of a security control is determined by calculating the reduction in Annual Loss Expectancy (

\Delta ALE

) and subtracting the annual cost of the countermeasure. Baseline

ALE = \$400,000 \times 0.50 \times 0.25 = \$50,000

. Post-mitigation

ALE = \$400,000 \times 0.10 \times 0.25 = \$10,000

. The annual reduction in expected loss is

\$40,000

. Subtracting the control's

\$15,000

annual fee yields a net benefit of

\$25,000

Step-by-Step Solution

Calculate the initial Single Loss Expectancy (

SLE_{initial}

) and initial Annual Loss Expectancy (

ALE_{initial}

)

SLE_{initial} = \$400,000 \times 0.50 = \$200,000

;

ALE_{initial} = \$200,000 \times 0.25 = \$50,000

Determines the baseline expected financial loss per year without any security control.

Calculate the mitigated Single Loss Expectancy (

SLE_{mitigated}

) and mitigated Annual Loss Expectancy (

ALE_{mitigated}

)

SLE_{mitigated} = \$400,000 \times 0.10 = \$40,000

;

ALE_{mitigated} = \$40,000 \times 0.25 = \$10,000

Determines the expected annual loss after deploying the threat monitoring solution.

Calculate the net benefit of the control

\text{Net Benefit} = (ALE_{initial} - ALE_{mitigated}) - \text{Annual Cost} = (\$50,000 - \$10,000) - \$15,000 = \$25,000

Subtracts the residual loss and annual safeguard cost from the baseline expected loss to measure financial return.

Key Concept

Quantitative Risk Assessment (ALE and Safeguard Cost-Benefit Analysis)

Question 1780Question →

An enterprise chief information security officer (CISO) is aligning the organization's global compliance baseline against sector-specific legal mandates and privacy extension standards. Match each compliance framework or regulation to its primary operational mandate.

Click a left item, then click its matching right item

Show answer & explanation

Answer

FISMA pairs with federal agency/contractor FIPS 199 categorization and continuous monitoring; DORA pairs with EU financial entity ICT risk management and operational resilience testing; ISO/IEC 27701 pairs with the PIMS extension to ISO/IEC 27001; NYDFS 23 NYCRR 500 pairs with state financial institution CISO designation and 72-hour incident notification mandates.

Each regulatory framework is correctly paired to its governing scope: FISMA regulates federal agencies and contractor system authorizations using FIPS/NIST standards; DORA enforces operational resilience across EU financial entities; ISO/IEC 27701 provides PIMS privacy governance as an extension to ISO/IEC 27001; and NYDFS 23 NYCRR 500 mandates designated security leadership and mandatory 72-hour event reporting for New York financial services.

Step-by-Step Solution

Analyze federal versus international and state regulatory jurisdictions

FISMA applies specifically to U.S. federal government information systems and contractors, requiring NIST and FIPS compliance.

Regulatory applicability is defined by entity type and geographic jurisdiction.

Identify operational resilience standards within financial sectors

DORA enforces digital operational resilience across EU financial institutions, whereas NYDFS 23 NYCRR 500 mandates specific administrative controls (such as a designated CISO and 72-hour reporting) for New York financial entities.

Sector-specific financial regulations introduce targeted requirements beyond broad privacy laws.

Differentiate privacy certification standards from security baseline standards

ISO/IEC 27701 specifies the requirements for a Privacy Information Management System (PIMS) as an explicit extension to ISO/IEC 27001.

ISO standards use add-on modules to extend security control frameworks into privacy governance.

Key Concept

Regulatory Framework Mapping and Compliance Mandates

PreviousPage 89 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept