Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1801Question →

A global logistics organization is evaluating a cloud-based warehouse management platform to manage critical supply chain operations. The security team requires verification that the vendor's security controls addressing system availability and data confidentiality are not only properly designed, but have also been evaluated for operational effectiveness over a six-month monitoring window. Which of the following audit reports or attestations should the organization request from the vendor?

Show answer & explanation

Answer: A SOC 2 Type II report

Answer

A SOC 2 Type II report
A SOC 2 Type II report specifically evaluates the design and operating effectiveness of security controls categorized under the Trust Services Criteria (such as availability, confidentiality, and security) over a defined period (such as six months).

Step-by-Step Solution

1
Identify the criteria domain required by the organization.
The requirement specifies system availability and data confidentiality, which fall under the Trust Services Criteria (SOC 2), not financial reporting controls (SOC 1).
SOC 1 reports address financial controls, whereas SOC 2 addresses operational trust criteria such as security, availability, and confidentiality.
2
Determine the time scope requirement for the audit.
The organization specifies evaluating operational effectiveness over a six-month period, which necessitates a Type II report.
Type I reports evaluate design at a specific point in time, whereas Type II reports test the operating effectiveness of controls over a designated testing period (typically 6 to 12 months).

Key Concept

SOC Report Types and Attestation Scopes
Question 1802Question →

A cloud development team integrates an automated scanner into a continuous integration and continuous deployment (CI/CD) pipeline to check Infrastructure-as-Code (IaC) templates for misconfigurations. When the scanner identifies high-risk security flaws, it automatically terminates the build job, stopping non-compliant infrastructure from being deployed into the live cloud environment. According to security control classifications, which category and functional type pair best describes this automated scanner gate?

Show answer & explanation

Answer: Technical and Preventive

Answer

Technical and Preventive
The option specifying 'Technical and Preventive' is correct because the scanner relies on software automation and system logic to enforce security policies (Technical category) and actively prevents misconfigured code from being deployed into the live environment (Preventive functional type).

Step-by-Step Solution

1
Determine the primary control category based on execution mechanism.
Because the control is implemented through automated software, security scripts, and CI/CD tooling rather than human processes or administrative policies, it belongs to the Technical (Logical) category.
Technical controls utilize hardware, software, or firmware mechanisms to enforce security rules.
2
Determine the functional control type based on the operational objective.
Because the pipeline gate halts execution to ensure insecure code never reaches the live production environment, its objective is to prevent security incidents from taking place.
Preventive controls stop unauthorized actions or vulnerabilities before impact occurs.
3
Synthesize category and functional type into the combined classification.
The control is classified as Technical and Preventive.
Combines technological execution (Technical) with proactive intervention (Preventive).

Key Concept

Security Control Categories and Functional Types
Question 1803Question →

A software firm utilizes a cloud database service to store business records. The firm's executive leadership designates an internal department manager to establish access permissions, assign classification sensitivity levels, and dictate data retention rules for these records. Which of the following data governance roles is this department manager performing?

Show answer & explanation

Answer: Data owner

Answer

Data owner
The data owner (sometimes referred to as the data controller or business owner) has primary responsibility and legal accountability for a dataset. This includes defining data sensitivity classifications, establishing access control policies, and setting data lifecycle and retention rules.

Step-by-Step Solution

1
Identify the primary responsibilities described in the scenario
The individual establishes access permissions, assigns data classification levels, and dictates retention policies.
Governance roles are categorized by whether they hold policy/business authority or technical execution duties.
2
Map the responsibilities to official CompTIA Security+ data governance roles
The manager holds executive business responsibility and policy-setting rights for the dataset, which defines the Data Owner role.
Data owners specify how data should be labeled and protected, whereas custodians perform technical tasks like database administration.

Key Concept

Data Owner vs. Data Custodian Responsibilities
Estimated Time:45s
Question 1804Question →

A financial analytics firm is conducting a quantitative risk assessment on its real-time market data feed server. The server has an Asset Value (AVAV) of $900,000\$900,000. Historical security data indicates that a major data breach occurs once every five years (ARO=0.20ARO = 0.20). If the calculated Annualized Loss Expectancy (ALEALE) for this threat vector is $45,000\$45,000, what is the Exposure Factor (EFEF) of a single security breach?

Show answer & explanation

Answer: 25%25\%

Answer

The Exposure Factor resulting from a single security breach is 25%.
The quantitative risk assessment formula relates Annualized Loss Expectancy (ALEALE), Single Loss Expectancy (SLESLE), Annual Rate of Occurrence (AROARO), Asset Value (AVAV), and Exposure Factor (EFEF) through two core equations: ALE=SLE×AROALE = SLE \times ARO and SLE=AV×EFSLE = AV \times EF. Substituting the given values (ALE=$45,000ALE = \$45,000 and ARO=0.20ARO = 0.20) yields SLE=$45,000/0.20=$225,000SLE = \$45,000 / 0.20 = \$225,000. Substituting SLE=$225,000SLE = \$225,000 and AV=$900,000AV = \$900,000 into the second formula yields EF=$225,000/$900,000=0.25EF = \$225,000 / \$900,000 = 0.25, or 25%25\%.

Step-by-Step Solution

1
Calculate the Single Loss Expectancy (SLE) from Annualized Loss Expectancy (ALE) and Annual Rate of Occurrence (ARO).
SLE=ALEARO=$45,0000.20=$225,000SLE = \frac{ALE}{ARO} = \frac{\$45,000}{0.20} = \$225,000
ALE is defined as ALE=SLE×AROALE = SLE \times ARO. Rearranging the formula isolates SLESLE.
2
Calculate the Exposure Factor (EF) from Single Loss Expectancy (SLE) and Asset Value (AV).
EF=SLEAV=$225,000$900,000=0.25=25%EF = \frac{SLE}{AV} = \frac{\$225,000}{\$900,000} = 0.25 = 25\%
SLE is defined as SLE=AV×EFSLE = AV \times EF. Rearranging the formula isolates EFEF.

Key Concept

Quantitative Risk Assessment (ALE, SLE, ARO, and EF calculations)
Estimated Time:1m 30s
Question 1805Question →

A enterprise healthcare organization is deploying an S/MIME solution for secure email communications. The compliance team mandates that encrypted emails must remain recoverable by security auditors if an employee leaves the company. However, the legal team requires that digitally signed emails strictly maintain legal non-repudiation. Which of the following public key infrastructure (PKI) key management configurations should the security team implement to satisfy both requirements?

Show answer & explanation

Answer: Escrow the private key designated for email decryption on a secure server, while keeping the digital signature private key under the user's sole control on the local system without escrow.

Answer

Escrow the private key designated for email decryption on a secure server, while keeping the digital signature private key under the user's sole control on the local system without escrow.
In enterprise PKI environments, separating encryption certificates from digital signature certificates is standard practice. The private key used for decrypting S/MIME emails can be safely escrowed so that the organization can recover encrypted files and emails if needed. Conversely, the private key used for digital signatures must remain under the exclusive control of the owner and never be escrowed, preserving strict legal non-repudiation.

Step-by-Step Solution

1
Analyze the compliance requirement for data recovery.
Email confidentiality relies on asymmetric encryption where messages are encrypted with the recipient's public key. Decrypting archived emails requires access to the corresponding private key, making key escrow appropriate for decryption keys.
Escrowing decryption keys guarantees that business correspondence remains readable even if keys are lost or employees depart.
2
Analyze the legal requirement for non-repudiation.
Non-repudiation proves that a specific individual authored or authorized a signed document. If any third party possesses a copy of the signing private key, the key owner can repudiate the signature.
Digital signature private keys must never be escrowed to ensure sole control by the key holder.
3
Select the configuration that balances both requirements.
Separate dual-key pairs should be issued: one key pair for encryption/decryption (with escrow) and one key pair for digital signatures (without escrow).
This dual-certificate deployment satisfies both data availability and non-repudiation mandates.

Key Concept

Dual Key Pair Management and Key Escrow vs Non-Repudiation in PKI
Estimated Time:1m 30s
Question 1806Question →

A security analyst is evaluating enterprise security mechanisms to classify them according to CompTIA Security+ functional control types. Which of the following examples correctly pair a security control with its primary functional control type? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Motion sensors installed in a server room to alert security personnel upon unauthorized physical entry function as a detective control.; Security policies mandating annual employee security awareness training prior to system access function as a directive control.

Answer

The motion sensors functioning as a detective control and security policies functioning as a directive control are the two correct functional control pairings.
Motion sensors detect physical intrusion events and alert monitoring staff, which satisfies the definition of a detective control. Security policies mandating security awareness training establish required behaviors and compliance expectations, satisfying the definition of a directive control.

Step-by-Step Solution

1
Analyze each security control scenario against the functional control categories defined by CompTIA Security+ (preventive, detective, corrective, deterrent, compensating, directive).
Motion sensors detect motion and alert security (detective). Organizational security training policies mandate behavior (directive). An inline NIPS actively blocks malicious traffic (preventive). A honeypot observes threat actor activity (detective).
Functional control types are categorized by their operational objective during an security event lifecycle.
2
Identify the two accurate control and functional type combinations.
Motion sensors as detective controls and security policies as directive controls are correct.
An inline NIPS is misclassified as detective when its active blocking role makes it preventive, and a honeypot is misclassified as preventive when its decoy logging function makes it detective.

Key Concept

Security Control Functional Types
Estimated Time:1m 30s
Question 1807Question →

An attacker contacts a remote branch manager while posing as an executive auditor from corporate headquarters. The attacker presents a fabricated narrative regarding an urgent regulatory compliance audit and persuades the branch manager to bypass standard identity verification procedures to grant temporary network credentials. Which social engineering technique was primarily utilized by the attacker to manipulate the victim?

Show answer & explanation

Answer: Pretexting

Answer

Pretexting is the primary technique used, as the attacker relied on a detailed, fabricated scenario and false persona to manipulate the victim into bypassing procedures.
Pretexting is the practice of crafting a detailed, invented scenario (the pretext) to trick a target into disclosing information or granting unauthorized privileges. Impersonating an auditor under an urgent compliance context leverages the influence principles of authority and urgency within a pretextual narrative.

Step-by-Step Solution

1
Analyze the attacker's primary tactic described in the scenario.
The attacker established a false persona (corporate executive auditor) and constructed a believable backstory (urgent regulatory audit).
Identifying the approach used to manipulate the target determines the attack category.
2
Evaluate the defined social engineering attack vectors.
Constructing a false narrative and impersonating an authority figure to manipulate an individual into surrendering access explicitly defines pretexting.
Social engineering techniques are distinguished by their delivery medium, narrative structure, and targeted manipulation method.

Key Concept

Pretexting in Social Engineering
Question 1808Question →

An enterprise organization is establishing data governance boundaries for its centralized cloud repository. Which of the following responsibilities belong specifically to the Data Owner rather than the Data Custodian? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Defining and assigning the data classification tier based on business sensitivity; Authorizing access permissions and approving business rules for data usage

Answer

The responsibilities belonging specifically to the Data Owner are defining and assigning the data classification tier based on business sensitivity, and authorizing access permissions and approving business rules for data usage.
The Data Owner is executive leadership or a business unit head accountable for specific information assets. Their responsibilities include establishing classification tiers and approving access rights. Operational duties like maintaining backups or system configurations are delegated to Data Custodians.

Step-by-Step Solution

1
Identify the core distinction between Data Owner and Data Custodian roles.
The Data Owner holds business accountability for data context and authorization, while the Data Custodian handles technical implementation and maintenance.
Governance frameworks explicitly separate business responsibility from operational system administration.
2
Evaluate the option regarding data classification assignment.
Assigning data sensitivity and classification levels is a primary duty of the Data Owner.
Only business stakeholders with understanding of data impact can accurately evaluate sensitivity.
3
Evaluate the option regarding access approval and usage rules.
Authorizing user access and defining acceptable business usage is a primary duty of the Data Owner.
The owner determines who requires access based on business needs.

Key Concept

Separation of responsibilities between Data Owners (business accountability, classification, authorization) and Data Custodians (technical execution, backups, control implementation).
Estimated Time:1m 0s
Question 1809Question →

A security analyst is investigating a dual-vector social engineering campaign targeting a corporate facility. During the investigation, the analyst notes that employees received text messages prompting them to verify credentials on a spoofed portal, while physical USB flash drives labeled "Executive Salaries" were strategically dropped in the employee parking area. Which of the following social engineering attack vectors were executed during this campaign? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Smishing by delivering malicious web links through cellular text messaging; Baiting by leaving physical storage media loaded with malware in accessible areas

Answer

The attack vectors executed in this campaign are smishing (using cellular text messages with malicious links) and baiting (strategically dropping infected physical media to exploit curiosity).
Smishing refers specifically to phishing attacks conducted over Short Message Service (SMS) text messages. Baiting involves leaving physical media, such as flash drives, in locations where victims will pick them up out of curiosity. Both mechanisms match the attack vectors described in the scenario.

Step-by-Step Solution

1
Analyze the first incident indicator in the scenario.
Employees received SMS text messages containing links to a spoofed credential portal.
Phishing conducted via SMS text messaging is classified as smishing.
2
Analyze the second incident indicator in the scenario.
Malicious USB drives labeled with enticing titles were left in the parking area for employees to find.
Promising a tangible item or relying on curiosity via physical media drops is classified as baiting.
3
Correlate identified vectors with the options.
Smishing and baiting correctly match the scenario indicators.
Both vectors directly align with the delivery mechanisms described in the incident report.

Key Concept

Identification of Social Engineering Attack Vectors (Smishing vs. Baiting)
Question 1810Question →

A regional financial institution based in the United States is updating its cybersecurity policy framework to ensure full alignment with the updated Gramm-Leach-Bliley Act (GLBA) Safeguards Rule. Which of the following administrative or technical controls is explicitly mandated by this regulatory framework to protect customer nonpublic personal information (NPI)?

Show answer & explanation

Answer: Implementing multi-factor authentication for any individual accessing customer information systems containing nonpublic personal information

Answer

Implementing multi-factor authentication for any individual accessing customer information systems containing nonpublic personal information.
The correct answer states the requirement to implement multi-factor authentication for any individual accessing customer information systems containing nonpublic personal information. Under the Federal Trade Commission (FTC) updated Safeguards Rule of the Gramm-Leach-Bliley Act (GLBA), covered financial institutions must implement specific technical controls, including mandatory multi-factor authentication, robust access controls, and data encryption to safeguard nonpublic personal information (NPI).

Step-by-Step Solution

1
Identify the target regulatory framework and governed data classification.
The target framework is the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, which governs nonpublic personal information (NPI) held by financial institutions.
Regulatory requirements vary significantly depending on whether the data is classified as PHI (HIPAA), CHD (PCI-DSS), or NPI (GLBA).
2
Evaluate the specific security control requirements under the updated GLBA Safeguards Rule.
The GLBA Safeguards Rule requires financial institutions to implement specific technical safeguards, including data encryption at rest and in transit, continuous monitoring or vulnerability assessments, robust access controls, and mandatory multi-factor authentication (MFA) for anyone accessing systems with NPI.
Understanding regulatory baseline requirements ensures correct selection of mandatory security controls.
3
Differentiate GLBA requirements from non-applicable regulatory mandates.
Four-day SEC breach reporting applies to publicly traded entities, BAAs apply to healthcare entities under HIPAA, and data localization mandates are not part of GLBA.
Eliminating distractor options based on mismatched regulatory scopes leaves the correct GLBA mandate.

Key Concept

Gramm-Leach-Bliley Act (GLBA) Safeguards Rule Compliance Mandates
Estimated Time:1m 15s
Question 1811Question →

An enterprise cloud engineering team at an online learning platform is standardizing infrastructure deployments across multiple cloud environments. To prevent configuration drift, the team publishes a mandatory document defining the mandatory minimum technical security configuration settings—such as turning off root SSH access, enforcing minimum encryption protocol versions, and disabling unused network daemons—that every Linux virtual machine must satisfy before deployment. Which of the following governance document types best describes this mandatory configuration document?

Show answer & explanation

Answer: Security Baseline

Answer

Security Baseline
The correct answer is Security Baseline because a baseline specifies the mandatory minimum technical security configurations, settings, and hardening rules required for a specific system or platform before it enters production.

Step-by-Step Solution

1
Analyze the scenario requirements
The document specifies mandatory minimum technical configuration requirements (disabling root SSH, enforcing encryption levels, closing unused ports) for virtual machines.
Governance documents are categorized based on their level of technical specificity, mandatory nature, and target application.
2
Evaluate governance document definitions against the scenario
A baseline provides a consistent, mandatory minimum security threshold for system configurations.
High-level policies set management intent, standards set specific mandatory rules, guidelines offer optional advice, and baselines define mandatory technical configuration minimums.

Key Concept

Security Governance Documentation Hierarchy: Policy vs. Standard vs. Baseline vs. Guideline
Question 1812Question →

Following a compliance audit, an enterprise identifies a legacy core mainframe application that cannot natively support multi-factor authentication (MFA) or modern encryption protocols. To address the vulnerability without replacing the application, the security team deploys an isolated jump host requiring hardware token MFA and places an inline proxy in front of the mainframe to encrypt all transient sessions. Which of the following functional control types is best demonstrated by this implementation?

Show answer & explanation

Answer: Compensating control

Answer

The implementation represents a compensating control because it provides an alternative technical mechanism to satisfy security requirements when native controls cannot be supported.
The selection of a compensating control is correct because placing a secondary gateway (MFA jump host and inline proxy) around a legacy system provides an alternative technical barrier that meets organizational authentication and encryption policy requirements when the primary host cannot support those features natively.

Step-by-Step Solution

1
Analyze the operational limitation presented in the scenario.
The core legacy mainframe system lacks native support for required security controls (MFA and session encryption).
Identifying the inability to deploy standard primary controls establishes the need for an alternate security measure.
2
Evaluate the mechanism chosen by the security team.
The team introduced an external MFA jump host and an inline encryption proxy to mitigate the exposure.
This alternative mechanism fulfills the security objective without directly altering the underlying legacy application.
3
Map the mechanism to CompTIA Security+ functional control types.
Controls designed to achieve the intent of a primary security requirement when primary controls are infeasible are classified as compensating controls.
Compensating controls specifically substitute for standard measures to achieve equivalent risk mitigation.

Key Concept

Security Control Functional Types: Compensating Controls
Question 1813Question →

A cloud-based SaaS organization is evaluating security management options to address vulnerabilities identified in a legacy customer authentication service. The Chief Information Security Officer (CISO) recommends deploying an inline Web Application Firewall (WAF) to filter malicious input and purchasing a cyber liability insurance policy to cover regulatory penalties and third-party losses in the event of a breach. Which of the following risk response strategies are being directly implemented through these combined actions? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Risk Mitigation; Risk Transference

Answer

The organization is implementing Risk Mitigation by deploying a Web Application Firewall to decrease exploit probability, and Risk Transference by procuring cyber liability insurance to shift financial risk.
Risk Mitigation involves applying controls—such as technical firewall rules—to reduce risk to an acceptable level. Risk Transference involves reassigning financial risk or liability to a third party, such as an insurance carrier. Both strategies are clearly demonstrated by deploying the Web Application Firewall and purchasing cyber liability insurance.

Step-by-Step Solution

1
Analyze the technical control implementation
Deploying a WAF active control decreases attack impact and likelihood.
Actions that decrease vulnerability impact or threat likelihood align with Risk Mitigation.
2
Analyze the financial protection strategy
Securing cyber insurance shifts potential monetary loss to an insurer.
Sharing or delegating financial impacts of a risk to a third party aligns with Risk Transference.
3
Evaluate distractor strategies against scenario facts
Avoidance (retiring service) and Acceptance (taking no action) are not present.
The service remains active and deliberate remediation steps are taken.

Key Concept

Risk Response Selection and Alignment
Question 1814Question →

Network security monitoring logs report repeated periodic UDP bursts originating from an internal application server to an unfamiliar external IP address over port 123. System configuration audits confirm that standard Network Time Protocol (NTP) services are disabled on this host. Which of the following initial actions should the security team take to analyze and contain this anomalous network activity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Capture and analyze raw network packet payloads at the gateway interface to evaluate the internal structure of the non-standard UDP traffic.; Implement network isolation controls on the affected internal application server to restrict external outbound communication.

Answer

The correct actions are capturing network packet payloads at the gateway interface for deep inspection and implementing network isolation controls on the affected internal application server.
Analyzing raw packet payloads helps security teams identify covert tunneling or unauthorized communications disguised as standard protocols, while host isolation prevents potential data exfiltration without destroying evidence.

Step-by-Step Solution

1
Analyze network traffic contents
Identify whether the UDP port 123 traffic represents legitimate protocol behavior or covert data encapsulation.
Packet capture and payload inspection are necessary to detect protocol tunneling when network flow monitoring flags disabled services transmitting data.
2
Contain the suspicious endpoint
Block further outbound network communication from the affected host.
Isolation stops potential exfiltration channels and command-and-control connectivity while allowing security analysts to conduct host forensics.

Key Concept

Network Security Monitoring and Anomaly Response
Estimated Time:1m 30s
Question 1815Question →

A security analyst is reviewing results from a routine network vulnerability scan targeting internal application servers. The generated report lists open network ports and OS banners, but fails to identify missing operating system patches, misconfigured registry settings, or internal web application vulnerabilities. Which of the following adjustments should the analyst make to resolve these scanning visibility gaps? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Provide valid administrative credentials to the scanner to perform local host checks.; Run an authenticated web application vulnerability scan targeted at inspecting dynamic application code and scripts.

Answer

The analyst should provide valid administrative credentials for host-level checks and execute an authenticated web application vulnerability scan.
Uncredentialed network scans can only identify exposed network ports and basic service banners. To detect missing operating system patches and misconfigured registry keys, the scanner requires administrative credentials to perform host-based checks. Similarly, assessing web application vulnerabilities requires dedicated, application-aware scanning techniques to audit client-side scripts and application logic.

Step-by-Step Solution

1
Analyze the limitation of uncredentialed network scanning
Uncredentialed scans interact only with network-facing services and banners, missing internal OS configurations, missing patches, and hidden application flaws.
Identifying internal system state requires local execution privileges on the target.
2
Select credentialed host auditing and application-layer scanning tools
Administrative credentials enable deep host auditing, while application-focused scanners audit web application logic.
Both methods address distinct visibility gaps identified in the scan report.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning and Web Application Assessment Methods
Question 1816Question →

A cybersecurity team at a pharmaceutical organization is revising its governance framework for cloud storage repositories housing sensitive clinical trial data. Which of the following governance document types represent mandatory rules that mandate compliance across the enterprise? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: High-level security policy signed by executive leadership that sets organizational security objectives; Technical security standards specifying mandatory encryption algorithms and minimum key lengths

Answer

The high-level security policy signed by executive leadership and the technical security standards specifying mandatory encryption algorithms represent mandatory compliance requirements.
High-level security policies set mandatory corporate direction from executive leadership, while technical security standards specify compulsory baseline rules (such as mandatory key lengths and encryption algorithms). Both are binding governance documents within an enterprise framework.

Step-by-Step Solution

1
Analyze the hierarchy of governance documentation to separate mandatory requirements from discretionary recommendations.
Identified policies and standards as mandatory elements, while guidelines and vendor whitepapers are discretionary.
Governance frameworks mandate compliance through top-level policies and specific technical standards.
2
Evaluate the remaining choices to verify they represent binding governance documents rather than functional permission controls or non-binding guidance.
Confirmed that authorization rules describe access control logic, whereas security policy and security standards fulfill the governance document criteria.
High-level policies dictate organizational goals, and technical standards provide compulsory implementation specifics.

Key Concept

Security Policy and Standard Hierarchy
Question 1817Question →

A security operations team is configuring an enterprise vulnerability management program for remote branch office Linux workstations connected over low-bandwidth VPN links. During preliminary network-based scanning, central scanner traffic caused noticeable network congestion across the VPN tunnels, and local host firewalls on workstations dropped multiple probe packets, resulting in incomplete scan results. Which of the following solutions should the team deploy to perform comprehensive vulnerability assessments without saturating WAN bandwidth or altering workstation firewall policies?

Show answer & explanation

Answer: Deploy host-based vulnerability scanning agents on the workstations to collect system metadata locally and transmit compressed audit results to the management console.

Answer

Deploying host-based vulnerability scanning agents directly on remote workstations enables local patch and configuration auditing without generating high network scan traffic over WAN links.
Deploying host-based scanning agents is the standard solution for environments with constrained network bandwidth or restrictive host firewalls. Agents run locally on the host, audit local software versions and configurations directly, and send small compressed report packages back to the vulnerability management system, avoiding heavy network packet generation across the VPN.

Step-by-Step Solution

1
Analyze operational constraints in the scenario
Identified low-bandwidth VPN connections, network congestion caused by network-based scanning, and dropped probes from local host firewalls.
Scanning across WAN/VPN links creates network overhead, while local host firewalls often block unauthenticated network probes.
2
Evaluate vulnerability scanning deployment methodologies
Agent-based scanning executes audit checks locally on the host OS, consuming minimal local CPU/RAM and transmitting only lightweight output summaries to the server.
Host agents do not rely on inbound network probing, eliminating firewall block issues and minimizing VPN bandwidth usage.
3
Select the optimal assessment mechanism
Host-based agents fulfill both requirements by bypassing host firewall probe blocks and preventing VPN bandwidth saturation.
Agent-based assessments provide deep internal OS visibility while requiring minimal network footprint.

Key Concept

Agent-based vs. Network-based Vulnerability Scanning
Estimated Time:1m 30s
Question 1818Question →

A regional health authority is updating its overarching security governance framework following an infrastructure modernization project. The governance steering committee must clearly distinguish between mandatory governance mandates and non-binding operational material. Which of the following document types constitute mandatory compliance requirements within the enterprise security governance framework? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Enterprise Security Policies that state management intent and define high-level mandatory requirements.; Technical Security Standards that specify mandatory baseline rules and technology configurations.

Answer

Enterprise Security Policies and Technical Security Standards are both mandatory elements of a security governance framework.
Enterprise Security Policies and Technical Security Standards are mandatory components of security governance. Policies reflect executive leadership direction and establish compulsory high-level rules, while standards define mandatory, measurable technical configurations and operational constraints.

Step-by-Step Solution

1
Identify the mandatory vs. discretionary elements in a standard security governance documentation hierarchy.
Policies (mandatory executive directives) and Standards (mandatory technical rules) are compulsory, whereas Guidelines are discretionary recommendations.
Governance frameworks rely on policies to establish mandatory high-level rules and standards to enforce uniform technical specifications.
2
Evaluate each provided document type against compulsory compliance criteria.
Enterprise Security Policies and Technical Security Standards carry mandatory authority, whereas Guidelines, Whitepapers, and Exception Requests do not set compulsory framework rules.
Only policies and standards establish legally and operationally binding security requirements across all organizational units.

Key Concept

Hierarchy of Security Governance Documents (Policies, Standards, Baselines, Guidelines, Procedures)
Estimated Time:1m 30s
Question 1819Question →

A security systems engineer is deploying mutual TLS (mTLS) for communication between internal microservices. During testing, client microservice instances fail to authenticate to target API gateways. Inspection of the certificate validation logs reveals that the client certificates were rejected because their Extended Key Usage (EKU) attribute is configured exclusively for "Server Authentication" (1.3.6.1.5.5.7.3.1) rather than "Client Authentication" (1.3.6.1.5.5.7.3.2). Which of the following actions should the security engineer take to resolve the authentication failures while adhering to PKI best practices?

Show answer & explanation

Answer: Generate a new Certificate Signing Request (CSR) requesting the Client Authentication EKU extension and submit it to the Certificate Authority for issuance.

Answer

Generate a new Certificate Signing Request (CSR) requesting the Client Authentication EKU extension and submit it to the Certificate Authority for issuance.
Generating a new Certificate Signing Request (CSR) with the Client Authentication EKU extension directly addresses the root cause of the mTLS handshake failure. PKI certificates explicitly define their intended applications via Key Usage and Extended Key Usage fields; client-side mTLS endpoints require the Client Authentication object identifier (1.3.6.1.5.5.7.3.2) to pass validation.

Step-by-Step Solution

1
Analyze the error log
Identified that the client certificate lacks the required Client Authentication EKU extension.
During a TLS handshake, mutual authentication requires the client certificate to explicitly allow client identity verification.
2
Determine the proper PKI issuance workflow
Create a updated CSR with the correct Extended Key Usage extension requested.
Certificate attributes such as EKU cannot be modified post-issuance; a new CSR must be signed by the CA.
3
Deploy and test the newly issued certificate
The client microservice presents a valid certificate containing Client Authentication EKU, resolving the mTLS handshake failure.
The API gateway trusts the CA and successfully verifies the EKU field during peer authentication.

Key Concept

Extended Key Usage (EKU) extensions in PKI certificate issuance
Question 1820Question →

A systems administrator at a financial firm is assigned to manage database server infrastructure, perform routine data backups, and configure technical access controls according to management policies. The administrator does not determine why the customer data is collected or define how long it should be legally retained. Which data governance role is this administrator fulfilling?

Show answer & explanation

Answer: Data custodian

Answer

Data custodian
The correct answer is the Data Custodian. In data governance, the data custodian is responsible for the technical implementation of security controls, system administration, data backups, and maintaining storage infrastructure in accordance with policies set by the organization.

Step-by-Step Solution

1
Analyze the operational responsibilities described in the scenario.
The individual manages server infrastructure, configures technical controls, and performs routine backups.
Technical execution and data protection mechanisms are operational tasks.
2
Distinguish technical maintenance duties from data governance accountability.
The role involves technical safeguards without governance authority over data classification or retention decisions.
System administrators implement controls designed to protect data, acting on directives established by data owners.
3
Map the technical role to standard CompTIA Security+ data governance terminology.
The role responsible for technical implementation and maintenance is the Data Custodian.
Data custodians maintain the security, integrity, and operational availability of data structures.

Key Concept

Distinction between Data Custodian and Data Owner responsibilities
Estimated Time:45s
PreviousPage 91 / 112Next
All practice questions — CompTIA Security+ | Examkin