Examkin

General Security Concepts

268 questions

All types268Multiple choice139Multiple select58Matching57Ordering14
Question 221Question →

A corporate employee working remotely authenticates successfully at the start of their shift using multi-factor authentication (MFA) from a compliant corporate laptop. Mid-day, a local policy check detects that the endpoint antivirus service was forcibly stopped and an unauthorized storage device was attached. Under Zero Trust Architecture (ZTA) principles, how should the access control system respond to this change in device posture?

Show answer & explanation

Answer: Dynamically re-evaluate security context and immediately revoke or restrict active application access privileges.

Answer

Dynamically re-evaluate security context and immediately revoke or restrict active application access privileges.
Zero Trust Architecture enforces continuous verification and explicit validation. Under ZTA, access is never implicitly granted permanently based on initial authentication. When device posture changes (such as disabling security agents or introducing high-risk hardware), the policy engine must dynamically re-evaluate the risk score and instruct policy enforcement points to revoke or constrain active session access immediately.

Step-by-Step Solution

1
Identify the core security event described in the enterprise scenario.
An authenticated endpoint underwent a negative change in security posture due to a disabled security service and unapproved hardware connection.
Understanding the trigger condition is essential to determine how access decisions must adapt.
2
Apply Zero Trust Architecture (ZTA) principles to the context evaluation.
Zero Trust assumes no implicit trust based on network location or past successful login, mandating explicit and continuous verification of context, identity, and device health.
Static initial authentication does not grant permanent access when operational risk parameters change.
3
Select the appropriate enforcement mechanism based on continuous inspection.
The architecture must dynamically adjust session state, revoking or step-down restricting access until compliance state is remediated.
Real-time context evaluation ensures access decisions react instantaneously to endpoint security degradation.

Key Concept

Continuous Verification and Dynamic Access Control in Zero Trust Architecture
Question 222Question →

An enterprise security administrator is auditing network infrastructure logs to verify full implementation of the Authentication, Authorization, and Accounting (AAA) framework. Which of the following technical controls directly perform Accounting functions? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Logging connection start times, disconnect timestamps, and total bandwidth consumed by remote users.; Recording command-line interface (CLI) statements executed by network engineers during active SSH management sessions.

Answer

The controls that satisfy the Accounting pillar are logging connection start times, disconnect timestamps, and bandwidth consumed, as well as recording command-line interface (CLI) statements executed by network engineers.
Accounting focuses on tracking resource utilization, user actions, and session data. Recording session timestamps, bandwidth, and specific commands executed on infrastructure devices creates an accountable audit trail.

Step-by-Step Solution

1
Define the specific operational role of the Accounting pillar in AAA.
Accounting tracks user activity, session statistics, resource usage, and audit logs to ensure non-repudiation and oversight.
Categorizing the AAA pillars isolates tracking mechanisms from identity checks and access enforcement.
2
Analyze each proposed technical control against the Accounting definition.
Logging bandwidth/timestamps and recording executed CLI commands capture activity logs and metrics (Accounting). Validating credentials proves identity (Authentication), and applying VLAN filters restricts access rights (Authorization).
Only mechanisms that monitor, measure, and record active usage fulfill the Accounting objective.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Question 223Question →

Match each organizational security measure to its corresponding functional control type according to CompTIA Security+ standards.

Click a left item, then click its matching right item

Items

Restoring corrupted system configurations from a known clean backup following a malware incident
Publishing an enterprise acceptable use policy that defines mandatory employee security responsibilities
Configuring a network firewall rule to block unauthorized inbound connection attempts
Deploying a network intrusion detection system (NIDS) to identify anomalous traffic and generate alerts

Matches

Show answer & explanation

Answer

Restoring from backups matches Corrective Control; Publishing acceptable use policy matches Directive Control; Configuring firewall rules matches Preventive Control; Deploying NIDS alerts matches Detective Control.
Each security control implementation aligns directly with standard CompTIA Security+ functional control classifications: restoring from backups fixes damage after an incident (Corrective), policies set required conduct rules (Directive), firewalls actively block threats before entry (Preventive), and intrusion detection systems discover and alert on suspicious activity (Detective).

Step-by-Step Solution

1
Analyze the operational goal of restoring system configurations from backups after an attack.
Identified as a corrective action designed to reverse impact and restore operational capability.
Corrective controls focus on mitigation and recovery after a security incident has taken place.
2
Evaluate the administrative nature of publishing an acceptable use policy.
Identified as a policy-driven directive establishing mandatory rules and expectations.
Directive controls prescribe required behavior and compliance regulations across an organization.
3
Examine the technical enforcement of a firewall rule blocking unauthorized inbound traffic.
Identified as a preventive measure designed to stop unauthorized actions before they happen.
Preventive controls proactively block security breaches or policy violations from occurring.
4
Determine the role of a network intrusion detection system generating alerts.
Identified as a detective measure focused on observing and signaling active or historical anomalies.
Detective controls discover and flag unauthorized or unexpected activities during or post-execution.

Key Concept

Functional Types of Security Controls
Question 224Question →

A security technician needs to verify that a downloaded software installation package has not been modified or corrupted during transit. Which of the following cryptographic mechanisms should the technician use to check the file's integrity?

Show answer & explanation

Answer: Cryptographic hash function

Answer

Cryptographic hash function
A cryptographic hash function converts arbitrary input data into a unique, fixed-length string (digest). By calculating the hash of the downloaded package and comparing it to the published hash value, the technician can verify whether the file was altered or corrupted during transit.

Step-by-Step Solution

1
Identify the primary security requirement
The scenario requires verifying that a file has not been altered or corrupted in transit (ensuring data integrity).
Data integrity controls ensure that data remains authentic and unmodified.
2
Match the requirement to the correct cryptographic concept
Cryptographic hash functions (such as SHA-256) produce a unique fixed-length output digest for a given input file.
Any modification to the source file results in a drastically different hash digest, allowing simple verification.

Key Concept

Cryptographic Hash Functions and Data Integrity
Question 225Question →

A security architect is auditing the access management architecture of a microservices-based enterprise platform. The platform relies on a central Identity Provider (IdP), an API Gateway, fine-grained access policies, and a SIEM system. Which of the following technical mechanisms specifically fulfill the Authorization pillar of the AAA framework? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Evaluating JSON Web Token (JWT) scope claims at the API gateway to restrict microservice endpoint execution; Enforcing Role-Based Access Control (RBAC) matrix rules to restrict backend database query execution based on user permissions

Answer

The controls that specifically fulfill the Authorization pillar are evaluating JWT scope claims at the API gateway and enforcing Role-Based Access Control (RBAC) matrix rules on backend queries.
Evaluating JWT scope claims at the API gateway and enforcing RBAC policies on backend database queries both represent Authorization controls. Authorization is the pillar of AAA responsible for determining what actions, endpoints, or data an authenticated subject is permitted to access based on privileges, scopes, or assigned roles.

Step-by-Step Solution

1
Analyze each mechanism in the scenario against the three AAA pillars (Authentication, Authorization, Accounting).
Categorize identity verification as Authentication, permission/access determination as Authorization, and activity logging/auditing as Accounting.
AAA requires clear operational separation between proving identity, determining privileges, and tracking actions.
2
Identify the Authorization mechanisms.
Evaluating JWT scopes at the API gateway and enforcing RBAC matrix rules on backend queries both decide whether an already-identified principal is allowed to perform a specific action.
Authorization explicitly deals with rights, roles, scopes, and access permissions.
3
Differentiate and exclude non-Authorization controls.
Credential/TOTP verification is Authentication (who you are); SIEM telemetry streaming is Accounting (what you did).
Selecting non-authorization controls reflects misconceptions regarding AAA pillar definitions.

Key Concept

Authentication verifies identity, Authorization determines permissions and access rights, and Accounting logs actions and usage for auditability.
Question 226Question →

An enterprise financial institution relies on a legacy mainframe system to process batch payments. A security compliance audit reveals that the mainframe application cannot natively support TLS 1.3 network transport encryption due to legacy protocol stack limitations. To satisfy data-in-transit security requirements without taking the system offline, the security engineering team deploys an inline hardware cryptographic proxy that intercepts outbound mainframe communications and encapsulates them inside an encrypted IPsec tunnel across the internal network. Which of the following best classifies the deployment of the hardware cryptographic proxy?

Show answer & explanation

Answer: Technical category and Compensating functional type

Answer

Technical category and Compensating functional type
The deployment of an inline hardware cryptographic proxy is executed via automated hardware technology, placing it firmly within the Technical (Logical) control category. Functionally, because native TLS 1.3 application encryption (the baseline primary control) cannot be implemented due to legacy system limitations, the proxy serves as an alternative control to achieve equivalent data protection. Controls implemented to satisfy a security requirement when a primary control is unfeasible are classified as Compensating controls.

Step-by-Step Solution

1
Determine the security control category
Identified as Technical category
The control consists of an inline hardware appliance executing cryptographic encapsulation routines autonomously, which falls under logical/technical mechanisms rather than human operations or administrative policies.
2
Determine the functional control type based on the operational context
Identified as Compensating functional type
The primary control requirement (native TLS 1.3 support on the legacy mainframe) is technically impossible to achieve without system replacement. Deploying an external hardware proxy satisfies the overarching security objective (protecting data in transit) as an explicit alternative mitigation.
3
Combine category and functional type classifications
Technical category + Compensating functional type
Synthesizing both dimensions yields a technical compensating control.

Key Concept

Security Control Categories and Functional Types
Question 227Question →

A security team deploys automated log parsing software that continuously analyzes server event logs to identify and flag unauthorized login attempts as they occur. Which functional control type is best demonstrated by this measure?

Show answer & explanation

Answer: Detective control

Answer

The measure is best classified as a Detective control.
The correct answer is the detective control because automated log parsing software functions to discover and report unauthorized activity, which aligns directly with the goal of detective controls under CompTIA Security+ framework definitions.

Step-by-Step Solution

1
Analyze the primary function of the security control in the scenario.
The control scans server logs to spot and flag unauthorized login attempts as they happen.
Identifying the operational objective of a control determines its functional classification.
2
Map the security objective to CompTIA Security+ functional control types.
Controls designed to observe, log, analyze, and alert on security events are defined as detective controls.
Detective mechanisms focus on threat discovery and event identification rather than prevention, deterrence, or remediation.

Key Concept

Security Control Functional Types (Detective Controls)
Question 228Question →

Match each cryptographic mechanism to its primary operational security objective.

Click a left item, then click its matching right item

Items

Key Stretching
Password Salting
Perfect Forward Secrecy
Homomorphic Encryption

Matches

Show answer & explanation

Answer

Key Stretching matches with repeatedly executing an algorithm to increase computational cost and impede offline brute-force attempts. Password Salting matches with adding unique random bytes to credentials prior to hashing to prevent precomputed rainbow table attacks. Perfect Forward Secrecy matches with generating unique ephemeral session keys so that compromising a long-term key does not decrypt past sessions. Homomorphic Encryption matches with enabling mathematical processing directly on encrypted data without needing to decrypt it first.
Each cryptographic technique aligns with a distinct operational goal: Key stretching increases computational difficulty against offline cracking; Password salting defeats precomputed hash lookups; Perfect Forward Secrecy protects recorded historical traffic using ephemeral keys; Homomorphic encryption enables calculations on ciphertexts without exposing plaintext.

Step-by-Step Solution

1
Identify the purpose of Key Stretching.
Key stretching algorithms (such as PBKDF2 or bcrypt) iterate a cryptographic hash function thousands of times to add execution overhead.
This directly increases computational cost for attackers performing offline brute-force attacks.
2
Identify the purpose of Password Salting.
Salting prepends or appends unique random bits to passwords before computing their digests.
This guarantees unique hash outputs for identical passwords, neutralizing precomputed rainbow table lookups.
3
Identify the purpose of Perfect Forward Secrecy.
Perfect Forward Secrecy uses ephemeral key exchange algorithms (like ECDHE) to generate distinct session keys for every communication session.
This ensures that compromise of a long-term private key does not compromise past encrypted sessions.
4
Identify the purpose of Homomorphic Encryption.
Homomorphic encryption allows third parties to compute operations directly on ciphertexts.
This enables secure data analysis in untrusted environments without decrypting data to plaintext.

Key Concept

Cryptographic Concepts and Algorithms
Question 229Question →

A DevOps security architect is establishing an automated firmware distribution pipeline for remote edge devices operating on untrusted networks. The security baseline mandates a mechanism that guarantees payload data integrity, authenticates the vendor build system as the source, and provides non-repudiation so the authoring system cannot deny issuing a specific release. Which of the following cryptographic controls should the architect implement?

Show answer & explanation

Answer: Digital signatures created using the vendor build system's asymmetric private key over a SHA-256 digest

Answer

Digital signatures created using the vendor build system's asymmetric private key over a SHA-256 digest
A digital signature is created by computing a cryptographic hash of the message (such as SHA-256) and encrypting that hash value using the sender's asymmetric private key. Recipients verify the signature using the corresponding public key. Because only the build server controls the private key, valid signatures provide proof of origin, data integrity, and non-repudiation.

Step-by-Step Solution

1
Identify the required cryptographic properties from the scenario
The requirements explicitly call for data integrity, source authentication, and non-repudiation.
Non-repudiation requires a mechanism where only one specific entity possesses the private key used to sign the data.
2
Evaluate symmetric vs. asymmetric cryptographic mechanisms
Symmetric keys (such as AES-GCM or HMAC shared keys) are shared between sender and recipient, meaning recipient systems could forge payloads, which invalidates non-repudiation.
Asymmetric cryptography provides asymmetric key pairs (private/public), ensuring only the private key holder can create valid signatures.
3
Select the proper asymmetric implementation for firmware integrity and non-repudiation
Hashing the firmware with SHA-256 and encrypting the digest with the build server's private key forms a digital signature that edge devices verify using the public key.
This guarantees integrity (via SHA-256), source origin authentication, and non-repudiation (only the build server holds the private key).

Key Concept

Digital Signatures and Non-Repudiation
Estimated Time:2m 0s
Question 230Question →

An enterprise security architect is standardizing cryptographic controls across a zero-trust network infrastructure. Match each security design requirement on the left with the most appropriate cryptographic mechanism or algorithm on the right.

Click a left item, then click its matching right item

Items

Negotiating a transient shared secret over an untrusted channel to provide Perfect Forward Secrecy (PFS) for TLS sessions
Providing simultaneous payload confidentiality, integrity verification, and origin authenticity in a single symmetric operation
Mitigating offline GPU-accelerated brute-force attacks against stored user credential hashes using configurable memory-hard work factors
Ensuring non-repudiation and origin verification for published software updates without encrypting the file binary itself

Matches

Show answer & explanation

Answer

1. Negotiating a transient shared secret with PFS matches ECDHE; 2. Simultaneous confidentiality, integrity, and authenticity matches AES-GCM; 3. Mitigating GPU brute-force cracking of stored credentials matches Argon2id; 4. Non-repudiation for software updates without payload encryption matches ECDSA.
Each requirement directly aligns with the operational purpose of the corresponding cryptographic primitive: ECDHE for forward-secret key exchange, AES-GCM for authenticated symmetric encryption, Argon2id for memory-hard credential hashing, and ECDSA for asymmetric digital signatures.

Step-by-Step Solution

1
Analyze key exchange requirements for session key forward secrecy.
Ephemeral Diffie-Hellman key exchanges (like ECDHE) generate temporary key pairs per session, guaranteeing Perfect Forward Secrecy.
Static asymmetric keys (like basic RSA or DH) do not satisfy PFS requirements because private key compromise exposes past traffic.
2
Evaluate cipher modes for combined confidentiality and integrity protection.
Galois/Counter Mode (GCM) is an AEAD mode combining AES block cipher encryption with Galois field authentication.
Standard block modes like CBC require a separate MAC algorithm (e.g., HMAC) to achieve authenticated encryption.
3
Determine password hashing mechanisms designed for high compute/memory cost.
Argon2id incorporates salt and deliberate CPU/memory overheads to neutralize parallelized cracking hardware.
Standard fast hash functions (SHA-256) are vulnerable to rapid GPU dictionary attacks when applied directly to passwords.
4
Identify asymmetric mechanisms providing non-repudiation for cleartext payloads.
Digital signatures (such as ECDSA) sign a digest of the payload using a private key, ensuring origin verification without requiring data encryption.
Public key encryption provides confidentiality rather than payload signing for unencrypted public distribution.

Key Concept

Cryptographic Concepts and Algorithms
Question 231Question →

A security engineer is configuring cryptographic primitives for a high-throughput financial microservice architecture. The system must establish session keys over untrusted networks ensuring Perfect Forward Secrecy (PFS), while also supporting high-speed authenticated bulk data encryption for payload storage. Which of the following cryptographic mechanisms should the engineer implement to satisfy BOTH requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange; Advanced Encryption Standard in Galois/Counter Mode (AES-GCM)

Answer

The engineer should select Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange for Perfect Forward Secrecy and Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) for high-speed authenticated bulk data encryption.
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) generates temporary keys per session to ensure Perfect Forward Secrecy (PFS). Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) is an authenticated symmetric encryption algorithm designed for high-performance bulk data confidentiality and integrity.

Step-by-Step Solution

1
Analyze the requirement for Perfect Forward Secrecy (PFS) during session key negotiation.
Identify that ephemeral key exchange algorithms like ECDHE generate unique, disposable session keys that prevent past sessions from being decrypted if long-term private keys are compromised.
Static asymmetric methods like traditional RSA key exchange do not support ephemeral keying.
2
Analyze the requirement for high-speed authenticated bulk payload encryption.
Identify symmetric block ciphers operating in authenticated encryption modes, specifically AES-GCM, which offer hardware-accelerated confidentiality and built-in integrity checking.
Asymmetric encryption and digital signature algorithms are computationally intensive and unsuitable for bulk payload confidentiality.
3
Select the correct combination of cryptographic primitives based on operational requirements.
Choose ECDHE for session key establishment and AES-GCM for bulk payload protection.
These mechanisms satisfy both PFS and high-speed authenticated encryption needs directly.

Key Concept

Cryptographic Algorithms and Key Exchange Properties
Question 232Question →

An enterprise security architecture team discovers that a legacy mainframe application processing sensitive financial transactions cannot support native transport layer encryption due to application stack limitations. To mitigate the risk of unauthorized data exposure across internal network segments without modifying legacy software, the team deploys an encrypted IPSec tunnel overlay between dedicated network gateway appliances. Which of the following best classifies both the control category and the functional control type of this IPSec tunnel implementation?

Show answer & explanation

Answer: Technical category and Compensating functional type

Answer

Technical category and Compensating functional type
The implementation utilizes network devices and cryptographic algorithms (Technical category) to provide an alternative mitigation path when the baseline security requirement cannot be directly integrated into the legacy software (Compensating functional type).

Step-by-Step Solution

1
Analyze the underlying mechanism to determine the control category.
The control is realized using network hardware, specialized appliances, and cryptographic protocols (IPSec), placing it firmly in the Technical category.
Technical controls (also called logical controls) use hardware, software, or firmware mechanisms to execute security protections.
2
Analyze the deployment rationale to determine the functional control type.
The IPSec overlay is implemented specifically because the legacy application cannot support the primary requirement of native transport layer encryption, designating it as a Compensating control type.
Compensating controls are alternative security measures put in place to achieve the intent of a primary security standard when the primary control is technically unfeasible or prohibitive to implement.

Key Concept

Dual-Axis Security Control Classification (Categories vs. Functional Types)
Question 233Question →

A security administrator is evaluating enterprise security controls to classify them by control category. Which of the following security measures are classified as technical controls? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implementing full-disk encryption on corporate laptops using AES-256; Configuring firewall access control lists (ACLs) to block unauthorized network traffic

Answer

Implementing full-disk encryption on corporate laptops using AES-256 and configuring firewall access control lists (ACLs) to block unauthorized network traffic are technical controls.
Full-disk encryption and firewall access control lists (ACLs) are both technical controls because they are implemented through computer hardware, software, or firmware mechanisms. Full-disk encryption uses software/hardware cryptographic algorithms to protect data at rest, while firewall ACLs use automated network software logic to filter incoming and outgoing network traffic.

Step-by-Step Solution

1
Define technical security controls based on CompTIA Security+ standards.
Technical controls are security controls that are executed and enforced by computer hardware, software, or automated system logic.
Distinguishing technical controls from operational, managerial, and physical controls requires determining whether technological systems automate the enforcement.
2
Analyze each option provided in the scenario.
Full-disk encryption and firewall access control lists rely on system software and network hardware logic. Security awareness training relies on human behavior/policies, and security guards rely on physical personnel.
Evaluating each item isolates the measures implemented via computer technology.

Key Concept

Technical Security Control Categories
Question 234Question →

A security administrator is configuring disk-level encryption for an enterprise storage network containing high-volume database files. The encryption solution must provide data confidentiality for bulk data while maintaining fast processing speeds and low performance overhead. Which of the following cryptographic approaches is best suited for this task?

Show answer & explanation

Answer: Symmetric encryption algorithm

Answer

Symmetric encryption algorithm
Symmetric encryption algorithms use a single secret key for both encryption and decryption operations. Their low mathematical complexity yields very high execution speed, making symmetric encryption the standard approach for bulk data-at-rest protection.

Step-by-Step Solution

1
Identify the primary requirement in the scenario
The system requires high-speed bulk data confidentiality at rest with low computational overhead.
Bulk storage encryption must process massive amounts of data without causing throughput bottlenecks.
2
Evaluate the algorithm categories against performance requirements
Symmetric algorithms (such as AES) perform encryption and decryption rapidly using a single key, making them ideal for bulk data.
Asymmetric encryption is computationally heavy, hashing is non-reversible, and Diffie-Hellman is a key exchange method rather than a data encryption algorithm.

Key Concept

Symmetric vs. Asymmetric Encryption Use Cases
Estimated Time:45s
Question 235Question →

An enterprise security administrator is deploying a high-volume public web service that requires TLS mutual authentication (mTLS) for client devices and automated certificate lifecycle management. The administrator must ensure that client certificate status checks are optimized for minimal latency without exposing the internal Certificate Authority (CA) to external query floods, while also establishing an automated, secure enrollment mechanism for enterprise endpoint certificates. Which of the following technical controls and configurations should the administrator implement to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Online Certificate Status Protocol (OCSP) stapling on the web server to append cached, digitally signed CA revocation responses to client TLS handshakes.; Implement Automated Certificate Management Environment (ACME) with standardized challenge protocols to automate certificate request and issuance for enterprise endpoints.

Answer

The administrator should configure OCSP stapling on the web server to optimize revocation checks without exposing the CA, and deploy the Automated Certificate Management Environment (ACME) protocol to automate endpoint certificate enrollment.
Enabling OCSP stapling delegates the burden of fetching digitally signed revocation status to the web server itself, which appends the OCSP response into the TLS handshake, reducing latency and shielding the CA from direct client queries. Utilizing ACME automates key pair creation, challenge verification, CSR submission, and certificate installation across endpoints securely.

Step-by-Step Solution

1
Evaluate revocation checking optimization requirements.
Identify that OCSP stapling caches signed revocation status directly on the web server, eliminating client-to-CA query latency and protecting internal CA infrastructure from external traffic spikes.
Direct CRL downloads or direct OCSP querying by clients introduce performance bottlenecks and privacy issues.
2
Evaluate automated certificate lifecycle management options.
Identify ACME as the standard open protocol for automated domain validation, key issuance, and certificate renewal.
Manual CSR processing and centralized private key distribution violate PKI key security principles and scalability standards.

Key Concept

PKI Certificate Lifecycle Automation and Revocation Optimization
Question 236Question →

An organization is evaluating its security architecture following a comprehensive risk assessment. Match each enterprise security measure to its correct dual-axis classification (Category and Functional Type) according to CompTIA Security+ standards.

Click a left item, then click its matching right item

Items

Mandatory annual security awareness training enforcing mandatory employee compliance with acceptable use policies
An automated endpoint script that isolates a compromised workstation from the subnet upon detecting command-and-control beaconing
A biometric access-controlled mantrap entry system protecting the perimeter of a primary data center
A segmented jump server with heightened logging deployed temporarily for administrative access while legacy servers undergo MFA retrofitting

Matches

Show answer & explanation

Answer

1. Annual awareness training maps to Managerial Category / Directive Type. 2. Automated host isolation script maps to Technical Category / Corrective Type. 3. Biometric mantrap system maps to Physical Category / Preventive Type. 4. Segmented jump server fallback maps to Technical Category / Compensating Type.
Each security control is accurately categorized by implementation method (Managerial, Technical, Physical) and functional purpose (Directive, Corrective, Preventive, Compensating). Policy sign-offs direct behavior (Managerial/Directive); host isolation mitigates ongoing attack damage (Technical/Corrective); physical mantraps prevent unauthorized entry (Physical/Preventive); and jump boxes act as substitute technical measures for legacy systems (Technical/Compensating).

Step-by-Step Solution

1
Analyze the primary category (Managerial, Operational, Technical, Physical) for each mechanism based on its underlying operational domain.
Training/policy is Managerial; automated endpoint script is Technical; mantrap facility hardware is Physical; jump server infrastructure is Technical.
Control categories are determined by how the control is implemented—via policy/governance, physical assets, human operations, or system logic.
2
Determine the functional goal (Preventive, Deterrent, Detective, Corrective, Compensating, Directive) for each mechanism.
Training directs compliance (Directive); isolation remediates active threat impact (Corrective); mantraps block unauthorized access (Preventive); jump server replaces missing native controls (Compensating).
Functional types define the operational intent relative to security incidents (before, during, after, or in place of primary controls).
3
Pair each implementation with its corresponding dual-axis category and functional type classification.
All four pairings are established cleanly based on CompTIA Security+ SY0-701 standard taxonomy definitions.
Correct mapping requires aligning both the category axis and functional type axis simultaneously.

Key Concept

Security Control Categories and Functional Types
Question 237Question →

An organization is modernizing its security controls by adopting Zero Trust Architecture (ZTA) principles across its enterprise environment. Match each core Zero Trust principle on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Items

Implicit Trust Elimination
Microsegmentation
Continuous Verification
Least Privilege Access

Matches

Show answer & explanation

Answer

Implicit Trust Elimination pairs with treating all network locations as untrusted; Microsegmentation pairs with isolating network workloads into granular enclaves; Continuous Verification pairs with dynamically re-evaluating context throughout an active session; Least Privilege Access pairs with granting permissions strictly on a per-resource and per-request basis.
Each Zero Trust principle correctly aligns with its operational definition: Implicit Trust Elimination treats all network environments as untrusted; Microsegmentation isolates workloads into granular enclaves; Continuous Verification continuously evaluates risk across the session lifetime; Least Privilege Access restricts privileges strictly to required resources per transaction.

Step-by-Step Solution

1
Evaluate 'Implicit Trust Elimination'
Matches treating all network zones as untrusted boundaries requiring explicit validation.
Zero Trust discards the concept of a trusted internal network segment.
2
Evaluate 'Microsegmentation'
Matches isolating workloads into granular enclaves to prevent lateral movement.
Partitioning resources creates strict micro-perimeters around individual applications or assets.
3
Evaluate 'Continuous Verification'
Matches dynamically re-evaluating identity and risk throughout an active connection.
Zero Trust requires real-time monitoring of user and device state beyond initial authentication.
4
Evaluate 'Least Privilege Access'
Matches granting rights strictly on a per-resource and per-request basis.
Access is scoped strictly to what is necessary for the specific requested operation.

Key Concept

Zero Trust Architecture Core Tenets
Estimated Time:1m 30s
Question 238Question →

A network administrator is setting up a new secure web server and needs to obtain an X.509 digital certificate from an enterprise Certificate Authority (CA). Which of the following actions should the administrator perform first on the server?

Show answer & explanation

Answer: Generate a private key and create a Certificate Signing Request (CSR)

Answer

The administrator must first generate a key pair and create a Certificate Signing Request (CSR) on the web server.
Generating a private key and creating a Certificate Signing Request (CSR) is the first standard step in obtaining an SSL/TLS certificate. The CSR contains the server's public key along with identifying information (such as domain name and organization) which is sent to the Certificate Authority for validation and signing.

Step-by-Step Solution

1
Identify the initial phase of PKI certificate enrollment.
The server needs to generate an asymmetric key pair (public and private keys).
The private key stays securely on the server, while the public key must be packaged for the Certificate Authority.
2
Package the public key with identifying details.
A Certificate Signing Request (CSR) is generated.
The CSR includes identity information (such as Common Name/SAN) and the public key, which the CA signs to produce the digital certificate.

Key Concept

PKI Certificate Request Workflow
Question 239Question →

A software development team is building an automated third-party API webhook receiver to process incoming transaction status updates. The security specification requires that the receiver must verify both the data integrity and origin authenticity of each incoming payload using a shared secret key, while avoiding the processing overhead associated with public key cryptography. Which cryptographic mechanism should the team implement to meet these requirements?

Show answer & explanation

Answer: Hash-based Message Authentication Code (HMAC)

Answer

The team should implement Hash-based Message Authentication Code (HMAC) to fulfill the integrity and origin authenticity requirements using a shared secret key.
Hash-based Message Authentication Code (HMAC) combines a symmetric shared secret key with a cryptographic hash function (such as SHA-256) to ensure both message integrity and sender origin authenticity. Because HMAC relies on symmetric shared secrets rather than public key infrastructure, it provides fast processing speeds suitable for high-throughput API webhooks.

Step-by-Step Solution

1
Analyze the operational requirements provided in the scenario.
Identified the need to verify data integrity and origin authenticity using a symmetric shared secret key without public key encryption overhead.
The system requires an efficient, low-overhead cryptographic method tailored for symmetric sender authentication.
2
Evaluate candidate cryptographic mechanisms against the identified constraints.
Hash-based Message Authentication Code (HMAC) uses a symmetric key combined with a hash function (e.g., SHA-256), satisfying both integrity and origin authenticity requirements at high speed.
Only a secret-keyed hash mechanism delivers symmetric origin verification and payload integrity without asymmetric computational costs.

Key Concept

Hash-based Message Authentication Code (HMAC)
Question 240Question →

A senior security architect is updating an enterprise security standard to enforce modern cryptographic controls across cloud, archive, hardware, and transport systems. Match each operational cryptographic requirement on the left to the corresponding technical concept or mechanism on the right.

Click a left item, then click its matching right item

Items

Performing mathematical calculations directly on encrypted datasets hosted in a multi-tenant cloud analytics platform without decrypting the data
Protecting long-term sensitive archive data against harvest-now-decrypt-later eavesdropping intended for future decryption by quantum computers
Securely encapsulating symmetric Data Encryption Keys (DEKs) for safe export and inter-facility transfer using a hardware root of trust key
Concealing covert maintenance commands within the least significant bits of image files transmitted over unencrypted monitoring feeds

Matches

Show answer & explanation

Answer

Homomorphic encryption pairs with performing calculations on encrypted data; Post-quantum cryptography pairs with defending against future quantum decryption of archived data; HSM key wrapping pairs with encapsulating Data Encryption Keys for transfer using a hardware root of trust; Steganography pairs with concealing commands inside the least significant bits of image files.
Each requirement strictly maps to its specialized cryptographic control: Homomorphic encryption allows cloud compute on encrypted data without decryption; Post-quantum cryptography mitigates future quantum decryption risks against intercepted archives; HSM key wrapping protects keys in transit by encrypting DEKs with KEKs managed by hardware; Steganography hides payload content within image files.

Step-by-Step Solution

1
Analyze the requirement for processing encrypted cloud data without decryption.
Identify that Homomorphic Encryption enables mathematical operations directly on ciphertext while preserving privacy from the host.
Traditional symmetric and asymmetric ciphers require plaintext exposure in memory to perform arithmetic operations.
2
Analyze the threat vector of adversaries capturing encrypted archives today to decrypt them when quantum computing matures.
Identify Post-quantum cryptography (quantum-resistant algorithms) as the control designed to withstand quantum cryptanalytic attacks like Shor's algorithm.
Standard RSA and ECC asymmetric algorithms are vulnerable to quantum factoring, requiring new mathematical primitives.
3
Examine the process of exporting symmetric encryption keys safely using dedicated crypto hardware.
Match HSM key wrapping as the practice of encrypting session keys or DEKs with a master Key Encryption Key residing within an HSM enclave.
Plaintext key transport exposes secrets in memory; key wrapping guarantees keys remain encrypted during transit across boundaries.
4
Evaluate the technique of hiding data inside image files using least significant bit alteration.
Match this obfuscation method to Steganography.
Steganography focuses on hiding the existence of a message rather than rendering message contents unreadable.

Key Concept

Cryptographic Primitives and Advanced Operational Controls
PreviousPage 12 / 14Next
General Security Concepts Practice Questions — CompTIA Security+ — Page 12 | Examkin