Examkin

General Security Concepts

268 questions

All types268Multiple choice139Multiple select58Matching57Ordering14
Question 241Question →

During an enterprise infrastructure hardening project, a security architect is tasked with selecting controls that are classified as technical controls and function specifically in a preventive capacity. Which of the following security measures meet both of these criteria? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An inline Intrusion Prevention System (IPS) configured to inspect network traffic and automatically drop packets matching malicious signatures; An automated host-based firewall rule that blocks incoming connections on unapproved network ports

Answer

The controls that are both technical and preventive are the inline Intrusion Prevention System (IPS) configured to drop malicious packets and the automated host-based firewall rule blocking unapproved ports.
Both the inline Intrusion Prevention System (IPS) and the host-based firewall rule are technical controls because they are implemented directly in software/hardware systems. Furthermore, both act preventively by actively blocking or dropping unauthorized and malicious network traffic before access to target assets is achieved.

Step-by-Step Solution

1
Identify the primary security control category requested
Technical controls rely on technology, hardware, or software mechanisms (e.g., firewalls, IPS, ACLs, encryption).
Categorization differentiates technological enforcement from administrative policies or physical barriers.
2
Identify the functional control type requested
Preventive controls proactively block or impede unwanted or malicious actions from occurring.
Functional classification evaluates the operational goal of the control during an attack lifecycle.
3
Evaluate each option against both criteria (Technical + Preventive)
The inline IPS drops malicious traffic automatically (Technical + Preventive). Host-based firewall rules block unapproved connections automatically (Technical + Preventive). The SIEM system logs and alerts (Technical + Detective). The written password policy sets administrative rules (Managerial/Directive + Preventive).
Dual-axis classification requires satisfying both the category (how it is implemented) and type (what operational function it performs).

Key Concept

Security Control Categories (Technical, Managerial, Operational, Physical) and Functional Types (Preventive, Detective, Corrective, Deterrent, Compensating, Directive)
Question 242Question →

An enterprise cloud engineering team is migrating a legacy microservices architecture to align with NIST SP 800-207 Zero Trust Architecture (ZTA) principles. The modern architecture spans hybrid cloud environments and supports both remote and on-premise users. Which of the following technical design choices directly reflect core Zero Trust Architecture principles? (Select THREE)

Select all that apply

Show answer & explanation

Answer: Evaluating subject identity, device posture, and context dynamically to re-evaluate trust and access rights continuously throughout every session; Establishing microsegmentation boundaries around resources and enforcing mutual TLS (mTLS) for explicit cryptographic validation of all inter-service communications; Applying granular, least-privilege authorization policies tailored specifically to the individual request and target resource sensitivity

Answer

The core Zero Trust principles are implemented by continuously re-evaluating trust throughout every active session, enforcing microsegmentation with explicit per-request cryptographic validation (such as mTLS), and applying strict least-privilege authorization policies per resource request.
Zero Trust Architecture operates on three key pillars: explicit validation, continuous verification, and least privilege access. Dynamically evaluating identity and context continuously across active sessions ensures posture changes revoke access immediately. Implementing microsegmentation and mTLS guarantees explicit cryptographic validation for every microservice request without relying on perimeter location. Applying granular least-privilege access ensures subjects only access the specific assets required for their authorized task.

Step-by-Step Solution

1
Identify the foundational tenets of Zero Trust Architecture according to NIST SP 800-207
Zero Trust tenets specify that all communication is secured regardless of network location, access is granted per session with least privilege, and access is evaluated dynamically using continuous context.
ZTA removes implicit trust from internal networks and shifts security enforcement to granular policy evaluation.
2
Evaluate each offered technical design choice against ZTA tenets
Dynamic continuous evaluation, inter-service mTLS microsegmentation, and granular least-privilege access align directly with ZTA principles. Network perimeter trust and delegating resource authorization to perimeter firewalls violate ZTA.
Zero Trust requires explicit validation and continuous policy enforcement directly protecting each asset.

Key Concept

Zero Trust Architecture Core Tenets (NIST SP 800-207)
Question 243Question →

A security operations team wants to detect unauthorized lateral movement and Kerberoasting attacks within their Active Directory domain without modifying host configurations or deploying dedicated virtual servers. The team creates a fake domain account configured with a Service Principal Name (SPN) and monitors domain controller logs for any Ticket Granting Service (TGS) request targeting this account. Which of the following deception technologies has the team deployed?

Show answer & explanation

Answer: Honeytoken

Answer

Honeytoken
The implementation of a fake Active Directory account with a Service Principal Name specifically designed to trigger alerts upon access represents a honeytoken. Honeytokens are decoy credentials, files, or database records placed within production environments to lure attackers and trigger high-confidence alerts when queried or compromised.

Step-by-Step Solution

1
Analyze the scenario details and requirements.
The team injected a fake credential asset (a decoy SPN) into Active Directory to alert when queried by adversaries.
Identifying the type of decoy asset helps distinguish between host-level decoys and data-level decoys.
2
Evaluate the mechanism against deception technology classifications.
Decoy data items such as fake database records, fake credentials, or fake SPNs are classified as honeytokens.
Honeytokens monitor unauthorized access to non-production data assets placed directly within existing systems.
3
Differentiate from honeypots, sinkholes, and preventive security controls.
No virtual server or service emulation is deployed (ruling out honeypots), and no network traffic filtering occurs (ruling out sinkholes and firewalls).
Honeypots require dedicated host or service emulation, whereas honeytokens are lightweight data artifacts.

Key Concept

Deception Technologies - Honeytokens
Question 244Question →

A security administrator is reviewing identity management definitions for new security operations team members. Match each access control phase of the AAA framework on the left with its corresponding operational security scenario on the right.

Click a left item, then click its matching right item

Items

Identification
Authentication
Authorization
Accounting

Matches

Show answer & explanation

Answer

Identification matches entering a unique username to claim identity; Authentication matches validating a password and TOTP code to prove identity; Authorization matches evaluating security policies to grant network subnet access; Accounting matches collecting log entries detailing session times and bandwidth usage.
Each phase of the access control model serves a distinct security role: Identification claims identity via an identifier (username); Authentication verifies that claim using credentials (password + TOTP); Authorization enforces access permissions (firewall rules); and Accounting logs resource usage and activity (SIEM/RADIUS session logs).

Step-by-Step Solution

1
Distinguish between Identification and Authentication
Entering a username simply claims identity (Identification), while verifying credentials like passwords and TOTP codes proves that identity (Authentication).
Identification must precede authentication in the identity lifecycle.
2
Define Authorization controls
Evaluating firewall security policies to permit or restrict access to specific network resources aligns directly with enforcing access permissions (Authorization).
Authorization dictates what an authenticated entity is permitted to do.
3
Identify Accounting functions
Collecting session start/stop times, command histories, and bandwidth logs on a SIEM or RADIUS server fulfills auditing and tracking requirements (Accounting).
Accounting creates non-repudiable audit logs of user activity.

Key Concept

Authentication, Authorization, and Accounting (AAA) Framework
Question 245Question →

Following a compliance audit, an enterprise security team identifies that a legacy industrial control server hosting critical operational technology cannot support endpoint detection and response (EDR) agents or full-disk encryption due to system resource constraints. To satisfy the security standard without taking the legacy system offline, the team installs a dedicated inline micro-segmentation appliance with access control lists restricted strictly to authorized jump boxes. Which of the following best classifies the security control category and functional type of this newly deployed appliance?

Show answer & explanation

Answer: Technical category and compensating control type

Answer

Technical category and compensating control type
The correct response identifies the appliance as a technical control because it relies on network hardware and automated rule logic, and as a compensating control because it provides alternative protection when the primary required security controls (EDR and encryption) cannot be implemented.

Step-by-Step Solution

1
Determine the security control category based on execution mechanism.
Because an inline micro-segmentation hardware appliance enforcement tool is system-implemented technology, it falls under the Technical control category.
Technical controls (also known as logical controls) use hardware, software, or firmware mechanisms.
2
Determine the functional type based on the strategic objective in the scenario.
The control was implemented to satisfy a security mandatory standard (EDR/encryption) when the primary solution could not be supported by legacy hardware, making it a Compensating control type.
Compensating controls provide an alternative measure that achieves equivalent security protection when primary security controls are unfeasible.

Key Concept

Dual-axis classification of security control categories and functional types
Question 246Question →

An enterprise security team plans to modify central authentication controls to enforce hardware-based multi-factor authentication across production subnets. To ensure operational continuity and minimize security risks, the team must follow the organization's formal change management process. Place the following change management steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with submitting a formal change request and security impact assessment, obtaining Change Advisory Board approval, conducting staging tests and rollback verification, executing the change during an authorized maintenance window, and concluding with post-implementation verification and CMDB updating.
Standard change management follows a structured lifecycle to control risk: documentation and impact assessment, formal approval by the Change Advisory Board, non-production staging and backout plan testing, scheduled production execution, and post-implementation auditing with baseline configuration updates.

Step-by-Step Solution

1
Identify the initial phase of formal change governance.
The change request and security impact assessment are drafted and submitted first.
A formal proposal detailing the scope, potential security vulnerabilities, and affected systems is mandatory before governance bodies can evaluate the risk.
2
Determine the required governance review and approval stage.
The change request is submitted to the Change Advisory Board (CAB) for approval.
The CAB must evaluate organizational impact, resource availability, and scheduling conflicts prior to technical execution.
3
Determine the pre-implementation risk mitigation stage.
The policy change is validated in a staging environment and the rollback procedure is tested.
Testing in non-production validates functionality and ensures a safe fallback mechanism exists before modifying production systems.
4
Identify the production implementation step.
The deployment is executed during the scheduled maintenance window.
Implementing changes during designated low-impact windows minimizes disruption to live operational business services.
5
Identify the final closure and baseline updating phase.
Post-implementation security testing is conducted and the CMDB baseline is updated.
Verifying production stability ensures security requirements are met, while updating the CMDB records the new operational baseline for compliance and auditing.

Key Concept

Change Management Lifecycle and Security Control Implementation
Question 247Question →

A system administrator is preparing to obtain a new TLS certificate for an internal server from the enterprise Certificate Authority (CA). Which of the following tasks must be completed on the server during the initial certificate request workflow? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Generate a asymmetric key pair consisting of a private key and a public key; Create a Certificate Signing Request (CSR) containing the server's public key and identity details

Answer

The server administrator must generate an asymmetric key pair on the server and create a Certificate Signing Request (CSR) containing the public key to send to the CA.
To obtain a signed digital certificate from a CA, the requesting server must first generate its own asymmetric key pair (private and public key) and then bundle the public key along with server identity attributes into a Certificate Signing Request (CSR) submitted to the CA.

Step-by-Step Solution

1
Generate Key Pair
Creation of the server's private key and matching public key.
The server needs a private key for decryption/signing and a public key to distribute via the signed certificate.
2
Create Certificate Signing Request (CSR)
A formatted request file containing the public key and server identity attributes.
The CA requires the CSR to verify requested identity attributes and sign the public key to issue an X.509 certificate.

Key Concept

PKI Certificate Enrollment and CSR Generation Workflow
Question 248Question →

A security analyst is hardening an internal web application's authentication module. An audit reveals two major vulnerabilities: session identifiers are predictable due to weak random seed generation, and user passwords stored in the database are susceptible to rapid offline dictionary and GPU-accelerated rainbow table attacks. Which of the following cryptographic techniques should the security analyst implement to mitigate both vulnerabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Utilize key stretching algorithms such as Argon2 or PBKDF2 combined with unique per-user salts for credential storage.; Generate session identifiers using a Cryptographically Secure Pseudorandom Number Generator (CSPRNG).

Answer

The analyst should implement key stretching algorithms (such as Argon2 or PBKDF2) with unique per-user salts for credential storage, and use a Cryptographically Secure Pseudorandom Number Generator (CSPRNG) for session token generation.
To secure session tokens against prediction, a Cryptographically Secure Pseudorandom Number Generator (CSPRNG) must be used to ensure high entropy. To protect stored credentials against offline GPU cracking and rainbow tables, key stretching algorithms like Argon2 or PBKDF2 are required because they introduce artificial computational delay and memory requirements while incorporating unique salts per user.

Step-by-Step Solution

1
Analyze the session token predictability vulnerability.
Identify that session tokens require high entropy and cryptographic unpredictability.
Standard pseudo-random number generators use deterministic algorithms that allow attackers to guess session keys if the seed is discovered.
2
Select the appropriate mechanism for session token generation.
Implement a Cryptographically Secure Pseudorandom Number Generator (CSPRNG).
CSPRNGs are specifically designed to produce output that is statistically indistinguishable from true random numbers.
3
Analyze the password storage cracking vulnerability.
Identify that plain hashing is vulnerable to fast GPU cracking and precomputed rainbow tables.
High-throughput hash functions like standard SHA-256 can be computed billions of times per second on GPU arrays.
4
Select the appropriate mechanism for secure password storage.
Enforce key stretching (Argon2 or PBKDF2) along with salting.
Salting neutralizes rainbow tables by making every hash unique, while key stretching intentionally slows down computation to thwart brute-force cracking.

Key Concept

Cryptographic Key Stretching, Salting, and CSPRNG Randomness
Question 249Question →

An organization's infrastructure team plans to enable HTTP/3 (QUIC) across all enterprise edge load balancers to reduce web application latency. Because HTTP/3 utilizes UDP port 443 instead of traditional TCP port 443, the team must perform a security impact analysis before presenting the proposal to the Change Advisory Board (CAB). Which of the following represents the primary security impact that must be evaluated during this change management step?

Show answer & explanation

Answer: Existing deep packet inspection and network intrusion prevention rules tuned for TCP port 443 traffic may fail to inspect application-layer payloads.

Answer

Existing deep packet inspection and network intrusion prevention rules tuned for TCP port 443 traffic may fail to inspect application-layer payloads.
Conducting a security impact analysis prior to change implementation requires assessing how infrastructure changes affect existing security controls. HTTP/3 (QUIC) uses UDP port 443 rather than TCP port 443. If network firewalls, web application firewalls, or intrusion prevention systems (IPS) are configured only to inspect TCP traffic on port 443, switching transport to UDP will result in uninspected traffic and a loss of security visibility.

Step-by-Step Solution

1
Identify the technical change proposed in the scenario
Transitioning web application traffic transport from TCP port 443 (HTTP/1.1 and HTTP/2) to UDP port 443 (HTTP/3 via QUIC).
Security impact assessments require analyzing how changes alter technical data paths and network behaviors.
2
Analyze how existing security controls interact with the new protocol
Existing perimeter firewalls, IPS devices, and network monitoring tools configured specifically for TCP streams will not automatically inspect UDP streams on port 443.
Security visibility can be severely compromised if network monitoring tools are not reconfigured or updated to support QUIC inspection.
3
Select the choice that correctly identifies this security vulnerability impact
The option highlighting potential inspection failures for network security devices tuned only for TCP port 443.
Proper change control requires uncovering unexpected security blind spots before deployment.

Key Concept

Security Impact Analysis in Change Management
Estimated Time:1m 30s
Question 250Question →

An enterprise network administrator is configuring centralized access management for core network hardware using a TACACS+ server. To align with the Authentication, Authorization, and Accounting (AAA) framework, which of the following configurations specifically satisfy the Authorization and Accounting pillars? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Restricting specific CLI commands an authenticated administrator can execute based on their assigned role; Recording timestamped entries of executed administrative commands to a centralized audit server

Answer

The correct configurations are restricting specific CLI commands an authenticated administrator can execute based on their assigned role, and recording timestamped entries of executed administrative commands to a centralized audit server.
Authorization defines the specific permissions and executable commands allowed for an authenticated role. Accounting captures timestamped records of user activity to maintain an accurate audit log.

Step-by-Step Solution

1
Identify the core requirements of Authorization and Accounting within AAA.
Authorization specifies permitted privileges and actions, while Accounting records and audits user actions during a session.
Distinguishing between identity verification, permission granting, and logging is essential for accurate classification.
2
Evaluate command restriction controls.
Restricting executable CLI commands by role explicitly determines allowed actions, directly fulfilling Authorization.
Authorization answers what actions an authenticated user is allowed to perform.
3
Evaluate logging controls.
Logging timestamped command executions creates an audit trail of user activity, directly fulfilling Accounting.
Accounting tracks user actions for accountability and auditing purposes.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Question 251Question →

A security administrator is tasked with updating the data protection mechanism for a customer relationship management (CRM) database storing high-volume customer records at rest. The enterprise security policy requires that all stored data be encrypted using a high-speed algorithm that provides confidentiality with low computational overhead. Which of the following cryptographic algorithms should the administrator implement to meet this requirement?

Show answer & explanation

Answer: Advanced Encryption Standard (AES)

Answer

Advanced Encryption Standard (AES)
The Advanced Encryption Standard (AES) is a symmetric block cipher that provides strong data confidentiality with high throughput and low computational cost, making it the ideal choice for bulk database encryption at rest.

Step-by-Step Solution

1
Analyze the operational requirement
Identified the requirement for bulk data-at-rest encryption offering high performance and minimal CPU overhead.
Databases containing millions of records require symmetric ciphers due to their processing efficiency.
2
Evaluate cryptographic algorithm categories
Selected symmetric key cryptography over asymmetric cryptography and key exchange protocols.
Symmetric encryption uses a single shared secret key, operating significantly faster than asymmetric key math.
3
Select the specific compliant algorithm
Advanced Encryption Standard (AES) fulfills all requirements.
AES is the standard symmetric block cipher for high-speed, robust data-at-rest confidentiality.

Key Concept

Symmetric vs. Asymmetric Cryptography for Bulk Data Encryption
Question 252Question →

A software engineering team is preparing to deploy an updated microservice that modifies shared container network policies and ingress routing rules within a production Kubernetes cluster. Which of the following steps must be completed as part of the formal change management workflow to evaluate and mitigate security risks prior to implementation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Conduct security impact testing and dependency analysis within a staging environment that mirrors production configurations.; Establish and validate a documented backout plan to restore previous routing rules and network policies if anomalies occur.

Answer

The change management workflow requires conducting security impact testing in a staging environment that mirrors production and establishing a validated backout plan to restore previous network configurations if issues arise.
Proper change management requires testing proposed changes in a staging environment to assess security impacts and dependencies, alongside maintaining a tested rollback plan to quickly revert changes if security or operational issues arise.

Step-by-Step Solution

1
Analyze the proposed configuration modifications in a non-production staging environment.
Identifies potential access control oversights, broken service dependencies, or unintended network exposures prior to deployment.
Security impact assessment in staging prevents unauthorized network paths from reaching production.
2
Develop and verify a backout procedure prior to change approval.
Ensures immediate recovery to a known good configuration if deployment fails or creates security regressions.
Change management governance mandates documented rollback procedures to preserve system availability and security integrity.

Key Concept

Change Management Security Impact and Rollback Planning
Question 253Question →

A security analyst is designing a secure telemetry collection architecture for edge gateway devices transmitting environmental data to an enterprise cloud endpoint. The design mandates establishing keying material that ensures perfect forward secrecy and validating the authenticity and data integrity of each transmitted payload with minimal performance overhead. Which of the following cryptographic techniques should the analyst select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE); Hash-based Message Authentication Code (HMAC)

Answer

The analyst should select Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for perfect forward secrecy during key negotiation, and Hash-based Message Authentication Code (HMAC) for efficient payload authenticity and integrity verification.
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) provides perfect forward secrecy through per-session temporary key generation, while Hash-based Message Authentication Code (HMAC) provides low-overhead authenticity and integrity checks via symmetric key hashing.

Step-by-Step Solution

1
Evaluate key exchange requirements for Perfect Forward Secrecy (PFS)
Identify that PFS requires ephemeral key exchange algorithms such as ECDHE.
Ephemeral key exchanges generate temporary keys for every session so that compromise of long-term server keys does not reveal past communications.
2
Evaluate payload validation requirements for authenticity and integrity
Identify that lightweight, keyed symmetric hashing such as HMAC satisfies both integrity and authenticity without high computational overhead.
HMAC incorporates a shared secret into the hashing process, ensuring that only authorized keyholders can produce a valid MAC code.

Key Concept

Cryptographic Key Exchange Mechanisms and Message Integrity Verification
Question 254Question →

A security analyst is investigating an automated alert from a cloud-hosted API gateway. A third-party developer successfully logged into the developer portal using single sign-on (SSO) credentials. However, when the developer attempted to issue a DELETE call against a production storage bucket, the API gateway returned a 403 Forbidden error because the developer's OAuth 2.0 access token lacked the required write/delete scope claims. Which pillar of the Authentication, Authorization, and Accounting (AAA) security framework directly enforced the decision to block the DELETE request?

Show answer & explanation

Answer: Authorization

Answer

Authorization is the AAA component that checks scopes and permissions to decide whether a verified identity is allowed to perform a specific action.
Authorization is responsible for determining whether an authenticated subject has permission to access a specific resource or execute a requested operation. Because the developer successfully authenticated via single sign-on, their identity was known; the blocking occurred because the API gateway evaluated the token's scope claims (permissions) and denied access to the DELETE operation.

Step-by-Step Solution

1
Analyze the incident details in the stem
The user successfully logged in (identity verified via SSO), but was denied execution of a specific API endpoint due to missing scope privileges.
Differentiating identity verification from permission enforcement is necessary to map the event to the correct AAA pillar.
2
Evaluate the AAA framework components against the scenario
Authentication validated 'who' the user is. Authorization evaluated 'what' the user is allowed to do (checking OAuth token scopes). Accounting recorded the audit entry.
The blocking of the DELETE operation based on token claims is a permission decision.
3
Select the component responsible for permission enforcement
Authorization directly performed the policy enforcement check.
Authorization governs access control decisions once authentication has occurred.

Key Concept

Authentication, Authorization, and Accounting (AAA) Roles
Estimated Time:1m 15s
Question 255Question →

A security engineer is troubleshooting intermittent connection timeouts and handshake failures reported by users accessing a high-security internal web application. Network logs indicate that client web browsers are attempting to query external Certificate Authority (CA) validation servers to verify the revocation status of the application's TLS certificate. However, client endpoints are on a strict zero-trust VLAN with no outbound internet access, causing the certificate status requests to block and eventually time out. Which of the following should the security engineer implement on the web server to resolve the validation failures while maintaining certificate status checking?

Show answer & explanation

Answer: Enable OCSP stapling on the web server so it periodically fetches and appends a time-stamped CA OCSP response during the TLS handshake.

Answer

Enable OCSP stapling on the web server so it periodically fetches and appends a time-stamped CA OCSP response during the TLS handshake.
Enabling OCSP stapling resolves client-side outbound connectivity issues by offloading OCSP status checks to the web server. The web server periodically contacts the CA's OCSP responder, receives a digitally signed and timestamped status response, and appends ('staples') this proof directly into the TLS handshake (Server Hello). This allows restricted internal clients to verify certificate validity without direct access to external CA servers.

Step-by-Step Solution

1
Analyze the root cause of the connection timeouts
Client browsers are trying to reach external CA infrastructure directly for Online Certificate Status Protocol (OCSP) or CRL verification, which fails because the client VLAN lacks outbound internet egress.
By default, clients perform revocation checks by contacting the CA's OCSP responder listed in the certificate's AIA extension.
2
Evaluate PKI mechanisms that allow revocation checking without client egress access
OCSP stapling (TLS Certificate Status Request extension) delegates the responsibility of querying the OCSP responder to the server itself.
The server queries the CA at configured intervals, caches the time-stamped signed OCSP assertion, and includes it directly in the initial TLS handshake to the client.
3
Verify requirement compliance
Client validation succeeds without requiring outbound client internet access, while maintaining security and resolving handshake latency.
The client receives proof of validity signed directly by the CA without making an independent network call.

Key Concept

OCSP Stapling (TLS Certificate Status Request Extension)
Question 256Question →

A security engineer is updating the firmware verification process for remote, low-power industrial sensor gateways. The firmware update image must be digitally signed by the vendor to verify its origin and integrity before installation. Due to severe memory and processing constraints on the gateway hardware, the solution must provide strong asymmetric security while minimizing key size and computational overhead. Which cryptographic algorithm combination should the engineer select?

Show answer & explanation

Answer: Elliptic Curve Digital Signature Algorithm (ECDSA) with SHA-256

Answer

Elliptic Curve Digital Signature Algorithm (ECDSA) with SHA-256
Elliptic Curve Digital Signature Algorithm (ECDSA) paired with SHA-256 satisfies the requirement for asymmetric digital signatures (enabling non-repudiation and origin authenticity verification) while offering significantly smaller key lengths and lighter computational demands than traditional algorithms like RSA. This makes it the ideal choice for low-power embedded devices.

Step-by-Step Solution

1
Identify the primary cryptographic requirement.
Digital signatures (asymmetric cryptography) are required to verify vendor origin and guarantee non-repudiation.
Symmetric approaches like pre-shared keys or symmetric ciphers cannot prove origin authenticity to third parties without sharing private keys.
2
Evaluate hardware constraints.
The target edge hardware has low processing power and constrained memory.
Large key asymmetric algorithms such as RSA-4096 introduce significant processing latency and memory requirements.
3
Select the optimal lightweight asymmetric signature scheme.
ECDSA combined with SHA-256 provides robust non-repudiation and integrity verification with minimal computational overhead.
Elliptic Curve Cryptography (ECC) achieves high cryptographic strength using much shorter keys than RSA.

Key Concept

Asymmetric Digital Signatures & Elliptic Curve Cryptography
Question 257Question →

A security engineer is auditing an automated provisioning pipeline for a fleet of internal microservice gateways. The deployment script generates a single public/private key pair and Certificate Signing Request (CSR) on a central management server, submits the CSR to the internal Certificate Authority (CA), and then copies the issued certificate and private key over SSH to all target gateway nodes. Which of the following best describes the primary security flaw in this PKI workflow?

Show answer & explanation

Answer: The private key was generated on a central server rather than locally on each target system, increasing the attack surface and violating non-repudiation and key isolation principles.

Answer

The primary flaw is generating the private key on a central server and distributing it to multiple target nodes, which compromises key isolation and exposes private keys over the network.
In proper PKI design, private keys should be generated locally on the target endpoint (or within an associated HSM/TPM) and must never traverse the network. Sharing a single private key across multiple microservice gateways increases the blast radius of a credential compromise and undermines host identification and non-repudiation.

Step-by-Step Solution

1
Analyze the PKI key generation and CSR workflow described in the scenario.
The workflow generates one key pair on a central server and pushes both the certificate and private key to multiple target nodes over SSH.
Understanding key lifecycle boundaries is necessary to identify architectural security risks.
2
Evaluate standard PKI best practices regarding private key containment.
Private keys must never leave the boundary of the host that generated them (or its Hardware Security Module) and must be unique per endpoint.
Distributing a shared private key over the network creates a single point of failure and allows compromise of one node to impact all nodes.
3
Identify the correct administrative remediation for automated enrollment.
Each microservice gateway node should generate its own local key pair, create its own unique CSR, and receive its signed certificate individually.
Local key generation ensures proper key isolation, preserves non-repudiation, and limits the blast radius of host compromises.

Key Concept

PKI Certificate Enrollment and Key Generation Lifecycle
Estimated Time:2m 0s
Question 258Question →

A security operations team configures an isolated decoy server populated with simulated confidential files on an internal subnet. The server is designed to attract unauthorized intruders who have breached the perimeter, allowing analysts to log their activities and gather telemetry on their attack techniques without exposing production data. Which of the following security control classifications correctly identifies both the category and functional type of this deployment?

Show answer & explanation

Answer: Technical category and Detective functional type

Answer

Technical category and Detective functional type
A decoy server (honeypot) is built using software tools and system configurations, placing it squarely in the Technical control category. Its core functional objective is to capture attacker activity and issue alerts when accessed, which classifies it as a Detective control.

Step-by-Step Solution

1
Determine the security control category based on implementation method.
Since the decoy server is deployed using operating systems, software services, and network configurations, it falls under the Technical (Logical) control category.
Technical controls are implemented using hardware, software, or firmware mechanisms.
2
Determine the functional control type based on the primary objective of the deployment.
The primary goal is to observe, record, and alert on unauthorized intruder activity within the environment, which defines a Detective control type.
Detective controls operate to identify and log unauthorized activities during or after an intrusion attempt.

Key Concept

Security Control Categories and Functional Types
Question 259Question →

A security administrator is refining the Public Key Infrastructure (PKI) deployment for an enterprise RADIUS server supporting 802.1X EAP-TLS authentication. Mobile clients connecting over high-latency cellular links experience frequent authentication timeouts caused by real-time Certificate Revocation List (CRL) downloads. To optimize client authentication performance and ensure secure server identity verification, which of the following mechanisms or configurations should the administrator implement? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Enable OCSP stapling on the RADIUS server to deliver signed revocation status directly within the TLS handshake.; Configure the server certificate with Subject Alternative Name (SAN) extensions and Server Authentication Extended Key Usage (EKU) attributes.

Answer

The correct configurations are enabling OCSP stapling on the server to provide direct revocation status during the TLS handshake, and configuring the server certificate with proper Subject Alternative Name (SAN) and Extended Key Usage (EKU) attributes.
Enabling OCSP stapling shifts the burden of fetching revocation status to the server, which attaches a time-stamped OCSP response signed by the CA directly inside the TLS handshake, eliminating out-of-band client network requests. Additionally, configuring Subject Alternative Name (SAN) and Extended Key Usage (EKU) attributes ensures that clients can validate server identity and authorized usage roles per EAP-TLS standards.

Step-by-Step Solution

1
Identify performance bottleneck in PKI revocation checking for mobile clients.
Real-time CRL downloads cause network overhead and connection timeouts on high-latency links.
Downloading complete CRL files requires separate client-side HTTP/LDAP requests.
2
Select server-side status optimization technique.
OCSP stapling caches a signed revocation assertion on the server and includes it during the TLS handshake.
This removes the requirement for the client to contact an external OCSP responder or download large CRLs.
3
Ensure server certificate configuration supports 802.1X identity validation.
Proper SAN entries and EKU attributes (Server Authentication) allow clients to verify server identity without certificate validation errors.
EAP-TLS clients strictly validate server purpose and hostname alignment.

Key Concept

Public Key Infrastructure, OCSP Stapling, and Certificate Extensions
Question 260Question →

A security analyst is classifying enterprise defense mechanisms according to CompTIA Security+ implementation categories (Technical, Managerial, Operational, Physical) and functional control types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive). Match each security scenario on the left with its primary dual-axis security control classification on the right.

Click a left item, then click its matching right item

Items

Deploying an automated web application firewall (WAF) to inspect and block malicious payload traffic before reaching internal web servers
Posting prominent warning notices detailing legal prosecution along the perimeter fence of a secure datacenter
Performing manual data restoration procedures from clean off-site backups following a ransomware compromise
Establishing a corporate security administrative policy requiring employees to sign an Acceptable Use Policy (AUP) during onboarding

Matches

Show answer & explanation

Answer

Web Application Firewall (WAF) filtering maps to Technical / Preventive; Warning notices along the perimeter fence map to Physical / Deterrent; Data restoration from backups maps to Operational / Corrective; Acceptable Use Policy (AUP) onboarding requirement maps to Managerial / Directive.
Each mechanism aligns precisely with standard CompTIA Security+ SY0-701 definitions: WAF operates logically in software to prevent attacks (Technical/Preventive); perimeter signs are tangible physical measures designed to deter trespassers (Physical/Deterrent); restoring backups requires personnel operational procedures to fix post-attack damage (Operational/Corrective); and AUP requirements represent managerial policy governance that directs compliant user behavior (Managerial/Directive).

Step-by-Step Solution

1
Analyze the web application firewall (WAF) deployment.
Identified as a logic/software control (Technical) that blocks attack vectors before impact (Preventive).
Technical controls utilize hardware/software mechanisms, while preventive controls proactively halt threat execution.
2
Analyze the warning signage along the perimeter fence.
Identified as a tangible real-world control (Physical) designed to discourage intruders (Deterrent).
Physical controls exist in the physical environment, while deterrent controls aim to dissuade potential attackers through psychological disincentives.
3
Analyze the data restoration process from backups post-ransomware.
Identified as a human-driven operational procedure (Operational) that restores system state after an incident (Corrective).
Operational controls depend on day-to-day human execution and workflows, while corrective controls mitigate damage and restore operations.
4
Analyze the onboarding Acceptable Use Policy (AUP) requirement.
Identified as administrative governance (Managerial) enforcing mandatory behavior (Directive).
Managerial controls center on security governance, risk assessment, and policies, while directive controls mandate specific conduct.

Key Concept

CompTIA Security+ dual-axis classification framework categorizes security controls by implementation method (Technical, Managerial, Operational, Physical) and functional purpose (Preventive, Deterrent, Detective, Corrective, Compensating, Directive).
PreviousPage 13 / 14Next
General Security Concepts Practice Questions — CompTIA Security+ — Page 13 | Examkin