Examkin

General Security Concepts

268 questions

All types268Multiple choice139Multiple select58Matching57Ordering14
Question 61Question →

A network security consultant is auditing a newly implemented TACACS+ access control solution for datacenter routers. Match each administrative operational activity to its corresponding pillar within the AAA framework.

Click a left item, then click its matching right item

Items

An engineer presents a corporate username and time-based hardware token passcode to prove their identity to the network terminal.
The central server evaluates the engineer's security group membership and restricts execution to a specific subset of privilege-level commands.
The device generates timestamped records of commands executed during the shell session and transmits them to a centralized audit server.

Matches

Show answer & explanation

Answer

Presenting credentials to establish identity matches Authentication; evaluating security groups to grant specific command execution privileges matches Authorization; generating timestamped logs of executed commands for auditing matches Accounting.
Authentication is the process of verifying a user's claimed identity using credentials such as passwords or hardware tokens. Authorization determines the specific rights, privileges, and commands permitted for that verified identity. Accounting collects telemetry, session timestamps, and command history to maintain accountability and support forensic auditing.

Step-by-Step Solution

1
Analyze the first activity involving identity proof via username and hardware token passcode.
Identify that credential validation and identity verification fall under Authentication.
Authentication is responsible for confirming the identity of a subject before granting system access.
2
Analyze the second activity involving security group evaluation and command execution restriction.
Identify that granting specific rights based on policy falls under Authorization.
Authorization determines what actions, commands, or resources an authenticated identity is permitted to access.
3
Analyze the third activity involving session logging, timestamp generation, and telemetry transmission.
Identify that tracking user actions for compliance and monitoring falls under Accounting.
Accounting measures resource consumption and maintains detailed logs of subject activity for non-repudiation and auditing.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Estimated Time:1m 30s
Question 62Question →

A security defense team is implementing active deception and disruption controls across an enterprise environment to improve threat detection and mitigation. Match each deception or disruption technology on the left with its corresponding operational security objective on the right.

Click a left item, then click its matching right item

Items

DNS Sinkhole
Honeyfile
Honeytoken
Low-Interaction Honeypot

Matches

Show answer & explanation

Answer

DNS Sinkhole matches with C2 domain lookup interception; Honeyfile matches with decoy file auditing; Honeytoken matches with fake credentials or API key detection; Low-Interaction Honeypot matches with simulated service basic protocol response.
Each technology is paired correctly based on its core implementation: DNS sinkholes redirect malicious DNS queries; honeyfiles act as audited decoy documents; honeytokens serve as fake digital credentials/keys; and low-interaction honeypots emulate basic network services to capture initial probes.

Step-by-Step Solution

1
Analyze DNS disruption techniques.
Identify that DNS Sinkholing specifically targets outbound malicious DNS queries to isolate or monitor botnet/C2 communications.
DNS sinkholes alter resolution paths to prevent compromised hosts from reaching external threat infrastructure.
2
Differentiate between decoy files, tokens, and honeypot interaction levels.
Honeyfiles correspond to file objects, honeytokens correspond to specific data/credentials, and low-interaction honeypots correspond to emulated network daemons.
Each deception technology operates at a distinct layer (filesystem, credential/data level, or protocol service level).
3
Map each item to its operational mechanism.
Establish the 4 correct pairings.
Correct alignment demonstrates understanding of active defense components within CompTIA Security+ framework.

Key Concept

Deception and Disruption Technologies
Question 63Question →

A healthcare technology enterprise is redesigning the communication architecture for its remotely managed biomedical telemetry gateways. Under the legacy model, gateways established an IPsec VPN tunnel to an internal network segment where all internal traffic was implicitly trusted after initial authentication. To align with Zero Trust Architecture (ZTA) principles, the security architect must enforce strict policy controls over access to backend microservices. Which of the following design decisions best reflects core Zero Trust Architecture principles for this scenario?

Show answer & explanation

Answer: Require explicit validation of identity, device health posture, and contextual signals for every access request, dynamically enforcing granular least privilege permissions regardless of network location.

Answer

Require explicit validation of identity, device health posture, and contextual signals for every access request, dynamically enforcing granular least privilege permissions regardless of network location.
The correct response reflects the fundamental Zero Trust principle 'never trust, always verify'. In Zero Trust Architecture, every connection request must be explicitly validated using real-time contextual factors (user identity, device compliance, context) and governed by least privilege access rules, regardless of whether the communication originates internally or over a VPN.

Step-by-Step Solution

1
Analyze the core tenets of Zero Trust Architecture (NIST SP 800-207).
Zero Trust operates on the fundamental principle of 'never trust, always verify', assuming no implicit trust based solely on physical or network location.
Traditional perimeter security relies on implicit network zone trust, whereas ZTA mandates per-request authentication and continuous authorization.
2
Evaluate the requirement for explicit validation and least privilege enforcement.
Access decisions must continuously evaluate contextual data (identity, device posture, location, resource sensitivity) and enforce minimum required access.
Continuous contextual validation prevents lateral movement in the event of compromised credentials or devices.
3
Select the option that correctly mandates explicit verification and contextual dynamic policy enforcement across every request.
The design decision requiring explicit validation of identity, device posture, and contextual signals for every request represents full ZTA alignment.
This directly fulfills the fundamental principles of explicit verification, micro-segmentation, and least privilege in Zero Trust.

Key Concept

Zero Trust Architecture Principles
Estimated Time:1m 15s
Question 64Question →

An organization deploys security personnel at the entrance of a facility to verify employee identity badges and physically block unauthorized individuals from entering. Which of the following security control categories and functional control types best classifies these security guards?

Show answer & explanation

Answer: Physical category and preventive functional type

Answer

Physical category and preventive functional type
Security guards represent a physical control category because they operate in the tangible physical domain to protect facilities. In this scenario, their primary function of checking badges to block unauthorized visitors directly prevents unauthorized entry from occurring, making them a preventive functional type.

Step-by-Step Solution

1
Determine the security control category based on implementation domain.
Security guards physically exist in the real world to secure a facility environment, making them a physical control.
Control categories distinguish between technical (logical/software), managerial (administrative/policy), operational (human procedures), and physical (tangible/environmental) controls.
2
Determine the functional control type based on the goal in the scenario.
The guards stop unauthorized individuals from entering, which directly prevents a security breach.
Functional types describe the primary security action: preventive controls stop incidents before they happen, detective controls discover incidents, and deterrent controls discourage actions.

Key Concept

Security Control Categories and Functional Types
Question 65Question →

A cloud security administrator is updating the identity and access management framework for an enterprise application platform to align strictly with the AAA model. Which of the following implementation steps specifically address the Authorization pillar of AAA? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Applying Role-Based Access Control (RBAC) policies to assign specific resource permissions based on job function; Enforcing Attribute-Based Access Control (ABAC) rules to evaluate environmental context and resource tags before granting request access

Answer

The configurations that specifically address Authorization are applying Role-Based Access Control (RBAC) policies to assign resource permissions and enforcing Attribute-Based Access Control (ABAC) rules based on context and resource tags.
Authorization determines the permissions and access rights granted to an identity after it has been authenticated. Both Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) are access control frameworks designed specifically to define and enforce what actions users or services can perform on target resources.

Step-by-Step Solution

1
Differentiate between the three pillars of the AAA model: Authentication (verifying identity), Authorization (determining permissions and access rights), and Accounting (tracking activity and keeping logs).
Established that the question requires identifying access control mechanisms that enforce permissions.
Authorization explicitly governs what actions an authenticated identity is allowed to execute.
2
Evaluate each configuration option against the Authorization definition.
RBAC and ABAC govern permissions and access rights (Authorization). Credential and TOTP verification establishes identity (Authentication). Activity logging tracks historical user actions (Accounting).
Correctly categorizes each control mechanism to isolate the two valid Authorization mechanisms.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Question 66Question →

An enterprise security administrator is resolving TLS handshake failures for internal client applications connecting to a critical web server in an isolated, air-gapped network segment. Clients are configured to require strict certificate revocation checks before trusting server certificates. Because client endpoints lack direct internet access or connection to internal revocation endpoints, standard Certificate Revocation List (CRL) downloads and direct Online Certificate Status Protocol (OCSP) queries fail, causing clients to terminate mTLS negotiations. Which of the following solutions should the administrator implement on the web server to resolve the revocation verification failure while maintaining real-time revocation assurance?

Show answer & explanation

Answer: Enable OCSP stapling (TLS Certificate Status Request extension) on the web server so it periodically fetches and appends a time-stamped, CA-signed revocation status response directly to the client during the TLS handshake.

Answer

Enable OCSP stapling on the web server so that a cached, CA-signed revocation status response is delivered to clients directly within the TLS handshake.
OCSP stapling (defined in RFC 6066 as the TLS Certificate Status Request extension) enables the web server to query the CA OCSP responder periodically and cache the time-stamped, cryptographically signed response. When clients initiate a TLS connection, the server includes this stapled response in the TLS handshake. This allows isolated clients to verify that the server certificate has not been revoked without requiring direct network access to external OCSP responders or downloading large CRL files.

Step-by-Step Solution

1
Analyze the constraint preventing client-side revocation validation.
Identified that client endpoints reside in an isolated network segment without direct connectivity to CRL distribution points or OCSP responders, causing revocation lookups to fail.
When strict revocation checking is enabled, inability to query revocation status forces compliant clients to reject the server certificate.
2
Evaluate revocation mechanisms that satisfy isolated network client requirements.
Selected OCSP stapling, which offloads the query responsibility to the web server.
The web server queries the CA's OCSP responder on a set interval, receives a signed and time-stamped status assertion, and staples this response into the server's TLS Certificate Status Request extension.
3
Verify client trust and bandwidth efficiency.
Clients validate the stapled OCSP response using the CA's trusted public key already present in their local trust store without originating external connections.
This eliminates bandwidth overhead and resolves connectivity limitations in restricted client environments while retaining real-time revocation integrity.

Key Concept

OCSP Stapling and Certificate Revocation Management
Estimated Time:2m 0s
Question 67Question →

An enterprise configures a remote-access VPN portal integrated with a centralized AAA infrastructure. When an engineer connects, the following sequential process occurs:

1. The gateway verifies the engineer's username, password, and multi-factor authentication token against the directory service.
2. The gateway evaluates the engineer's group memberships and applies a dynamic Network Access Control List (NACL) to restrict access strictly to database subnet resources.
3. The gateway logs the engineer's active session duration, assigned IP address, and bandwidth consumption to an auditing server.

Which core pillar of the AAA security framework is directly performed during step 2?

Show answer & explanation

Answer: Authorization

Answer

Authorization is the AAA pillar demonstrated when enforcing resource access restrictions and applying dynamic control lists based on user privileges.
Evaluating group memberships and applying network access control lists (NACLs) to limit accessible network subnets directly enforces permissions, which is the exact definition and responsibility of the Authorization pillar in AAA.

Step-by-Step Solution

1
Analyze step 1 of the scenario
Step 1 confirms and validates identity credentials (Authentication).
Authentication is the process of verifying who a user claims to be.
2
Analyze step 2 of the scenario
Step 2 evaluates permissions and applies ACL restrictions based on user group membership (Authorization).
Authorization dictates what actions or resources an authenticated user is permitted to access.
3
Analyze step 3 of the scenario
Step 3 tracks session usage and duration metrics (Accounting).
Accounting records user activities, consumption, and event timestamps for auditing.

Key Concept

Authentication, Authorization, and Accounting (AAA) Security Framework
Estimated Time:1m 15s
Question 68Question →

A security analyst is configuring asymmetric cryptography for an enterprise web application to enable secure public key exchange and digital signatures. Which of the following cryptographic algorithms meet these specific functional requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: RSA (Rivest-Shamir-Adleman); ECC (Elliptic Curve Cryptography)

Answer

The correct asymmetric cryptographic algorithms are RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography).
RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography) are both asymmetric key algorithms. They utilize mathematically linked public-private key pairs to perform key establishment and generate digital signatures for non-repudiation.

Step-by-Step Solution

1
Identify the cryptographic category required by the scenario.
The requirements demand asymmetric encryption mechanisms capable of key exchange and digital signatures.
Asymmetric cryptography utilizes public/private key pairs to enable key negotiation and non-repudiation.
2
Evaluate the algorithm options against asymmetric capability.
RSA and ECC use public/private key pairs designed for key exchange and signatures.
RSA relies on prime factorization complexity while ECC relies on algebraic curves, both fulfilling asymmetric functions.
3
Eliminate symmetric algorithms, hashing functions, and non-cryptographic security controls.
AES (symmetric bulk cipher), SHA-256 (integrity hash), and WAF (network defense control) are incorrect.
Symmetric ciphers use a shared key and cannot independently produce digital signatures, while hash functions only produce message digests.

Key Concept

Asymmetric vs. Symmetric Cryptographic Algorithm Classification
Question 69Question →

During an active incident response, a security analyst identifies multiple compromised internal workstations attempting to establish connections to a known malicious command-and-control (C2) domain. To immediately disrupt these communications enterprise-wide and capture telemetry from infected hosts without deploying host agents or creating custom firewall drop rules for every host, the analyst configures internal name servers to resolve queries for the C2 domain to an isolated monitoring IP address. Which deception or disruption technology is being utilized in this scenario?

Show answer & explanation

Answer: DNS sinkholing

Answer

DNS sinkholing is the correct technology being utilized to redirect malicious domain resolution requests to a security-monitored IP address.
DNS sinkholing works by configuring a DNS server to return false or redirected IP addresses (sinkhole IP addresses) for specific malicious domain names. When infected hosts attempt to resolve the C2 server domain, the DNS server redirects the connection attempt to an internal security monitoring host. This immediately disrupts malware communication while allowing the security team to identify every infected machine querying that domain.

Step-by-Step Solution

1
Analyze the operational objective in the scenario.
The goal is to disrupt malware command-and-control traffic and log infected hosts by manipulating domain name resolution across internal name servers.
Identifying the primary operational mechanism reveals whether the control relies on deception lures, decoy assets, or network resolution redirection.
2
Evaluate deception and disruption technology definitions.
DNS sinkholing specifically intercepts domain queries destined for known malicious hosts and returns a controlled IP address (such as a loopback address or monitoring sinkhole).
This technique provides rapid disruption of C2 channels while capturing traffic logs from all infected internal devices querying the domain.
3
Distinguish DNS sinkholing from decoy host and file controls.
Unlike honeypots, honeynets, or honeyfiles—which rely on decoy resources to entice threat actors—DNS sinkholing operates at the infrastructure level to intercept and divert malicious traffic.
Confirming the exact functional layer ensures accurate control selection.

Key Concept

DNS Sinkholing as a Disruption and Detection Technology
Question 70Question →

An IT administrator needs to request and implement an X.509 server certificate from a public Certificate Authority (CA) to secure a corporate web portal. Arrange the steps of the initial PKI certificate enrollment process in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Generate the key pair, 2) Create the CSR, 3) Submit the CSR to the CA, 4) CA signs and issues the certificate, 5) Install the certificate on the web server.
In standard Public Key Infrastructure (PKI) workflows, certificate issuance follows a strict logical sequence. First, the requesting server generates an asymmetric key pair (private and public keys). Next, the administrator generates a Certificate Signing Request (CSR) which embeds the public key and organization identity details. The CSR is then submitted to the Certificate Authority (CA), which verifies the requester's identity. Once verified, the CA signs the certificate using its own private key and issues it. Finally, the administrator installs the signed certificate on the web server to service secure TLS connections.

Step-by-Step Solution

1
Generate asymmetric key pair locally
A public key and private key are generated on the destination server.
A public key is required to populate the Certificate Signing Request (CSR).
2
Build the Certificate Signing Request (CSR)
A CSR file containing the public key and entity identity (Subject/SAN) is compiled.
The CSR acts as the formal application sent to a CA for certificate issuance.
3
Submit CSR to the target CA
The CA receives the CSR and begins domain validation procedures.
The CA must verify identity and domain control before binding its trust signature.
4
CA certificate signing and issuance
The CA signs the applicant's public key with its own private key and returns the X.509 certificate.
The cryptographic signature of the CA establishes trust for clients trusting that CA root.
5
Deploy certificate on server
The server is bound to the new certificate and intermediate CA certificates.
Installation enables the web server to present a trusted certificate during TLS handshakes.

Key Concept

PKI Certificate Request and Enrollment Workflow
Question 71Question →

A fintech enterprise is redesigning its transactional API gateway and core internal services to align with Zero Trust Architecture (ZTA) principles. Under the legacy model, any service deployed within the internal management network zone was implicitly trusted to execute database queries. Which of the following access enforcement strategies best reflects the core Zero Trust principle of explicit verification for internal service communication?

Show answer & explanation

Answer: Requiring every service transaction to be explicitly authenticated, authorized, and encrypted using context-aware inspection regardless of network location

Answer

Requiring every service transaction to be explicitly authenticated, authorized, and encrypted using context-aware inspection regardless of network location
Zero Trust Architecture operates on the core principle of 'never trust, always verify.' In a ZTA model, network location provides no inherent trust. Every access request—even those originating within internal subnets—must be explicitly authenticated, authorized against context-aware policy, and encrypted end-to-end.

Step-by-Step Solution

1
Identify the core tenet of Zero Trust Architecture (ZTA) regarding network trust boundaries.
ZTA operates under the assumption that network location does not imply trust, eliminating implicit trust for internal segments.
Traditional perimeter security relies on location-based trust, whereas ZTA requires continuous validation regardless of origin.
2
Evaluate the requirement for explicit verification across internal service transactions.
Every access request must be explicitly authenticated, authorized within context, and encrypted end-to-end.
Explicit verification ensures least privilege and continuous evaluation for all data flows.

Key Concept

Explicit verification and removal of implicit network perimeter trust in Zero Trust Architecture
Estimated Time:1m 30s
Question 72Question →

A security technician is configuring a web application server that hosts multiple distinct domain names on a single IP address. During initial testing, users receive a certificate domain name mismatch warning when attempting to navigate to the secondary domain. Which of the following X.509 certificate fields or extensions must be configured in the Certificate Signing Request (CSR) to resolve this warning?

Show answer & explanation

Answer: Subject Alternative Name (SAN)

Answer

The Subject Alternative Name (SAN) extension must be configured in the Certificate Signing Request (CSR).
Subject Alternative Name (SAN) is an X.509 certificate extension that allows a single certificate to secure multiple hostnames, domain names, or IP addresses. Specifying all intended hostnames in the SAN extension during CSR generation ensures client browsers successfully match the requested domain to the certificate identity.

Step-by-Step Solution

1
Identify the cause of the TLS certificate mismatch warning
The client browser rejects the connection because the domain requested by the client does not match the subject name on the presented X.509 certificate.
Browsers validate server identity by ensuring the requested URL matches a listed domain identity within the server's certificate attributes.
2
Determine the appropriate certificate field for securing multiple domain names
The Subject Alternative Name (SAN) extension allows an administrator to list additional hostnames, FQDNs, or IP addresses under a single certificate.
Populating the SAN field during CSR creation instructs the Certificate Authority (CA) to issue a multi-domain certificate valid for all specified domains.

Key Concept

Subject Alternative Name (SAN) extension in Public Key Infrastructure
Question 73Question →

During a network infrastructure assessment, a security analyst reviews the operational workflow of a centralized 802.1X RADIUS deployment. When an employee connects a corporate laptop to an enterprise switch port, the RADIUS server first verifies the user's domain password against Active Directory. Immediately following identity verification, the RADIUS server returns specific network access attributes that instruct the switch to dynamically place the user's connection onto VLAN 30 (Finance). Which pillar of the AAA framework is directly performed by dynamically placing the user into VLAN 30?

Show answer & explanation

Answer: Authorization

Answer

Authorization
Authorization is the process of granting specific permissions, privileges, and network access limits to an authenticated entity. In this scenario, placing the connection into VLAN 30 enforces role-based access privileges, making it a direct application of authorization.

Step-by-Step Solution

1
Identify the distinct phases of the AAA framework described in the scenario
The initial step (verifying domain credentials against Active Directory) establishes identity, which is Authentication. The subsequent step (assigning VLAN 30 attributes) defines what resources the validated user is permitted to access.
AAA separates identity verification from permission assignment and tracking.
2
Map the dynamic VLAN 30 assignment to the corresponding AAA pillar
Restricting network access rights based on user role attributes corresponds to Authorization.
Authorization defines access privileges, network segmentation restrictions, and resource boundaries.

Key Concept

Authentication, Authorization, and Accounting (AAA) Framework
Question 74Question →

A manufacturing enterprise is updating its network security model for factory floor industrial IoT sensors that transmit operational metrics to an enterprise analytics platform. Under the legacy network model, any device connected to the internal factory subnet was implicitly trusted. Which of the following technical implementations best aligns this environment with Zero Trust Architecture (ZTA) principles?

Show answer & explanation

Answer: Require explicit, continuous authentication and dynamic authorization for every data payload, regardless of whether the traffic originates inside the factory subnet.

Answer

Requiring explicit, continuous authentication and dynamic authorization for every data payload regardless of network origin.
The correct answer aligns directly with Zero Trust Architecture (ZTA) principles by eliminating implicit trust derived from network location. Zero Trust requires that every device, user, and data transaction be explicitly authenticated and authorized using real-time context and continuous validation, even if the request originates from an internal factory subnet.

Step-by-Step Solution

1
Analyze the legacy architecture described in the scenario
The legacy model relies on implicit trust granted to devices residing on the internal factory subnet.
Traditional perimeter-based security assumes devices behind the internal firewall are trustworthy.
2
Apply Zero Trust Architecture tenets (such as NIST SP 800-207)
Zero Trust dictates 'never trust, always verify' regardless of physical or logical network position.
All communication must be explicitly authenticated, authorized, and continuously validated on a per-request basis.
3
Identify the option that enforces per-request continuous validation without network location bias
Enforcing continuous authentication and dynamic authorization for all payloads fulfills ZTA requirements.
This removes implicit perimeter trust and applies granular access controls to every transaction.

Key Concept

Zero Trust Architecture enforces explicit, continuous verification of identity and authorization for every access request, regardless of network location.
Question 75Question →

An enterprise security engineer is deploying S/MIME dual-key certificates (separate key pairs for digital signing and data encryption) across an organization using an internal PKI with key recovery capabilities. To comply with security governance, private encryption keys must be escrowed before certificate issuance, while signing keys must never be escrowed. Place the administrative operational steps in the correct chronological sequence from initial key pair creation to final client integration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with generating the dual key pairs on the endpoint, followed by archiving the private encryption key into key escrow, creating and transmitting the CSR to the Intermediate CA, the CA signing and publishing the X.509 S/MIME certificate, and finally importing the signed certificate into the user's email client store.
The proper sequence follows the cryptographic lifecycle: generating dual key pairs first provides the necessary key material. Next, the private encryption key must be safely backed up into key escrow before certification to ensure data recovery compliance while maintaining non-repudiation for the private signing key. After escrow verification, the client generates a CSR with public key material and sends it to the Issuing CA. The CA validates the identity, signs the X.509 certificate, and publishes it to the directory repository. Finally, the endpoint installs the signed certificate into the local email client store to enable cryptographic email functions.

Step-by-Step Solution

1
Initiate asymmetric key pair generation on the local workstation for S/MIME dual-key deployment.
Two distinct key pairs (signing key pair and encryption key pair) are generated.
Cryptographic material must exist before any submission, escrow, or signing actions can proceed.
2
Transmit the private encryption key to the enterprise Key Escrow database over an encrypted session, leaving the signing key strictly local.
The private encryption key is archived for enterprise data recovery compliance, while non-repudiation of digital signatures is preserved.
Enterprise PKI policy mandates that private key escrow occurs prior to CA certification so unbacked-up keys are never issued active certificates.
3
Formulate a Certificate Signing Request (CSR) including the public keys and subject distinguished name, then submit it to the Issuing CA.
The CA receives a structured CSR payload containing the identity details and public key material.
The CSR acts as the formal request for the CA to validate identity and certify public key ownership.
4
The Intermediate CA authenticates the request, signs the X.509 S/MIME certificate with its private key, and publishes the certificate to LDAP.
An authenticated, signed X.509 S/MIME certificate is created and published for enterprise access.
The CA is responsible for establishing trust by signing the public key and making the certificate accessible to other email users.
5
Download and install the issued X.509 certificate into the endpoint's personal certificate store.
The email client binds the signed certificate to the local private keys, completing S/MIME initialization.
The endpoint requires the signed certificate to complete TLS/MIME handshake routines and execute cryptographic operations.

Key Concept

S/MIME Dual-Key Lifecycle and Key Escrow Workflow
Estimated Time:3m 0s
Question 76Question →

A security engineer is designing a secure communication protocol between distributed edge gateways and a cloud broker. The design mandates that if an attacker compromises the private key of a gateway in the future, the attacker must not be able to decrypt past session traffic that was previously captured and stored. Which of the following cryptographic mechanisms should the engineer enforce to satisfy this specific requirement?

Show answer & explanation

Answer: Ephemeral Diffie-Hellman key exchange to establish Perfect Forward Secrecy

Answer

Ephemeral Diffie-Hellman key exchange to establish Perfect Forward Secrecy
Ephemeral Diffie-Hellman (such as DHE or ECDHE) creates unique, temporary key pairs for every communication session. Because these ephemeral keys are discarded after the session terminates and are never saved to disk or transmitted directly, a future compromise of the server or gateway's long-term private key cannot be used to recalculate or decrypt historical session keys. This property is known as Perfect Forward Secrecy.

Step-by-Step Solution

1
Analyze the core requirement
Identified requirement: Future compromise of a long-term private key must not compromise previously recorded session traffic.
This is the exact definition of Perfect Forward Secrecy (PFS).
2
Evaluate cryptographic primitives for PFS support
Ephemeral key exchanges (such as DHE or ECDHE) derive dynamic session keys for each individual session that are independent of long-term identity keys.
Static asymmetric key transport (e.g., standard RSA key exchange) allows any historical session to be decrypted if the static private key is compromised.
3
Select the mechanism that satisfies PFS
Ephemeral Diffie-Hellman key exchange guarantees that compromise of long-term secrets does not expose past session keys.
Temporary keys generated during the handshake are deleted immediately after the session ends.

Key Concept

Perfect Forward Secrecy (PFS) via Ephemeral Key Exchange
Question 77Question →

A security analyst is reviewing modern cryptographic primitives and key management practices for an enterprise application architecture. Match each cryptographic technique on the left with its primary security objective or operational implementation on the right.

Click a left item, then click its matching right item

Items

Ephemeral Diffie-Hellman (ECDHE)
Key Stretching (PBKDF2)
Authenticated Encryption (AES-GCM)
Salted Hashing (SHA-256 with unique salt)

Matches

Show answer & explanation

Answer

Ephemeral Diffie-Hellman matches with generating temporary session keys for perfect forward secrecy. Key Stretching matches with applying thousands of iterative hashing loops to slow down offline brute-force cracking. Authenticated Encryption matches with simultaneously providing confidentiality and integrity verification. Salted Hashing matches with neutralizing precomputed rainbow table lookup attacks.
Each cryptographic primitive directly fulfills its stated security goal: Ephemeral Diffie-Hellman provides forward secrecy through disposable session keys; Key Stretching delays offline password cracking via iteration counts; AES-GCM delivers both confidentiality and tamper detection; and Salting eliminates precomputed hash lookup tables.

Step-by-Step Solution

1
Analyze key exchange mechanism requirements for session key protection.
Identify Ephemeral Diffie-Hellman (ECDHE) as the mechanism providing perfect forward secrecy through temporary key generation.
Ephemeral keys are discarded after session closure, preventing retrospective decryption.
2
Evaluate password resistance algorithms against offline dictionary attacks.
Map Key Stretching (PBKDF2) to iterative computational delay function.
Slowing down compute time per guess mitigates high-speed automated password cracking.
3
Examine symmetric cipher modes combining dual security functions.
Associate AES-GCM with Authenticated Encryption with Associated Data (AEAD).
AES-GCM encrypts data while generating an authentication tag to prevent tampering.
4
Identify anti-precomputation controls for stored password databases.
Match unique cryptographic salt added to hash inputs with rainbow table defense.
Salting forces attackers to recompute hashes individually for each targeted account.

Key Concept

Cryptographic Concepts and Algorithms
Question 78Question →

A security architect is mapping newly implemented security controls across an enterprise network against CompTIA Security+ control categories (Technical, Managerial, Operational, Physical) and functional control types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive). Match each enterprise security measure on the left to its corresponding dual-axis classification on the right.

Click a left item, then click its matching right item

Items

An automated Network Access Control (NAC) policy engine that evaluates device health and blocks non-compliant endpoints from associating with production subnets.
A corporate governance policy mandating that all employees complete anti-phishing training and sign an acceptable use agreement upon onboarding.
A dual-custody biometric mantrap vestibule that physically isolates individuals between two interlocking doors at a data center entrance.
An out-of-band Network Intrusion Detection System (NIDS) analyzing mirrored core switch traffic to generate security warnings upon identifying signature anomalies.

Matches

Show answer & explanation

Answer

Automated NAC dynamic blocking corresponds to Technical / Preventive; Mandatory onboarding policies and agreements correspond to Managerial / Directive; Biometric mantrap vestibules correspond to Physical / Preventive; Out-of-band NIDS monitoring corresponds to Technical / Detective.
Each control measure accurately aligns across both axes: Automated NAC health checks use technological mechanisms to block non-compliant endpoints (Technical / Preventive). Corporate onboarding policies and acceptable use agreements set rules for human behavior through management governance (Managerial / Directive). Biometric mantrap vestibules physically stop unauthorized individuals from entering facility spaces (Physical / Preventive). Out-of-band NIDS sensors use monitoring software to inspect mirrored network traffic and alert on security anomalies without inline blocking (Technical / Detective).

Step-by-Step Solution

1
Determine the primary category for each mechanism based on how it is implemented.
NAC health checking and out-of-band NIDS monitoring rely on hardware/software systems (Technical). Training mandates and acceptable use agreements stem from management oversight and policy frameworks (Managerial). Mantraps rely on physical structures and access barriers (Physical).
Control categories differentiate whether controls are implemented via technology, administrative management, operational procedures, or physical security boundaries.
2
Determine the functional type for each mechanism based on its operational objective during an event.
Blocking non-compliant endpoints and physically stopping tailgating/unauthorized access prevent security incidents before occurrence (Preventive). Mandating behavior directs human actions to comply with organizational expectations (Directive). Identifying anomalous traffic and triggering alerts discovers active or past events (Detective).
Functional types define the specific role a security control plays in the timeline of a threat or security event.
3
Synthesize category and functional type classifications into pair assignments.
Match NAC to Technical / Preventive, onboarding mandates to Managerial / Directive, mantrap to Physical / Preventive, and out-of-band NIDS to Technical / Detective.
Combining category and type provides a complete security control classification.

Key Concept

Dual-Axis Security Control Categorization (Category vs. Functional Type)
Question 79Question →

An organization configures an automated endpoint configuration management agent across its cloud instances. The agent continuously monitors system files for unapproved modifications, immediately sends an alert upon detecting a divergence, and automatically restores the altered files back to their authorized baseline state without human intervention. Which of the following best classifies this control by its category and functional type?

Show answer & explanation

Answer: Technical category and Corrective functional type

Answer

The mechanism is classified as a Technical category control and a Corrective functional type.
The system relies on software automation on endpoints to enforce security policies, making it a Technical control. Because it actively reverses unapproved modifications and restores systems to their known-good baseline, its primary function is Corrective.

Step-by-Step Solution

1
Determine the control category (Technical, Managerial, Operational, Physical).
The control is implemented using automated software logic running on system endpoints, which defines it as a Technical (or Logical) control.
Technical controls utilize hardware, software, or firmware mechanisms to enforce security policies.
2
Determine the primary functional control type (Preventive, Deterrent, Detective, Corrective, Compensating, Directive).
The agent actively reverses unauthorized modifications by restoring altered files back to an authorized baseline state, fulfilling a Corrective role.
Corrective controls act after an undesirable event occurs to remediate damage, restore capabilities, or return systems to a normal operational state.

Key Concept

Dual-Axis Control Classification (Category vs. Functional Type)
Estimated Time:1m 30s
Question 80Question →

A web administrator is setting up a new internal server and needs to secure web traffic using HTTPS. The administrator generates a public-private key pair on the web server and packages the public key alongside organizational details into a request file to send to the enterprise Certificate Authority (CA). Which of the following is the administrator creating to submit to the CA?

Show answer & explanation

Answer: Certificate Signing Request (CSR)

Answer

Certificate Signing Request (CSR)
The correct answer is the Certificate Signing Request (CSR). When requesting an X.509 certificate from a Certificate Authority, an administrator first generates a key pair and packages the public key along with server information into a CSR.

Step-by-Step Solution

1
Identify the artifact being generated to apply for a CA-signed digital certificate.
The server generates a key pair and formats the public key and server identification details into a standardized request file.
Certificate Authorities require this request file to validate identity before issuing a signed X.509 certificate.
2
Match the request file format to standard PKI terminology.
The file is a Certificate Signing Request (CSR).
A CSR is the standard format used to apply for an X.509 digital certificate from a CA.

Key Concept

Certificate Signing Request (CSR) workflow in PKI
PreviousPage 4 / 14Next
General Security Concepts Practice Questions — CompTIA Security+ — Page 4 | Examkin