General Security Concepts

An enterprise security team is categorizing various security controls according to CompTIA Security+ framework classifications. Match each security control implementation on the left with its corresponding control category and functional type on the right.

A security architect is establishing cryptographic standards for an enterprise API service. The service requirements specify that past session communications must remain secure even if the server's long-term private key is compromised in the future. Additionally, incoming API requests must provide proof of origin and data integrity that cannot be denied by the sender. Which of the following cryptographic mechanisms should the architect implement to satisfy these security requirements? (Select TWO).

An organization updates its enterprise defense baseline to satisfy compliance requirements. As part of this initiative, the security team deploys an inline Network Intrusion Prevention System (NIPS) to automatically drop unauthorized network traffic, and publishes an updated Acceptable Use Policy (AUP) mandating clean desk and screen lock procedures for all staff members.

Which of the following statements correctly classify these security controls according to CompTIA Security+ categories and functional types? (Select TWO.)

A security analyst is reviewing the transport layer cryptographic configuration for a high-security financial microservice. The service requirements dictate that even if an adversary compromises the server's long-term private key in the future, previously intercepted session traffic must remain unencrypted and unreadable. Which cryptographic mechanism should be implemented to satisfy this requirement?

A security engineer is updating the organization's cryptographic policy to cover emerging operational scenarios including IoT deployments, cloud analytics, secure password storage, and covert communication detection. Match each cryptographic concept on the left with its primary operational characteristic or security use case on the right.

An enterprise facility installs biometric fingerprint readers on all access doors leading into its main server room to explicitly prevent unauthorized personnel from physically touching server hardware. How should the security team classify this access mechanism based on CompTIA Security+ control category and functional type definitions?

An organization is updating its credential storage architecture to protect user account passwords against offline precomputed table attacks. System analysis reveals that many users select identical plaintext passwords, which currently results in identical stored hash values within the credential database. Which of the following cryptographic techniques should the security administrator implement to ensure that identical passwords produce distinct stored hashes?

An enterprise security team is auditing organizational controls against the CompTIA Security+ framework. Match each implemented security control on the left to its corresponding dual-axis classification (Control Category / Functional Type) on the right.

A security administrator is updating the enterprise baseline controls for data protection across various infrastructure layers. Match each cryptographic mechanism on the left with its primary operational security function on the right.

An IT administrator is deploying multiple internal web applications under subdomains of an enterprise domain (such as `hr.corp.example.com` and `finance.corp.example.com`). To simplify administrative overhead and ensure all current and future first-level subdomains are secured under a single TLS certificate issued by the internal Certificate Authority, which of the following certificate features should be specified during the Certificate Signing Request (CSR) process?

A cloud development team integrates an automated scanner into a continuous integration and continuous deployment (CI/CD) pipeline to check Infrastructure-as-Code (IaC) templates for misconfigurations. When the scanner identifies high-risk security flaws, it automatically terminates the build job, stopping non-compliant infrastructure from being deployed into the live cloud environment. According to security control classifications, which category and functional type pair best describes this automated scanner gate?

A enterprise healthcare organization is deploying an S/MIME solution for secure email communications. The compliance team mandates that encrypted emails must remain recoverable by security auditors if an employee leaves the company. However, the legal team requires that digitally signed emails strictly maintain legal non-repudiation. Which of the following public key infrastructure (PKI) key management configurations should the security team implement to satisfy both requirements?

A security analyst is evaluating enterprise security mechanisms to classify them according to CompTIA Security+ functional control types. Which of the following examples correctly pair a security control with its primary functional control type? (Select TWO).

Following a compliance audit, an enterprise identifies a legacy core mainframe application that cannot natively support multi-factor authentication (MFA) or modern encryption protocols. To address the vulnerability without replacing the application, the security team deploys an isolated jump host requiring hardware token MFA and places an inline proxy in front of the mainframe to encrypt all transient sessions. Which of the following functional control types is best demonstrated by this implementation?

A security systems engineer is deploying mutual TLS (mTLS) for communication between internal microservices. During testing, client microservice instances fail to authenticate to target API gateways. Inspection of the certificate validation logs reveals that the client certificates were rejected because their Extended Key Usage (EKU) attribute is configured exclusively for "Server Authentication" (1.3.6.1.5.5.7.3.1) rather than "Client Authentication" (1.3.6.1.5.5.7.3.2). Which of the following actions should the security engineer take to resolve the authentication failures while adhering to PKI best practices?

An enterprise security policy requires software developers to digitally sign compiled binaries using a dedicated Hardware Security Module (HSM) USB token. Which of the following represents the correct sequential order of steps required to obtain and prepare the code signing certificate on the hardware token, from first to last?

An enterprise deploys host-based agent software on all employee workstations to continuously monitor volatile memory for anomalous activity and automatically generate alerts for the security operations center upon identifying suspicious API calls. According to CompTIA Security+, which control category and functional type combination does this host-based monitoring software represent?

A systems administrator needs to request and deploy a new SSL/TLS certificate for an enterprise web application using an internal Certificate Authority (CA). Arrange the steps of the certificate enrollment and deployment process in the correct chronological order from first to last.

An organization observes significant latency during TLS handshakes because client browsers independently query an external Certificate Authority (CA) to check revocation status. Additionally, the privacy team raises concerns that direct client queries allow the CA to monitor user browsing activity. Which of the following features should the security administrator configure on the web server to reduce latency and address the privacy concern?

A security administrator is optimizing the Public Key Infrastructure (PKI) architecture for an enterprise web portal that hosts services across multiple distinct domain names. The administrator must eliminate client-side OCSP lookup delays during TLS handshakes and consolidate multi-domain identity validation into a single digital certificate. Which of the following PKI mechanisms should the administrator implement to meet these objectives? (Select TWO.)