General Security Concepts

A security architect is designing an enterprise Zero Trust Architecture (ZTA) baseline aligned with NIST SP 800-207. During a dynamic context evaluation event, distinct logical control plane and data plane components handle distinct duties. Match each Zero Trust logical component on the left with its precise operational role during access decision making and execution on the right.

A security analyst places decoy configuration files containing dummy server hostnames and fake database connection parameters onto several developer endpoints. The intention is that an unauthorized intruder performing local credential harvesting will follow these planted traces toward a monitored decoy system. Which of the following deception and disruption technologies is primarily being utilized on the developer endpoints?

Match each deception technology component on the left with its corresponding functional definition on the right.

An organization installs closed-circuit television (CCTV) cameras around the perimeter of its facility to continuously monitor activity and review video footage following potential security incidents. Which security control functional type does this installation primarily represent?

A security engineer is integrating an identity provider (IdP) with an internal web application using OpenID Connect (OIDC) and OAuth 2.0. During testing, users successfully authenticate at the IdP prompt and receive a valid ID token verifying their credentials. However, when the web application presents the accompanying access token to a backend microservice to update sensitive records, the backend service returns an HTTP 403 Forbidden status code because the token is missing the required write permission scope. Which core pillar of the AAA framework is directly failing in this scenario, and why?

A security administrator is evaluating existing security measures across an enterprise environment to ensure appropriate control categorization. Which of the following represent technical security controls? (Select TWO.)

A software enterprise recently migrated its legacy inventory management application to a hybrid cloud environment. To protect application access, the security team configured a Web Application Firewall at the network edge and mandated multi-factor authentication during user login. However, once an employee successfully authenticates at the start of their shift, backend microservices honor all subsequent data requests based on the request originating from an internal IP subnet, without re-evaluating risk telemetry, user behavior, or device compliance. Which core principle of Zero Trust Architecture is directly violated by this security design?

An enterprise risk management team is auditing the security controls of an automated insurance claims processing platform. Match each system security implementation on the left to the corresponding security objective (CIA Triad pillar or Non-Repudiation) it primarily satisfies on the right.

A enterprise security architect is updating the Transport Layer Security (TLS) configuration for an API gateway that services millions of mobile endpoints. The architecture requires establishing unique, temporary symmetric session keys across untrusted connections while minimizing computational overhead on mobile processor microchips. Additionally, the solution must enforce Perfect Forward Secrecy (PFS) so that a future compromise of the API gateway's long-term private key will not allow an attacker to decrypt previously captured session traffic. Which cryptographic key exchange algorithm combination should the architect configure on the gateway?

Following a major security incident involving a compromised legacy jump box, an enterprise security team implements two immediate measures: (1) deploying custom Web Application Firewall (WAF) rate-limiting rules to shield the legacy application while developers rebuild the primary authentication microservice, and (2) establishing an enterprise-wide policy requiring formal executive sign-off for any future jump box configuration modifications. Which of the following correctly classifies Measure 1 and Measure 2 by their control category and functional type?

A cloud security team is designing a telemetry ingestion pipeline for high-speed streaming data collected from millions of remote edge devices. The architecture requires that each transmitted payload maintain confidentiality while enabling recipient servers to verify message authenticity and integrity in a single, computationally efficient pass. Which cryptographic algorithm mode or mechanism best satisfies these operational constraints?

An enterprise security team is designing a cryptographically secure real-time transaction processing engine for a distributed financial network. The system requires ephemeral key agreement for inter-microservice TLS communications to protect past sessions if long-term credentials are compromised, alongside high-speed data encryption with built-in authenticity verification for sensitive ledger entries stored in volatile memory. Which of the following cryptographic implementation choices should the security team select to satisfy these requirements? (Select TWO).

An IT operations team is preparing to upgrade the operating system of an enterprise web server host cluster. According to standard change management procedures, which of the following activities MUST be completed prior to implementing the change in the production environment? (Select TWO.)

Following an enterprise risk assessment, an organization implements several new security measures: (1) automated Endpoint Detection and Response (EDR) agents configured to isolate compromised hosts and terminate malicious processes, (2) formal updates to the enterprise security governance document requiring multi-factor authentication (MFA) across all administrative accounts, (3) decoy honeypot servers deployed in an isolated subnet to attract and monitor threat actors, and (4) mandatory annual security awareness training for all software developers. Which of the following statements correctly classify the category and functional type of these security controls according to CompTIA Security+ standards? (Select TWO).

A security operations team configures an isolated decoy server on an internal network. The server runs a complete, fully functional operating system with authentic services and interactive shells designed to capture advanced attacker tools, command-line techniques, and lateral movement tactics in real time. Which of the following deception technologies has the team implemented?

An organization aims to enhance its threat detection capabilities against internal lateral movement and credential theft within a cloud-native environment. The security team decides to deploy deception technologies to lure attackers into revealing their presence without exposing actual production assets. Which of the following techniques should the security team implement to meet these objectives? (Select TWO).

A lead security analyst is evaluating enterprise cryptographic controls to remediate vulnerabilities identified in a recent security audit. Match each cryptographic mechanism on the left with its primary operational security objective or implementation purpose on the right.

An enterprise network team plans to modify existing firewall rule sets to allow communications for a new third-party business application. Which of the following represents the primary security objective of conducting a security impact assessment before approving this request?

A systems administrator is reviewing federated identity access logs for an enterprise web portal. After a user successfully validates their username, password, and time-based one-time password (TOTP) at the central Identity Provider (IdP), the service provider parses the group membership claims in the token to restrict the user to read-only privileges on administrative dashboards. Which pillar of the AAA framework is being executed by the service provider when enforcing these access privileges based on group membership?

A logistics enterprise is migrating its internal supply chain microservices from a legacy network zone model to a Zero Trust Architecture (ZTA). The engineering team must ensure that service-to-service communications are secured strictly according to Zero Trust principles. Which of the following design decisions directly align with Zero Trust Architecture principles for this deployment? (Select TWO.)