SY0-801 practice questions
CompTIA · SY0-801 · 300 questions
Original practice questions for the CompTIA Security+ V8 (SY0-801) exam, covering general security concepts; threats, vulnerabilities, and attacks (including threats from AI usage); security architecture; security operations; and security program management and oversight, written to the official SY0-801 exam objectives.
This course contains the use of artificial intelligence.
About the SY0-801 exam
- Time allowed
- 1 hour 30 minutes
- Questions
- Maximum of 90
- Passing score
- 750 (scale 100-900)
- Format
- Multiple-choice and performance-based
Schedule this exam The certification this earns
Exam details published by the vendor, checked 7 October 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
General Security Concepts · 48 questions
- A retailer protects its customer-facing web application solely with a web application firewall (WAF). During a penetration test, the tester slips an encoded injection payload past the WAF and reaches the backend database directly. Which approach would BEST limit the damage from a future WAF bypass?
- An attacker gains write access to an accounting database and quietly changes the amounts on several outstanding invoices. Logs show that no records were exported and nothing was viewed beyond what was needed to make the edits. Which security property was PRIMARILY violated?
- During peak season, a travel company's online booking portal is flooded with traffic from thousands of compromised hosts and becomes unreachable for customers. No data was accessed or altered. Which control BEST addresses the security property that was affected?
- Network engineers share a single root login on all core switches. After an outage caused by a configuration change, an auditor cannot determine which engineer made the change. Which remediation addresses the gap?
- An employee signs in to the corporate domain with valid credentials and completes MFA, then receives an access-denied message when opening the payroll file share. Which function of AAA produced the denial?
- A manager approved a large wire transfer by email and later claims he never sent the approval. The organization wants future approvals to be provably attributable to the person who gave them. Which control provides this?
- A remote employee connects to the corporate VPN but is still prompted to authenticate and pass a device-health check before each internal application opens. The employee asks why being on the VPN is not enough. Which principle explains this behavior?
- An architect designing a Zero Trust model separates the component that evaluates identity, device posture, and policy to decide whether a request is allowed from the component that actually opens or blocks the connection to the resource. Which component makes the access decision?
- Help desk technicians were added to the Domain Admins group so they could reset user passwords. A security review flags the practice. Which change BEST applies the principle of least privilege?
- A security manager is cataloging three controls: a locked server-room door, a firewall rule that blocks inbound Telnet, and a written acceptable use policy. Which classification of these controls, in that order, is correct?
- Each quarter, IT operations staff follow a documented procedure to review user accounts and remove any access that managers no longer approve. The review is carried out by people rather than enforced automatically by a system. Which control category BEST describes this access review?
- A login screen on every corporate workstation displays a banner stating that activity is monitored and that unauthorized use will be prosecuted. Which control type does the banner represent?
- A legacy manufacturing control system cannot support multifactor authentication. The security team places it on an isolated VLAN reachable only through a hardened jump host that does enforce MFA. Which control type does this arrangement represent?
- After ransomware encrypts a file server, administrators wipe the server and restore the data from the previous night's immutable backup. Which control type does the restoration represent?
- A warehouse uses motion sensors that write an alert to the security log when movement occurs after hours, and guards review recorded camera footage after a break-in to identify the intruder. Which control type do both of these represent?
- A company security policy states that all laptops must be configured with full disk encryption before they are issued to employees. Which control type is the policy statement itself?
- A data center installs bollards and a perimeter fence to keep vehicles and pedestrians away from the building and posts signs warning of video surveillance. Which control type do the bollards PRIMARILY provide?
- An organization relies on a strong perimeter firewall but has a flat internal network with no endpoint protection. A malicious insider moves freely from a workstation to file servers and the HR database. What is the PRIMARY gap in the security design?
- At noon on a weekday, a network engineer modifies the edge firewall rules without submitting a change request, and remote VPN users lose connectivity for two hours. What was the ROOT process failure?
- A change ticket to replace a load balancer certificate has no named owner, and the application team whose mobile app relies on certificate pinning was never notified. After the change, the mobile app stops connecting. Which change management elements were missing?
- A critical patch is scheduled for a database server shared by finance, HR, and sales applications. Before the change advisory board approves it, which step identifies the services, users, and risks affected by the change?
- The change advisory board is reviewing a request to roll out a new endpoint agent to all workstations. Board members want evidence that the agent will not break line-of-business applications before they approve production deployment. What should the requester provide?
- Halfway through a scheduled maintenance window, a firmware upgrade on a core router fails and the device stops passing traffic. The window closes in one hour. What should the team do according to change management best practice?
- A database schema migration has converted production tables to a new format, and the old format cannot be restored without losing transactions entered since go-live. A defect appears shortly after the change. Which approach is the team MOST likely to take?
- An e-commerce platform runs 24x7 and must apply operating system patches that require a reboot. Which approach BEST balances security and business impact?
- IT deploys a new version of a reporting tool to finance workstations. The next morning users cannot launch it, and endpoint logs show the executable was blocked by application control. The change ticket made no mention of application control. What was overlooked in planning the change?
- An administrator plans to replace an expiring TLS certificate on a production web server. The web service loads certificates only when it starts. What should the change request account for?
- A security team disables TLS 1.0 on an internal web server. A legacy reporting application that connects to the server stops working because it supports only TLS 1.0. Which change management activity would MOST likely have caught this before the change?
- Months after a network was re-segmented into new VLANs, incident responders investigating malware follow outdated diagrams and isolate the wrong switch ports. Which step was missed when the segmentation change was closed out?
- Two administrators edit the same firewall configuration script stored on a shared drive. One overwrites the other's changes, and no one can tell which rules were removed or restore the earlier copy. Which practice BEST prevents this?
- A user wants colleagues to be able to send her encrypted email that only she can read. Which key will her colleagues use to encrypt messages to her?
- An organization encrypts sensitive project files with keys issued to individual employees. Legal requires that the company be able to recover the encrypted data if an employee leaves or loses a key. Which mechanism meets this requirement?
- A browser must check whether a server certificate has been revoked at the moment of connection, without downloading the certificate authority's entire list of revoked serial numbers. Which mechanism should it use?
- Customers visiting a company's new public storefront see browser warnings that the site is not trusted, even though the connection is encrypted. The administrator generated the certificate on the web server itself. What is the BEST fix?
- An IoT device verifies each stage of its firmware before running it, beginning with a public key permanently stored in tamper-resistant hardware. Why is that hardware-stored key essential to the design?
- An administrator needs a certificate from a public certificate authority for a new web server. What should the administrator do FIRST?
- An organization wants a single certificate covering shop.example.com, mail.example.com, and www.example.com, and it expects to add more first-level subdomains of example.com over time. Which certificate type fits BEST?
- An administrator must encrypt a very large nightly backup file quickly before sending it to an offsite storage provider. Which approach is MOST appropriate for encrypting the bulk data?
- Two systems that have never communicated before must agree on a symmetric session key over an untrusted network without ever transmitting the key itself. Which technique accomplishes this?
- Laptops used by field auditors hold client workpapers, and temporary files and swap space may contain sensitive fragments. If a laptop is stolen, no data on it can be readable. Which encryption level BEST meets this requirement?
- A customer table holds names, addresses, order history, and Social Security numbers. Policy requires that only the SSN values be encrypted so other fields stay searchable for support staff. Which encryption level fits this requirement?
- A web application's login page submits credentials over plain HTTP, and a packet capture on the local network shows usernames and passwords in cleartext. Which control directly protects the credentials while they are in transit?
- An auditor flags a VPN gateway that uses a short key length with an otherwise sound encryption algorithm. Why does increasing the key length improve security in this case?
- A software publisher wants customers to be able to verify that an installer genuinely came from the publisher and was not modified after release. Which solution provides both assurances?
- A review of a password database shows that two users with the same password have identical stored hashes, making both accounts easy targets for precomputed rainbow table lookups. Which change addresses this weakness?
- An administrator downloads an operating system ISO and wants to confirm the file was not corrupted or altered in transit. The vendor publishes a SHA-256 value for the file on its website. What should the administrator do?
- A developer minifies and renames the variables in a web app's client-side JavaScript to make it harder to reverse engineer. A manager then describes the code as encrypted. Which statement is accurate?
- A payment processor requires that cryptographic keys be generated and stored in dedicated, tamper-resistant hardware, with signing operations performed inside the device so the keys never leave it. Which tool meets this requirement?
Threats, Vulnerabilities, and Attacks · 72 questions
- A security operations center wants lists of known malicious IP addresses and domains to be ingested automatically into its SIEM and firewall block lists as they are updated. What should the SOC subscribe to?
- A security analyst at a regional hospital wants threat intelligence that is specific to healthcare, contributed by peer organizations that have faced the same attackers, and exchanged under agreed handling rules. Which intelligence source BEST fits these requirements?
- A risk analyst compares two threats. Phishing attempts land several times a month, and each costs about an hour of help-desk time. A regional flood is expected roughly once in 20 years, but it would shut down the primary data center for weeks. The analyst marks the flood as negligible because it is rare. What is wrong with that ranking?
- An analyst reviews an intrusion timeline. Weeks of port scans and scraping of staff profiles were followed by a phishing email that exploited a document-reader flaw. The newest event is a scheduled task that relaunches the attacker's beacon every time the host reboots. Which threat life cycle stage does the scheduled task represent?
- A vulnerability scan reports a flaw with a CVSS base score of 9.8 on a test web server and a flaw scored 5.3 on the payroll database. A manager concludes that the test web server must be the more valuable asset. What does the CVSS base score actually express?
- A team can patch only one finding this week. One is a CVSS 6.5 flaw on an internet-facing customer payment portal. The other is a CVSS 9.1 flaw on a lab host with no network connection that is scheduled for decommissioning next month. Which finding should be remediated first?
- A vulnerability scanner's report tags each finding with an identifier in the CVE-year-number format. A new analyst asks what that identifier provides. What is the best answer?
- A review produces two findings. First, a web server's settings still allow a deprecated TLS version even though the software fully supports current versions. Second, a parsing library has a buffer overflow that only a vendor code update can fix. How should the first finding be classified?
- In a briefing, a manager says one finding must be more dangerous than another because its CVE number is higher. How should the analyst correct this?
- A risk register's Threat column lists four entries: an unpatched VPN appliance, a ransomware crew, no MFA on administrator accounts, and severe storms. A reviewer says two entries belong in a Vulnerability column instead. Which two?
- A SOC sees attacks that use an unmodified public exploit kit with its default signatures, scan random address ranges rather than chosen targets, and stop as soon as the first attempt fails. Which threat actor best fits these attributes?
- A defense contractor finds intruders who used custom-built implants and several fallback command channels, stayed undetected for 18 months, and copied only weapons research data. There was no ransom demand and nothing was sold or leaked publicly. Which actor and motivation are most likely?
- Shortly after a company announces a drilling project in a protected wilderness area, its public website is defaced with slogans opposing the project. A group claims credit on social media, and no data was stolen or encrypted. Which actor and motivation best fit?
- A ransomware operation leases its encryption tool to affiliates, splits each payment with them, and runs a leak site threatening to publish stolen files if victims do not pay. Which actor type and motivation does this describe?
- A database administrator was demoted last week after a heated HR meeting. Logs now show his still-valid credentials deleting backup jobs and storage snapshots after hours from his own workstation. No ticket requested the deletions and there are no external connections. Which threat actor and motivation best fit?
- To share files quickly with a supplier, an engineer sets a cloud storage container to allow anonymous public access. Weeks later the files appear in search results. There is no evidence of intent, and the engineer reported the problem as soon as she noticed it. How should this threat be classified?
- A rival manufacturer hires away two engineers and approaches others, offering signing bonuses to anyone who brings CAD drawings of an unreleased product. Which threat actor and motivation does this describe?
- A bank's threat model compares a lone attacker with a nation-state group. Which actor attribute most directly explains why the nation-state can develop custom zero-day exploits and sustain a campaign for years?
- An attack on a municipal water utility's operational technology attempts to change chemical dosing levels. There is no ransom demand and no data theft. The group's statement threatens more attacks and urges residents to fear their tap water. Which actor and motivation best fit?
- Incident responders find that an attacker held access for nine months, maintained several backdoors, rotated command infrastructure, exfiltrated data slowly, and regained access after a partial cleanup. Which term best describes this threat?
- Employees receive text messages on their company phones saying a parcel is being held and linking to a site that asks for a redelivery fee. The courier named in the message has no relationship with the company. Which threat vector is being used?
- An external guest added to a shared channel in the company's team chat workspace posts a project brief file that installs malware when opened. The chat platform itself was not compromised. Which threat vector is this?
- Staff notice stickers with QR codes placed over the official payment codes on parking meters outside the office. Scanning one opens a look-alike payment page. Which threat vector category does this represent?
- A user receives an invoice document from an unknown sender. When opened, it shows a banner saying the content cannot be displayed until the user clicks Enable Content. What is the vector, and what is the correct user response?
- After several users install a coupon-finder browser extension that is not on the approved list, their webmail sessions are accessed from foreign IP addresses without any password or MFA prompt. What best explains the compromise?
- Attackers exploit a known flaw in the web management interface of an edge router that is reachable from the internet, then alter its routing table. Which vector category applies, and which control most directly addresses it?
- Logs show thousands of failed logins per hour against a remote desktop service exposed directly to the internet so a few administrators can work remotely. Which change most directly removes this attack vector?
- On a compromised server, an attacker uses only the operating system's built-in scripting shell, scheduled task utility and remote management tools. No custom malware is dropped, and antivirus raises no alerts. Which technique is the attacker relying on?
- A managed service provider's remote monitoring platform is breached, and the attacker uses it to push a malicious script to every client endpoint the provider manages, including the company's laptops. Which threat vector does this represent?
- Several USB flash drives labeled Salaries 2026 are found in the office lobby and parking lot. One employee plugged a drive into a workstation, and the endpoint agent then detected a keyboard-emulation device. Which threat vector was used?
- Attackers compromise an industry forum that engineers at several target firms visit daily and inject a script that exploits visitors' browsers. Only visitors coming from the target firms' address ranges receive the payload. Which attack is this?
- An assessment finds badge readers that accept unencrypted NFC credentials that can be cloned from a short distance, and IP cameras with Bluetooth maintenance pairing enabled and no PIN. Which threat vector categories does this assessment highlight?
- A manufacturing plant's control workstation runs an operating system that no longer receives vendor patches. The control software will not run on a newer release, and replacement is 18 months away. Which approach best manages the risk in the meantime?
- A network discovery scan finds a small device with its own cellular modem plugged into a conference room network port. It is not in the asset inventory and no department claims it. How is this device best described?
- A hardening review finds that a file server is listening for FTP and Telnet, although nobody uses either service; administrators connect with SSH and users access shares over SMB. Which action most effectively reduces the server's attack surface?
- A privileged program checks whether the calling user may write to a file path and, a moment later, opens that path to write. Between those two steps, an attacker replaces the file with a symbolic link to a protected system file. Which vulnerability is being exploited?
- Attackers breach a software vendor's build environment and insert a backdoor into the next release. Customers receive the properly signed update through the product's normal automatic update channel and install it as usual. Which vulnerability does this describe?
- A developer commits a configuration file containing a cloud API key to a public code repository. The security team discovers it two days later. What is the best remediation?
- Sending a malformed request to a customer web application returns a page showing a full stack trace with the database server name, table names and the framework version. Which vulnerability does this reveal?
- In a shared virtualization cluster, an attacker controlling one guest VM runs code that executes on the underlying hypervisor host and then reads memory belonging to other tenants' VMs. Which vulnerability does this describe?
- Attackers are exploiting a flaw in a widely used email server that the vendor did not know about until today. No patch exists, and signature-based tools have no rule for it. Which defense is most likely to detect or contain the attack right now?
- A contractor's engagement ended six months ago, but the contractor's VPN account is still active and was used last night from an unfamiliar address. Which vulnerability does this illustrate, and which control addresses it?
- A marketing department uses corporate cards to sign up for an unapproved file-sharing SaaS service and stores customer contact lists there. IT and security are unaware of the service until an employee mentions it. Which vulnerability does this represent?
- A security researcher reports that a company's cloud object storage bucket holding customer invoices can be listed and downloaded anonymously. The provider's service is working as designed, and the bucket policy grants public read access. Which vulnerability type is this?
- A company connects an internal LLM assistant to its HR, finance and email systems so staff can ask questions across them. All of its applications also rely on a single identity provider for SSO. Which statement best describes how these choices affect the attack surface?
- On a shared drive, thousands of files suddenly have a new extension and cannot be opened. A text file with payment instructions appears in every folder, and the file server shows a spike in disk writes from one workstation's account. Which malware is indicated?
- An EDR tool flags a scripting shell launched by a word processor, running an encoded command that loads code directly into memory. A full disk scan finds no malicious executable, and persistence is a registry value that stores a script. Which malware type is indicated?
- A developer left the company in March. On June 30, a script hidden inside a routine maintenance job deleted payroll records. Code review shows it checks the date and whether the developer's account still exists before running. Which malware type does this describe?
- Within an hour, malware appears on dozens of servers. No user opened an attachment or ran a file. Each infected host scans its subnet and exploits an unpatched file-sharing service on other hosts to copy itself. Which malware type is this?
- During an inspection at a fuel station, technicians find thin overlay devices fitted over the card readers at several pumps. The overlays read the magnetic stripe of each card inserted. Which physical attack is this?
- Users on the office wireless network see certificate warnings on well-known sites. A traceroute shows an extra hop through an unfamiliar internal host, and the ARP table maps the default gateway's IP address to a workstation's MAC address. Which attack is indicated?
- Users on the corporate network report that their bank's domain resolves to an unfamiliar IP address. The same name resolves correctly from public resolvers and other networks, local hosts files are clean, and the internal resolver's cache holds the bogus record with an unusually long TTL. Which attack is indicated?
- A security analyst reviewing handshake logs for a payment portal sees that several client sessions normally negotiated with TLS 1.3 were instead completed with SSL 3.0 after the first handshake attempts were repeatedly interrupted. Both the clients and the server support current protocol versions. Which attack do these indicators MOST likely point to?
- The CFO receives an urgent phone call from someone who sounds like the CEO, insisting that a wire transfer to a new supplier be approved before the end of the day and kept confidential. The awareness team categorizes every reported social engineering incident by its delivery channel. How should this incident be categorized?
- During a video meeting, a finance employee sees and hears what appears to be the CIO asking for the employee's current MFA code to fix an urgent payroll issue. The meeting was started from an external account the employee has never seen before. What should the employee do FIRST?
- A SIEM alert shows that a single user account authenticated to the corporate SaaS suite from New York at 09:02 and from Singapore at 09:11. The New York session was logged off at 09:05, and the company does not use a VPN or proxy that would relay traffic through Asia. Which indicator of compromise does this activity represent?
- While investigating a suspected intrusion, an analyst finds that a server's security event log has no entries for a 40-minute window during which an administrator account was active elsewhere on the network, followed by an event recording that the audit log was cleared. Which indicator of compromise is MOST directly shown?
- A Linux web server has been running at 100% CPU for two days. An analyst finds an unfamiliar process launched from a temporary directory that maintains a persistent outbound connection to an external pool address. No files have been encrypted or renamed and users report no pop-ups. What is the MOST likely explanation?
- During a penetration test, the tester enters ' OR 1=1 -- into the username field of a web application's login form and leaves the password blank. The application logs the tester in and displays every user record stored in the backend database. Which attack has succeeded?
- A web application firewall logs repeated requests to an image-download endpoint in which the file parameter steps up four parent directories and names the system password file. One of the requests returned a response of the same size as the server's password file. Which attack is being attempted?
- A customer logged in to an online banking site opens a forum post in another browser tab. A hidden form on the forum page automatically submits a funds-transfer request to the bank, and the browser attaches the customer's valid session cookie. The bank's own pages were not modified, and the request was newly generated. Which attack occurred?
- Authentication logs show about 1,200 different employee usernames each receiving one or two failed sign-in attempts over six hours, all using the same seasonal password and originating from a small set of IP addresses. No accounts were locked out. Which credential attack is MOST likely underway?
- A company's AI assistant can browse the web to summarize pages for employees. After summarizing a vendor page, the assistant appended a link that sent the employee's earlier conversation to an external server. The page contained hidden text instructing the model to do this. The employee typed only a normal request. Which AI threat does this describe?
- An attacker with write access to a security vendor's labeled training repository adds thousands of samples from one malware family labeled as benign. After the next scheduled retraining, the vendor's classifier consistently misses that family, although the deployed model files were never directly altered. Which AI threat occurred?
- Over several sessions, an employee feeds an internal AI assistant elaborate role-play scenarios, such as asking it to pretend to be an unrestricted model with no policies, until it produces content its safety rules prohibit. No external documents, web pages, or files were involved. Which AI threat does this activity BEST represent?
- A security review finds that customer-service staff routinely paste full customer records, including names, account numbers, and support histories, into a free public AI chatbot to draft replies. The organization has no agreement with the chatbot provider. Which AI-related risk is MOST directly created by this practice?
- A compliance analyst used an AI assistant to draft an audit report. A reviewer discovers that the report cites a data-protection regulation section that does not exist, quoted in confident, authoritative language. No one tampered with the assistant or its inputs. Which risk does this represent, and what control BEST addresses it?
- An AI model used to screen job applicants was trained on ten years of the company's historical hiring decisions. An internal audit finds that it consistently scores applicants from one demographic group lower than equally qualified applicants from others. No one tampered with the training data. Which AI risk does this BEST illustrate?
- A regulator asks a bank to explain why its AI fraud-detection model blocked a specific customer's transaction. The data science team confirms the model is accurate overall, but they cannot identify which factors led to that particular decision or justify it to the customer. Which AI risk does this situation BEST illustrate?
- A threat actor repeatedly adds padding bytes and alters strings in a known malware sample, testing each variant against a vendor's machine-learning detection engine until one is classified as benign. The engine's model and training data were never accessed or changed. Which AI threat does this BEST describe?
- A developer's AI coding agent can run shell commands on a build server. While triaging a repository issue, the agent read text in the issue telling it to download and run a setup script from an external site, and it did so, installing a backdoor on the build server. Which AI-related risk materialized on the build server?
- Infostealer malware on an employee's laptop exfiltrates browser cookies. Hours later, an attacker opens the company's AI assistant web portal from another country and reads the employee's full conversation history without receiving any password or MFA prompt. Which attack BEST explains this access?
Security Architecture · 57 questions
- A company migrated its application servers to virtual machines in a public IaaS offering. A vulnerability scan reveals that the guest operating systems are missing months of security patches because the administrators assumed the provider applies them. Under the shared responsibility model, who is responsible for patching these guest operating systems?
- A development team moves several APIs from virtual machines to serverless functions on a public cloud platform. A manager asks which security tasks the team still owns now that there are no servers to administer. Which set of tasks remains the team's responsibility?
- Several regional hospitals with similar regulatory obligations agree to share a cloud environment that is used only by their member organizations and is governed jointly under a common set of security and compliance requirements. Which cloud deployment model does this arrangement describe?
- A retailer keeps its payment-processing systems in its own data center but automatically shifts web front-end workloads to a public cloud provider during seasonal traffic peaks. Which deployment model is this, and what is a key security implication?
- A cloud team deploys 50 environments from a single infrastructure-as-code template. A later review finds that the same storage bucket in every environment allows public read access, all traced to one line in the template. What does this situation BEST illustrate about infrastructure as code?
- A manufacturer's security team learns that the programmable logic controllers on a production line have a published vulnerability. Applying the vendor's firmware update requires stopping the line, and an unplanned stop creates safety hazards. Which approach BEST fits the priorities of this operational technology environment?
- A research lab keeps its classified design network physically disconnected from all other networks, with no wired or wireless links. Malware is nevertheless found on several workstations in that network, and the investigation traces it to a USB drive a contractor used to move test files into the lab. What does this incident BEST demonstrate about air-gapped networks?
- A company splits its monolithic e-commerce application into dozens of microservices that call one another through internal APIs. The architects previously relied on a perimeter firewall in front of the single application. Which security implication should they address FIRST in the new design?
- A retailer must isolate its cardholder data environment from the rest of the network. An assessor warns that with VLANs on shared switches, a single switch misconfiguration could bridge the zones. Management requires isolation that does not depend on the configuration of shared network devices, regardless of cost. Which approach meets this requirement?
- An online service runs entirely in one cloud region, spread across that region's availability zones. The business now requires the service to keep running and recover quickly even if the entire region becomes unavailable. Which architectural change BEST meets this requirement?
- A development team must choose between an open-source cryptography library and a proprietary SDK with similar features. The security team requires the ability to inspect the source code during reviews and has staff available to track and apply updates itself. Which statement accurately reflects a security implication of choosing the open-source library?
- A software company plans to host customer data for European clients in a cloud platform. Its contracts require that this data remain within the European Union because it is subject to the laws of the country where it is stored. Which business consideration is driving this architectural constraint?
- A startup with a small security budget expects its customer traffic to grow roughly tenfold over the next two years and wants to avoid large upfront hardware purchases. Which approach to its security architecture BEST balances cost and scalability?
- A network team is adding an intrusion prevention system to the internet edge. They want it to block attacks in real time but inspect only traffic that the edge firewall has already permitted, so it is not overloaded by traffic the firewall would drop anyway. Where should the IPS be placed?
- An organization hosts public web servers that must be reachable from the internet, but if one is compromised, the attacker must not have direct access to internal workstations and databases. Which design BEST meets this requirement?
- An external scan shows that the web administration interfaces and SSH services on the company's firewalls and core switches are reachable from every user VLAN, and one firewall's admin page is reachable from the internet. Which action MOST effectively reduces this attack surface?
- A company protects its data center with two layers of firewalls, both the same model from the same vendor. An attacker uses a single exploit for that model's firmware to bypass both layers in one step. Which architectural principle would MOST directly have reduced this risk?
- In a zero trust deployment, an employee who signed in at 8:00 a.m. tries at 2:00 p.m. to download a large, highly sensitive dataset from an unfamiliar location. The policy engine evaluates the request and requires the employee to complete MFA again before access is granted. Which zero trust practice does this BEST demonstrate?
- A user with a valid username, password, and MFA approval is denied access to the company's internal applications. The access logs show that the zero trust policy engine rejected the request because the user's laptop is missing critical operating system patches and its endpoint protection agent is not reporting. Which zero trust control caused the denial?
- Contractors need access to a single internal web application. Today they connect through a full-network VPN that lets them reach every internal subnet once connected. The security team wants to apply zero trust principles without placing contractors on the internal network at all. Which approach BEST meets this goal?
- A company is opening a branch office and needs all traffic between the branch network and headquarters to travel over the internet encrypted, without installing client software on each branch workstation. Which solution BEST meets this requirement?
- A company with a mostly remote workforce wants to retire the practice of backhauling user traffic to headquarters. It needs a cloud-delivered service that provides secure web gateway filtering, cloud access security broker controls, and zero trust access to private applications, without replacing its existing WAN routing. Which solution BEST fits?
- A routing loop has taken down the production network, and administrators cannot reach the core switches over SSH because SSH runs over that same network. Which capability would have let them reach the switches' management consoles during this outage?
- A company exchanges payroll files with a partner using plain FTP over the internet. An audit finds that usernames, passwords, and file contents can be captured by anyone on the network path. Which replacement BEST addresses this finding?
- Executives want a messaging platform for board discussions with the requirement that the service provider itself must be unable to read message contents, even if its servers are compromised or it receives a legal demand. Which capability BEST satisfies this requirement?
- A Windows domain uses one service account to run a line-of-business service on 30 servers. Its password has not been changed in five years because updating it on every server manually risks an outage. Which solution BEST resolves this while removing the manual password handling?
- During a quarterly access review, an auditor finds that an employee who moved from accounts payable to purchasing and then to IT support still holds the permissions from all three roles. No permissions were removed at any transfer. Which issue does this BEST describe, and how should it be remediated?
- A review finds that system administrators read email, browse the web, and open documents while signed in with their domain administrator accounts. Which change BEST applies least privilege to reduce the impact if one of these activities leads to a compromise?
- A building's power fails. The electronic lock on an emergency exit door along an evacuation route and the perimeter firewall protecting the data center network are both affected. Which failure mode configuration is MOST appropriate for these two devices?
- A data discovery scan finds customer details in a relational database with defined fields and the same details scattered across email messages, PDF reports, and slide decks on file shares. Which statement BEST describes the difference in protecting these two data types?
- An analytics service decrypts customer records so it can run calculations on them, and the security team is worried that an attacker with access to the host could read the plaintext straight out of RAM while the computation runs. Which data state is exposed, and which protection addresses it most directly?
- A company writes nightly backups to a disk array in its data center and then replicates those backup sets across a leased WAN link to a disaster recovery site. Which pairing of controls correctly protects the backups in each data state?
- A manufacturer's production control recipes are not secret from staff, but if they were lost or unavailable the assembly lines would stop within hours. Which data classification best describes information whose defining concern is that the business cannot operate without it?
- A defense contractor stores government documents marked Secret alongside others marked Top Secret, and a new hire asks how the two markings relate. Which statement correctly describes the relationship between these classification levels?
- Call center agents must confirm a caller's identity using only the last four digits of the payment card, while the billing system must keep storing and charging the full card number. Which data protection method best meets both requirements?
- A payment platform replaces every stored card number with a random surrogate value that has no mathematical relationship to the original, and only a separately protected vault can map a surrogate back to the real number. Which data protection method is this?
- A hospital will give an outside research team a copy of patient records so the team can study diagnoses and treatment outcomes, but the researchers must not be able to identify any individual patient, even with full access to the copy they receive. Which method best meets this requirement?
- An application must confirm that the answer a user types to a security question matches the answer given at enrollment, but the database must never hold the original answers in a form that anyone could recover. Which method should the developers use?
- The vice president of human resources decides that payroll records are confidential and approves who may read them, while the IT storage team configures the backups, encryption and access permissions she approved. Which roles do the vice president and the storage team hold, in that order?
- A retailer collects customer data and decides why and how it is processed. It contracts a cloud CRM vendor to process the data on its behalf, and that vendor engages a separate support firm that also handles the retailer's customer records. How should the support firm be classified?
- A company names an analyst in its marketing division to own the consistency of customer data definitions, data quality rules and accurate metadata for the customer dataset. She does not decide the dataset's classification and does not run the servers. Which data role has the company assigned?
- A healthcare firm wants its patient records app on corporate tablets to refuse to open any record whenever the device's reported location is outside the country, regardless of which network the tablet is using. Which data handling control meets this requirement?
- Sensitive design documents keep leaving the company by email because staff do not realize the files are sensitive, and the data loss prevention system cannot distinguish them from routine files. Which first step best addresses both problems?
- The retention period that company policy sets for closed customer accounts has ended, and legal counsel confirms that no legal hold applies to those records. Which action should follow in the data management life cycle?
- A firm needs its order system running at an alternate location within roughly a day of losing its primary data center. Leadership will not pay for continuous real-time replication, but it will fund standby hardware and network links that are kept ready. Which recovery site fits?
- Every production workload a company runs sits on a single hypervisor product, and a new advisory warns that one escape flaw in that hypervisor could let an attacker compromise all of the workloads at once. Which resilience strategy most directly removes this single point of failure?
- An application has a stateless web tier that any server can serve and a stateful database that must keep one consistent copy of its data and move to a standby node if the primary node fails. Which pairing of resilience techniques best fits the two tiers?
- An online store running on cloud virtual machines is overwhelmed by traffic spikes during flash sales, while between events the extra capacity it keeps running sits idle and costs money. Which resilience approach best addresses both problems?
- A server room suffers frequent power interruptions and brownouts lasting from a few seconds to a few minutes, and each one causes servers to reboot. Long multi-hour outages are rare and are already covered by an on-site generator. Which addition best fixes the reboots?
- Attackers used stolen administrator credentials to encrypt the company's backup repository along with its production servers. Which backup capability would have prevented them from altering or deleting the existing backup copies, even with administrator rights?
- A company's nightly backup jobs have reported success for months, but when an incident forces a restore, the data cannot be recovered because the backup media are corrupt. Which practice would most likely have revealed the problem beforehand?
- A backup team is asked to define which servers, databases and SaaS data must be included in backups, and how long each set of copies must be kept to satisfy legal and business requirements. Which two backup concepts is the team defining?
- A company wants to prove that its disaster recovery systems can actually process real transaction workloads correctly, but production must stay online and serving customers throughout the test. Which type of test best meets both requirements?
- After any failure of its order database, the business states it can tolerate losing no more than 15 minutes of order data. Which recovery metric does this statement define, and what does that metric drive?
- A team is comparing two firewall models. Model X has a mean time between failures of 50,000 hours and a mean time to repair of 8 hours. Model Y has a mean time between failures of 30,000 hours and a mean time to repair of 2 hours. Which statement is correct?
- During a regional flood, a company keeps taking customer orders by phone with paper forms and relocates key staff to a partner office, while the IT team works separately to bring the flooded data center's systems back. Which plan governs keeping those essential business functions running?
- Growth projections show that within a year the security operations center's log volume will exceed its storage, its analysts will be unable to keep up with alert volume, and its network links will saturate. Which practice addresses these needs across people, technology and infrastructure before the shortfall arrives?
Security Operations · 81 questions
- Attackers compromised a lobby visitor kiosk and then reached the finance servers directly, because every device in the building sits on one flat network. Which mitigation most directly prevents an attacker from repeating that lateral path?
- A new server built from a vendor's default image goes live with the default administrator account enabled, sample web applications installed and several unused services listening on the network. Which action best reduces its attack surface?
- A security team wants to see what unknown email attachments actually do when opened, such as files they write or connections they attempt, without risking any production endpoint. Which mitigation should the team apply?
- After an intrusion in which attackers dumped stored credentials and reused them, a team wants an immediate, high-confidence alert the next time anyone tries to use harvested credentials. Which deception technique best meets this goal?
- A security research team wants to lure attackers into a convincing environment of several interconnected decoy servers and workstations so it can observe how they move laterally from one system to another. Which deception technology fits this goal?
- Public self-service kiosks in a store should run only the vendor's ordering application, yet staff keep finding unfamiliar executables on them that new malware variants have dropped. Which control most effectively prevents unauthorized programs from running on the kiosks?
- A network intrusion detection sensor connected to a mirrored switch port correctly alerted on exploit traffic aimed at a public web server, but it could not stop the traffic. The team now wants that traffic dropped automatically at the network perimeter. Which control should it deploy?
- Unauthorized wireless access points keep appearing in an office, plugged in by employees who want better coverage, and the security team wants them detected and automatically contained without walking the floor. Which control best fits?
- A public web API is being hit with sudden bursts of thousands of requests per second from a handful of clients, and the same application is also receiving SQL injection attempts in request parameters. Which single control best mitigates both problems?
- A perimeter firewall allows outbound TCP 443 for web browsing, but an unapproved file-sharing application and a tunneling tool both use port 443 and slip through. Staff must keep normal web access while those two applications are blocked. Which firewall capability is required?
- Employees' laptops frequently work from home and travel without connecting to the corporate VPN, and the company must stop sensitive files from being uploaded to personal cloud storage wherever the laptop happens to be. Which data loss prevention approach fits best?
- Analysts must manually stitch together alerts from endpoint, email, network and cloud tools to reconstruct each attack, and incidents are being missed between the tools. Which endpoint security approach best addresses this?
- Only corporate laptops that are authenticated and meet current patch and endpoint-protection requirements may connect to the wired network; non-compliant devices must be kept off until they are fixed. Which network access control approach meets this requirement?
- Developers keep accidentally committing cloud API keys and database passwords into the company's shared source code repository, and some of those keys were later abused. Which control most directly catches these credentials before they are exposed?
- Attackers are sending email that spoofs the company's exact domain to its customers. The company already publishes SPF and DKIM records, but receiving servers have no instruction on what to do when those checks fail, and the company receives no reports about such mail. Which step best addresses this?
- Linux web servers must confine the web server process with mandatory access control, so that even if the process is compromised it cannot read files outside its labeled context, regardless of standard file ownership. Which operating system security control fits?
- A company launches an asset management program, but one team tracks only hardware, another tracks software licenses and SaaS subscriptions, and nobody tracks datasets, so the inventories cannot be combined. Which asset life cycle activity was skipped?
- To save money, a team bought network switches from an unvetted online reseller, and an inspection later found counterfeit units running modified firmware. Which asset management control would most directly have prevented this?
- Several laptops have gone missing, and investigators cannot determine who last had them, because devices are handed out from a shared pool without any record of who receives them. Which asset management practice most directly fixes this accountability gap?
- Network scans keep discovering devices that are not in the asset inventory, while the inventory still lists hardware that was retired months ago. Which practice best keeps the inventory aligned with what actually exists?
- Hard drives from decommissioned servers were sold to an electronics recycler without any sanitization, and a researcher later recovered customer data from them. Which control should the company adopt for future disposal?
- A security manager is documenting the hardware asset management life cycle for new staff. Which sequence lists the stages in the correct order?
- A vulnerability scan run without credentials reports very few findings on a group of servers, yet administrators know those servers are missing several operating system patches and have weak local security settings. Which change will most improve the accuracy of future scans?
- A vulnerability manager discovers that the scanner's target list was built years ago from a spreadsheet, and a recent compromise involved an on-premises server on a subnet that had never been scanned. Which source would BEST establish the full set of address ranges and allocations in use so future scans cover every network?
- A company runs workloads in dozens of accounts across two public cloud providers. Audits keep finding storage buckets made public and security group rules opened to the internet, usually weeks after the change. Which solution would continuously detect these configuration problems across all accounts against defined policies?
- A development team is finishing a new payment module and wants to find insecure coding patterns and logic flaws, such as missing authorization checks, before the code is built and released. No test or production environment is running the module yet. Which vulnerability identification method fits this requirement?
- A vulnerability scan rates a flaw on an isolated lab host, which holds no sensitive data, at a CVSS base score of 9.8. The latest penetration test report shows testers chained two medium-severity findings on production servers to gain domain administrator rights. Which should the team remediate FIRST?
- A scan reveals a critical remotely exploitable flaw in a building management appliance that must stay in service. The vendor states that a patch will not be available for several months. Which action BEST reduces exposure now?
- An administrator deploys a vendor patch for a high-severity vulnerability to thirty servers, and the patch management console reports success on all of them. Which step provides verification that the vulnerability has actually been remediated?
- A CISO asks the vulnerability management team to prepare a quarterly report for the executive leadership committee, which decides on funding and risk acceptance. Which content is MOST appropriate for this internal report?
- An independent researcher emails a company's security team about a flaw in its public website. The company has no published process for outside reports, and management does not want to offer financial rewards. Which should the company establish so future reports arrive through a defined channel with agreed rules?
- A team already monitors CPU, memory, and disk usage on the hosts that run a customer portal. They now need to detect spikes in failed logins, error responses, and unusual transaction patterns produced by the portal itself. Which category of monitoring should they add?
- Analysts investigating incidents must log in to each of forty servers separately to read local logs, and correlating events across systems takes hours. Which activity would MOST improve their ability to investigate across all servers?
- A SIEM correlation rule fires hundreds of alerts every day when the organization's authorized vulnerability scanner runs its scheduled scans. Analysts have started ignoring the rule's alerts entirely. Which action BEST addresses the problem while preserving detection of real attacks?
- A regulation requires the organization to retain security logs for one year, but the SIEM's searchable storage holds only thirty days and management will not increase SIEM storage costs. Which activity BEST meets the requirement?
- A security team must routinely measure hundreds of servers against a published hardening benchmark and produce standardized, machine-readable compliance results. Which approach BEST fits this requirement?
- An organization needs to monitor the health and security events of network appliances and printers whose vendors do not allow third-party software to be installed on them. Which monitoring approach fits these devices?
- A network team needs months of data showing which internal hosts communicate with which external addresses, on which ports, and how much data moves, without storing packet payloads. Which source BEST meets this requirement?
- A network team must centralize event messages from routers and switches and also poll those devices for health statistics. Security policy requires that the polling protocol authenticate requests and encrypt its traffic. Which combination BEST meets these requirements?
- A security team deploys a passive network intrusion detection sensor and needs it to receive a copy of all traffic passing through an access switch without affecting the flow of production traffic if the sensor fails. Which configuration BEST meets this requirement?
- The executive leadership team wants a weekly at-a-glance view of the organization's security posture, including open critical vulnerabilities, incident counts, and patch compliance trends, without being interrupted by individual events. Which tool BEST meets this need?
- An audit finds that an employee terminated two weeks ago still has active VPN and SaaS accounts, and the help desk learned of the departure only through a later email. Which process change BEST ensures access is removed when people leave?
- A file server has thousands of permissions granted directly to individual user accounts. When employees change roles, their old permissions remain, and administrators cannot easily tell who should have what. Which approach BEST corrects this?
- A remote company issues laptops and accounts to new hires it has never met in person. A recent fraud case involved a person who used stolen personal details to get hired and obtain credentials. Which control BEST addresses this before credentials are issued?
- Employees need to sign in to a partner's browser-based SaaS application using their existing corporate credentials, and the company does not want user passwords stored by or sent to the partner. Which approach BEST meets this requirement?
- A third-party scheduling application needs to read users' corporate calendars through the provider's API. The company forbids users from giving their passwords to the application and wants access limited to calendar data and revocable by the user. Which technology BEST fits?
- An organization requires all administrative access through its cloud identity provider with MFA. Leadership worries that an outage of the identity provider or MFA service could lock administrators out of critical systems. Which control BEST addresses this concern?
- An attacker who compromised one workstation used its local administrator password to log in to dozens of other workstations, because every machine had the same local administrator password. Which control BEST prevents this lateral movement path?
- A user's phone, which held their only authenticator app, was lost on a trip, and they cannot complete MFA to sign in. During enrollment, the organization issued each user a set of single-use recovery values. Which response BEST restores access while keeping MFA in place?
- A government contractor's operating system assigns classification labels to files and clearance levels to users. A project lead who owns a secret-labeled file tries to share it with a colleague cleared only for confidential, and the system refuses. Which access control model is in use?
- Engineers occasionally need administrator rights on production servers to resolve change tickets. The security team wants no standing admin access, with elevation granted only for an approved ticket and removed automatically when the work window ends. Which access control approach BEST fits?
- A regulator requires the company to demonstrate each quarter that every user's access to its financial systems is still appropriate for their job. Which control BEST provides this evidence?
- Attackers using real-time phishing proxies have captured employees' passwords and the one-time codes from their authenticator apps. The organization wants an authentication method that a look-alike site cannot capture and replay. Which option BEST meets this goal?
- A password policy forces changes every thirty days, and an audit finds users choosing predictable patterns such as a season plus the year. Which policy change BEST aligns with current password best practices?
- New hires frequently start without the correct application access, while others receive access they should not have, because IT creates each account manually from email requests. Which automation use case BEST addresses this?
- Operations staff make undocumented changes to servers during troubleshooting, and over time many servers no longer match the approved security baseline. Which automation approach BEST keeps servers aligned with the baseline continuously?
- SOC analysts spend much of each shift copying SIEM alert details into the ticketing system by hand, and some alerts are never ticketed. Which automation BEST addresses this problem?
- An automated containment playbook isolated a production database server from the network after a false-positive alert, causing a significant outage. The team wants to keep automated containment for most endpoints. Which change BEST reduces this risk?
- An engineer proposes building custom orchestration code to automate a ten-minute manual task that runs twice a year. The code would need ongoing maintenance whenever the connected systems change. Which consideration should MOST influence the decision?
- A SOC deploys an AI tool that, without step-by-step prompting, pulls related logs, enriches indicators, decides whether an alert is benign, and closes or escalates the ticket on its own. Which AI capability is this, and what does it MOST require?
- A security team wants a system that learns each user's and host's normal activity patterns and flags deviations, such as unusual login times or data volumes, instead of relying on fixed thresholds. Which capability BEST matches this description?
- A development team deploys code to production many times a day, and security testing currently happens only in a manual review before each quarterly audit. Which change BEST integrates security into this delivery process?
- During a recent ransomware incident, responders argued over who could authorize taking systems offline, who would contact legal counsel, and in what order to act. Which preparation activity BEST prevents this confusion in future incidents?
- The executive team gathers in a conference room while a facilitator walks them through a hypothetical data breach, asking how they would respond at each stage. No systems are touched and no actions are actually taken. Which type of exercise is this?
- After reading a report about a new adversary technique, analysts form a hypothesis and proactively search endpoint and network telemetry for signs that the technique was used in their environment, even though no alert has fired. Which activity is this?
- A software vendor publishes a security advisory stating that its remote access product was exploited and listing indicators of compromise, including file hashes and attacker IP addresses. The organization runs that product. Which incident response activity should this advisory MOST directly support?
- During an internal investigation, a hard drive containing evidence was passed among four staff members over two weeks, with no record of who held it, when, or why. Defense counsel now challenges the evidence. Which problem does this situation MOST directly illustrate?
- An organization is sued, and its legal counsel asks IT to identify, preserve, collect, and produce all emails and documents relevant to a contract dispute for review by both parties. There is no indication of a security breach. Which process is this?
- An endpoint detection tool shows that a workstation infected with worm-like malware is actively scanning and attempting to infect other hosts on the same subnet. Which action should the responder take FIRST?
- A ransomware outbreak has been contained by isolating the affected servers. The team must now decide the order of the next activities. Which sequence is CORRECT?
- A company confirms that attackers stole an unencrypted database of customer names, addresses, and government identification numbers. Applicable privacy law requires breaches of this type of data to be reported. Which action BEST meets the organization's obligations?
- A phishing-driven account compromise has been eradicated and all systems are restored. Several weeks earlier a similar incident occurred. Which post-incident activity should the team perform to prevent another recurrence?
- An investigator needs to determine which accounts signed in to a specific Linux server last week, from which source addresses, and whether any attempts failed. Which data source should the investigator examine FIRST?
- Overnight, someone unplugged a storage array inside a badge-controlled server room. A contractor is suspected, but the contractor says they never entered the room. Which data sources should the investigator use to confirm or refute the contractor's statement?
- A workstation has started beaconing to an unfamiliar domain. The analyst needs to know which process launched the payload, what its parent process was, and the command-line arguments used. Which log source should the analyst examine first?
- An internal spreadsheet was leaked and posted on a public forum. Investigators want to identify which account created the file and when it was last modified, without relying on the forum poster's claims. What should the investigators examine first?
- The SOC suspects a database server has been sending large volumes of data to an unfamiliar external IP address for the past month. Full packet capture is retained for only 48 hours. Which data source most efficiently shows which hosts talked to that address, when, and how many bytes moved during the month?
- Before handing exported firewall logs to legal counsel, an investigator must be able to demonstrate later that the files have not been modified since they were collected. What should the investigator do at the time of collection?
- Responders suspect fileless malware is running only in memory on a live server. Management wants the server powered off right away to stop the spread. Which action should the responders take first to preserve the most relevant evidence?
- An investigation into data exfiltration points to a specific employee, and management wants to interview the employee and possibly take disciplinary action. Which stakeholders should the security team involve before any of those steps are taken?
- An analyst must find every failed login across several gigabytes of authentication logs collected from dozens of servers and then count the failures per source IP address. Which approach is most effective?
Security Program Management and Oversight · 42 questions
- A security team publishes a document that recommends, but does not require, that developers follow a published hardening benchmark when building short-lived test environments. Which type of governance artifact is this document?
- An organization requires every new Linux server to meet a documented minimum set of configuration settings, including disabled unused services, enabled logging, and specific password settings, before it can enter production. What does this document represent?
- Help desk staff need step-by-step instructions to safely restart a payment service after hours, including the checks to perform before and after the restart and whom to notify. Which governance artifact should be created?
- After a flood destroys the primary data center, the IT team needs a document that tells them how to restore servers, networks, and data at the alternate site and in what priority order. Which plan should the team follow?
- Employees want to read company email on their personally owned phones. The security team must define requirements such as device enrollment, a screen lock, and the company's right to remotely wipe corporate data from those phones. Which policy should define these requirements?
- During an evening walkthrough, a security officer finds printed customer records left on several desks, visible to cleaning staff and visitors. Which policy most directly addresses this behavior?
- Independent security researchers have found flaws in a company's public web application, but they are unsure how to report them and fear legal action if they do. Which policy should the company publish to address this?
- A company is starting its first formal risk management program and wants to begin with risk identification. Which activity should come first?
- A risk team rates each identified risk as high, medium, or low for both likelihood and impact and plots the results on a heat map. No monetary values are assigned. Which type of risk analysis is the team performing?
- A server is valued at $200,000. If a specific flood scenario occurs, 25 percent of the server's value would be lost, and that flood is expected to occur once every two years. What is the annualized loss expectancy (ALE) for this risk?
- A CISO wants a single living record that lists each identified risk with its owner, likelihood and impact ratings, current mitigations, planned treatment, and review date, so it can be reported to leadership regularly. What should the organization maintain?
- After analyzing ransomware risk, a company decides to buy a cyber insurance policy that would cover recovery costs and business interruption losses if an attack succeeds. Which risk treatment does this purchase represent?
- A company determines that a legacy customer file-sharing service carries risk it cannot reduce cost-effectively. Leadership decides to decommission the service entirely and stop offering it. Which risk treatment is this?
- After deploying new controls on a customer portal, the remaining risk is still rated above the level the board has formally stated it is willing to accept. What should the organization do next?
- Before choosing recovery strategies, a company wants to identify which business processes are most critical, how disruption to each would affect revenue and obligations over time, and how long each can be down. Which activity should it perform?
- A new regulation requires that senior leadership demonstrate accountability for cybersecurity risk decisions. The CISO now presents the top risks to the board each quarter, and the board formally approves the risk appetite. Which business-level risk consideration does this demonstrate?
- A company is exploring managed detection and response services for the first time. Before writing formal requirements, it wants to collect general information from several providers about their capabilities, service models, and experience. Which document should it issue?
- Before signing a contract with a new managed security provider, a company reviews the provider's financial stability, independent audit reports, breach history, and security controls, and checks whether any executive has a financial stake in the provider. Which vendor selection activity is this?
- A cloud provider's contract commits to 99.9 percent monthly availability, with service credits owed if it is missed. Internally, the provider's engineering team works to a stricter 99.95 percent goal to leave a safety margin. What is the internal 99.95 percent figure?
- A company and a consulting firm sign one contract setting the general terms for all future work, such as liability, payment terms, and confidentiality. For each engagement they then sign a separate document listing deliverables, timeline, acceptance criteria, and price. What is the per-engagement document?
- A company outsources card payment processing. It wants contractual assurance that it can inspect the vendor's security controls when needed, and it also wants formal annual evidence that the vendor remains compliant with the applicable standard. Which combination meets both needs?
- A company discovers that its SaaS vendor stores customer data only in another country with different privacy laws, and that the vendor uses a proprietary data format that would make migrating to another provider slow and costly. Which two third-party limitations does this describe?
- A company wants a penetration test of its application, which is hosted on a third-party cloud provider's platform. Before any testing begins, what must be established with the provider and the testing team?
- Tellers at a regional bank must be trained to recognize structured cash deposits and unusual transfers that could be hiding the proceeds of crime or funding terrorist groups, and to escalate them appropriately. Which compliance training topic does this describe?
- After updating its acceptable use policy, a company requires every employee to electronically confirm that they have received and read the new version. The confirmations are recorded and retained by HR. Which compliance monitoring element does this represent?
- A regulator finds that a healthcare provider repeatedly failed to protect patient data and revokes the provider's authorization to operate a pharmacy in that jurisdiction. Which consequence of non-compliance does this represent?
- A customer closes their account with an online retailer and asks the retailer to permanently delete all personal data it holds about them, where no legal obligation requires keeping it. Which privacy right is the customer exercising?
- A retailer uses a cloud payroll provider to pay its employees. The retailer decides what employee data is collected and why it is processed; the provider processes that data only according to the retailer's instructions. Which roles do the two organizations hold?
- Legal counsel reasonably expects a former employee to file a lawsuit about their termination. The company's retention schedule will automatically delete that employee's email and HR records next week. What should the company do?
- An auditor cannot review all 40,000 access-change tickets from the past year, so the auditor selects 60 tickets at random and checks each for documented manager approval before drawing a conclusion about the whole population. Which data-gathering technique is the auditor using?
- A security team wants to map behaviors observed during a recent intrusion to a publicly maintained knowledge base organized as a matrix of adversary tactics and techniques, so it can identify detection gaps. Which reference source should the team use?
- A company is creating an internal audit function. The board wants a formal document that defines the function's purpose, authority, independence, scope, and reporting line to the audit committee. Which document should be created?
- A company plans to adopt an industry security framework next year. It first wants to compare its current controls with the framework's requirements to find what is missing and plan remediation. No certification or external opinion is needed yet. Which engagement type fits?
- A company hires a penetration testing firm and gives the testers only the company's name. They receive no network diagrams, credentials, or source code, so they must discover everything the way an outside attacker would. What type of penetration test is this?
- During the first phase of an authorized penetration test, testers collect employee names, email formats, and technology details from the company's website, social media, job postings, and public records, without sending any traffic to the company's systems. Which activity is this?
- An assessor sends a test message with a known malicious attachment to a mailbox to verify that the email security gateway actually quarantines it as designed. Which kind of testing is the assessor performing?
- An employee has clicked the link in a phishing simulation for the second time this quarter. The security team wants to assign short, immediate training that addresses that specific mistake. Which type of training is most appropriate?
- A company must deliver security awareness training to 5,000 employees who work remotely across several time zones. It needs self-paced content, automatic reminders, and completion records for auditors. Which delivery mechanism fits best?
- Leadership asks whether the security awareness program is actually changing employee behavior. Which measurement provides the best evidence?
- Several finance employees have received convincing emails, apparently from a long-time supplier, asking them to update the supplier's bank account details before the next invoice is paid. Which awareness topic should targeted training for this group emphasize?
- Many staff now work from cafes and home offices, and several have been seen plugging in USB drives they were given at conferences. Which pair of awareness topics should the security team add to training for these staff?
- Employees have been posting photos on social media that show their ID badges, the office layout, and screens in the background. Which awareness topic most directly addresses this behavior?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by CompTIA, Inc..