CompTIA Security+ SY0-701 (CyberVista Practice Test) — Questions and Answers

Question 1: A U.S.-based e-commerce company processes data for customers in California and the European Union. A key difference in their compliance obligations between CCPA and GDPR relates to the basis for processing personal data. Which statement accurately describes this difference?

GDPR requires a specific legal basis (like consent) for processing, while CCPA operates on an 'opt-out' model. (Correct answer)
CCPA requires a legal basis for processing, while GDPR allows processing by default.
Both regulations require an 'opt-in' consent model before collecting any user data.
Both regulations have identical requirements for data breach notifications, making consent models similar.

Correct answer: GDPR requires a specific legal basis (like consent) for processing, while CCPA operates on an 'opt-out' model.

A primary difference between the two regulations is their approach to consent. GDPR requires organizations to have one of six specific legal bases (e.g., explicit consent, contractual necessity) to process personal data, which is an 'opt-in' model. CCPA, on the other hand, allows for the collection and processing of data by default but requires giving consumers a clear option to 'opt-out' of the sale or sharing of their personal information.

Question 2: An organization is using the OSI model to guide its layered security strategy. At which layer would a security architect primarily focus on implementing IPsec to secure network communications?

Layer 4 (Transport Layer)
Layer 7 (Application Layer)
Layer 3 (Network Layer) (Correct answer)
Layer 2 (Data Link Layer)

Correct answer: Layer 3 (Network Layer)

IPsec (Internet Protocol Security) operates at the Network Layer (Layer 3) of the OSI model. It is used to secure IP communications by authenticating and encrypting each IP packet of a communication session.

Question 3: What is the function of antivirus software?

It improves battery life.
It updates the hardware.
It protects the computer by detecting and removing malware (Correct answer)
It slows down the system.

Correct answer: It protects the computer by detecting and removing malware

Antivirus software is specifically designed to protect computers by identifying, preventing, and removing malicious software, commonly known as malware. It scans files and programs for known threats and suspicious behavior, safeguarding the system's integrity and data. Its core function is to combat digital infections.

Question 4: A web application takes serialized user-supplied data, reconstructs it into an object, and then processes it. An attacker crafts a malicious serialized object that, when deserialized by the application, leads to arbitrary code execution on the server. Which vulnerability has been exploited?

XML External Entity (XXE) injection
Server-Side Request Forgery (SSRF)
Insecure Deserialization (Correct answer)
Cross-Site Request Forgery (CSRF)

Correct answer: Insecure Deserialization

Insecure Deserialization occurs when an application deserializes untrusted or malicious data without sufficient validation. This can allow an attacker to create unexpected object types, manipulate application logic, and ultimately achieve remote code execution, as described in the scenario.

Question 5: How is risk calculated in cybersecurity?

Likelihood x Impact (Correct answer)
Compliance + Security.
Budget / Cost.
Value - Vulnerability.

Correct answer: Likelihood x Impact

In cybersecurity, risk is commonly calculated as the product of the likelihood of a threat exploiting a vulnerability and the potential impact of that exploitation. This formula, Likelihood x Impact, provides a quantitative measure to prioritize risks. It helps organizations understand both how probable an event is and how severe its consequences would be.

Question 6: Why is it important to classify assets?

To determine how to protect them (Correct answer)
To delete them easily.
To avoid audits.
To hide them from users.

Correct answer: To determine how to protect them

Classifying assets involves categorizing them based on their value, sensitivity, and criticality to the organization. This process is crucial because it helps determine the appropriate level of security controls and resources needed to protect each asset effectively. Without proper classification, it's difficult to implement targeted and cost-efficient security measures.

Question 7: During a routine security audit, a vulnerability scanner identifies a critical cross-site scripting (XSS) flaw in a public-facing web application. Which of the following tools would be MOST appropriate for this type of discovery?

Static Application Security Testing (SAST) tool
Network Mapper (e.g., Nmap)
Container Scanner (e.g., Trivy)
Web Application Vulnerability Scanner (e.g., Acunetix, OWASP ZAP) (Correct answer)

Correct answer: Web Application Vulnerability Scanner (e.g., Acunetix, OWASP ZAP)

Web application vulnerability scanners are specialized tools designed to scan and identify security flaws specific to web applications, such as SQL injection and cross-site scripting (XSS). While a SAST tool also finds vulnerabilities, it does so by analyzing source code, not by testing the running application from the outside.

Question 8: Why is log management critical for monitoring?

To fill disk space.
To create user profiles.
To monitor battery levels.
To track system activity and security events (Correct answer)

Correct answer: To track system activity and security events

Log management is critical for monitoring because logs provide a detailed record of every event that occurs within a system or network. By collecting, storing, and analyzing these logs, organizations can track system activity, identify security events, and detect anomalies or potential threats. This historical data is invaluable for forensic investigations, compliance auditing, and understanding the overall health and security of the IT infrastructure.

Question 9: A security analyst notices that an organization's web server has become extremely slow and unresponsive. A network traffic analysis reveals that the server is being inundated with a massive volume of requests from thousands of different IP addresses simultaneously. This is characteristic of what type of attack?

Distributed Denial-of-Service (DDoS) Attack (Correct answer)
Brute Force Attack
Denial-of-Service (DoS) Attack
Spyware

Correct answer: Distributed Denial-of-Service (DDoS) Attack

A Distributed Denial-of-Service (DDoS) attack overwhelms a target system with traffic from multiple, distributed sources, making it unavailable to legitimate users. A regular DoS attack is similar but originates from a single source. A brute force attack is a method of guessing passwords, and spyware is a type of malware that secretly gathers information.

Question 10: Which environmental threat to data center hardware is best mitigated by maintaining relative humidity between 40% and 60%?

Overheating
Condensation causing short circuits
Electrostatic discharge (ESD) (Correct answer)
Power surges

Correct answer: Electrostatic discharge (ESD)

Maintaining proper humidity levels reduces static electricity buildup that can cause ESD damage to sensitive electronic components.

Question 11: What is the first phase of the incident response lifecycle?

Containment.
Eradication.
Preparation (Correct answer)
Recovery.

Correct answer: Preparation

The incident response lifecycle typically begins with the 'Preparation' phase. This phase involves proactive measures such as establishing policies, training staff, implementing security controls, and developing comprehensive incident response plans before an incident occurs. Effective preparation is crucial for minimizing the impact and improving the efficiency of subsequent response efforts.

Question 12: An organization has successfully contained a malware outbreak by isolating the affected systems from the network. According to the NIST incident response lifecycle, what is the immediate NEXT step the security team should take?

Post-Incident Activity
Eradication (Correct answer)
Detection & Analysis
Preparation

Correct answer: Eradication

The NIST incident response lifecycle groups Containment, Eradication, and Recovery together as a single phase. After an incident is successfully contained to prevent further spread, the next logical step is Eradication—the process of removing the threat, such as malware or a malicious actor's foothold, from the affected systems.

Question 13: What should be done after an incident is resolved?

Erase the logs.
Shut down all systems.
Document the lessons learned and update plans (Correct answer)
Forget the incident.

Correct answer: Document the lessons learned and update plans

After an incident is resolved, it is crucial to conduct a post-incident review to document lessons learned and update existing incident response plans and security policies. This step helps organizations understand what went wrong, identify areas for improvement, and enhance their preparedness for future incidents. This fosters continuous security improvement and resilience.

Question 14: According to the NIST Special Publication 800-61, which phase of the incident response lifecycle involves learning from a security incident and implementing improvements to prevent its recurrence?

Preparation
Containment, Eradication, & Recovery
Post-Incident Activity (Correct answer)
Detection & Analysis

Correct answer: Post-Incident Activity

The Post-Incident Activity phase is the final stage in the NIST incident response lifecycle. This phase includes a 'lessons learned' meeting and analysis to understand the incident's root cause and improve security controls, policies, and procedures to prevent future similar incidents.

Question 15: An organization is conducting a risk assessment and uses descriptive ratings such as 'High,' 'Medium,' and 'Low' to evaluate the likelihood and impact of identified risks based on expert judgment and experience. What type of risk assessment is being performed?

Hybrid
Quantitative
Qualitative (Correct answer)
Ad-hoc

Correct answer: Qualitative

A qualitative risk assessment uses descriptive or categorical ratings (e.g., high, medium, low) to evaluate risks based on subjective judgment, experience, and context. This method is less precise than a quantitative assessment but is often quicker and easier to perform when numerical data is not available.

Question 16: Why are incident response plans tested regularly?

To ensure preparedness and effectiveness (Correct answer)
To delay future responses.
To avoid compliance checks.
To reduce system uptime.

Correct answer: To ensure preparedness and effectiveness

Regular testing of incident response plans is crucial to ensure that they are current, effective, and that personnel are prepared to execute them. Testing helps identify weaknesses, gaps, or outdated procedures in the plan, allowing for necessary adjustments and training. This improves an organization's ability to respond efficiently and effectively to real-world security incidents, minimizing their impact.

Question 17: Which of the following is an example of a vulnerability?

Regular backups.
Strong password policy.
Updated software.
Unpatched software flaw (Correct answer)

Correct answer: Unpatched software flaw

A vulnerability is a weakness or flaw in a system that can be exploited by a threat actor. An unpatched software flaw directly represents such a weakness, as it leaves the software susceptible to attacks that target that specific defect. The other options are security measures, not vulnerabilities.

Question 18: What is the goal of the eradication phase?

To block users.
To remove malware and fix vulnerabilities (Correct answer)
To delete backups.
To shut down the network.

Correct answer: To remove malware and fix vulnerabilities

The eradication phase in incident response focuses on completely removing the root cause of the incident, such as malware, compromised accounts, or backdoors. It also involves identifying and patching vulnerabilities that allowed the attack to occur. The goal is to ensure that the threat is fully eliminated and systems are secured before they are restored to operation.

Question 19: An organization has identified a risk to its data center from a potential long-term power outage. The organization decides to purchase a contract with a third-party provider for a fully equipped disaster recovery site. Which risk treatment strategy is being employed?

Risk Transference (Correct answer)
Risk Avoidance
Risk Acceptance
Risk Mitigation

Correct answer: Risk Transference

Risk transference (or transfer) involves shifting the impact of a risk to a third party. By contracting with a disaster recovery site provider, the organization is transferring the responsibility and financial burden of maintaining a secondary site, thereby sharing the risk of a data center outage.

Question 20: Which RAID level provides both striping and mirroring, requiring a minimum of four drives and offering fault tolerance for up to one drive failure per mirrored pair?

RAID 0
RAID 1
RAID 10 (Correct answer)
RAID 5

Correct answer: RAID 10

RAID 10 combines mirroring (RAID 1) and striping (RAID 0), providing high performance and redundancy with the ability to survive a drive failure in each mirrored pair.

Question 21: What is the primary difference between a virus and a worm?

A virus is designed to steal data, while a worm is designed to cause network disruption.
A worm can self-replicate and spread independently across networks, while a virus requires a host file or program to spread. (Correct answer)
A virus can self-replicate, while a worm cannot.
A worm requires human interaction to spread, while a virus does not.

Correct answer: A worm can self-replicate and spread independently across networks, while a virus requires a host file or program to spread.

The primary distinction is that a worm is a standalone piece of malware that can replicate and spread on its own through a network. A virus, on the other hand, needs to attach itself to a legitimate program or file. Human action, like opening an infected file, is typically required to trigger the virus and allow it to spread.

Question 22: Which of the following is a form of social engineering where an attacker sends a fraudulent email that appears to be from a legitimate and reputable source to trick the recipient into revealing sensitive information, such as login credentials or credit card numbers?

Phishing (Correct answer)
Spoofing
Ransomware
Trojan Horse

Correct answer: Phishing

Phishing is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. Ransomware holds a system hostage for a fee, a Trojan horse is malware disguised as legitimate software, and Spoofing is a broader term for disguising communication from an unknown source as being from a known, trusted source.

Question 23: What does the CIA triad stand for in cybersecurity?

Control, Input, Audit
Compliance, Identity, Alerting
Communication, Infrastructure, Access
Confidentiality, Integrity, Availability (Correct answer)

Correct answer: Confidentiality, Integrity, Availability

The CIA triad is a foundational model in cybersecurity, representing the three core principles for securing information. Confidentiality ensures that data is accessible only to authorized individuals, preventing unauthorized disclosure. Integrity guarantees that data remains accurate and unaltered, protecting against unauthorized modification. Availability ensures that authorized users can access information and systems when needed.

Question 24: A security analyst needs to implement an encryption method that is fast, efficient for large amounts of data, and uses a single key for both encryption and decryption. Which type of cryptography best meets these requirements?

Quantum cryptography
Asymmetric encryption
Symmetric encryption (Correct answer)
Hashing

Correct answer: Symmetric encryption

Symmetric encryption uses a single shared key to both encrypt and decrypt data. It is known for its speed and efficiency, making it ideal for encrypting large volumes of data, such as in database or file encryption.

Question 25: Which of the following best defines a Recovery Time Objective (RTO)?

The maximum acceptable time to restore a system or process after a disruption (Correct answer)
The minimum number of backup copies required
The maximum tolerable amount of data loss measured in time
The time interval between scheduled backups

Correct answer: The maximum acceptable time to restore a system or process after a disruption

RTO defines how quickly a system must be restored after an incident to avoid unacceptable business impact.

Question 26: An attacker is using a technique to intercept and alter communication between two parties who believe they are directly communicating with each other. The attacker is situated between the two parties and is relaying messages, potentially manipulating the content without their knowledge. Which of the following attacks is being described?

SQL Injection
Man-in-the-Middle (MitM) (Correct answer)
DDoS
Phishing

Correct answer: Man-in-the-Middle (MitM)

A Man-in-the-Middle (MitM) attack is a form of eavesdropping where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. The other options are incorrect: Phishing involves tricking users into revealing sensitive information, a DDoS attack overwhelms a system with traffic to make it unavailable, and a SQL Injection attack targets databases by inserting malicious SQL code.

Question 27: Which cloud service model gives customers the most control over the operating system, middleware, and runtime environment?

FaaS
IaaS (Correct answer)
SaaS
PaaS

Correct answer: IaaS

Infrastructure as a Service (IaaS) provides virtualized compute, storage, and networking, allowing customers to manage everything from the OS up.

Question 28: What is the primary goal of cybersecurity?

To monitor employee performance.
To create new software.
To protect digital assets from unauthorized access (Correct answer)
To slow down network speeds.

Correct answer: To protect digital assets from unauthorized access

The primary goal of cybersecurity is to establish robust defenses that protect digital assets, such as data, systems, and networks, from unauthorized access, use, disclosure, disruption, modification, or destruction. This involves implementing various technologies, processes, and controls to safeguard information and ensure the continuity of operations. Ultimately, it aims to maintain the confidentiality, integrity, and availability of digital resources.

Question 29: What is the purpose of a Business Impact Analysis (BIA)?

To determine the potential effects of disruptions on critical business functions and prioritize recovery (Correct answer)
To assess an organization's firewall configuration
To identify vulnerabilities in web applications
To enumerate all IT assets and assign ownership

Correct answer: To determine the potential effects of disruptions on critical business functions and prioritize recovery

A BIA identifies mission-critical processes, estimates financial and operational impact of downtime, and informs RTO/RPO targets.

Question 30: A company wants to allow its employees to use their corporate credentials to log in to a third-party SaaS application for expense reporting. This is an example of which IAM concept?

Role-Based Access Control (RBAC)
Identity Governance and Administration (IGA)
Privileged Access Management (PAM)
Identity Federation (Correct answer)

Correct answer: Identity Federation

Identity Federation allows users from one domain (the company's corporate network, or Identity Provider) to securely access resources in another domain (the third-party SaaS app, or Service Provider) without needing a separate set of credentials. This establishes a trust relationship between the two entities, enabling single sign-on capabilities.

Question 31: In the context of Identity and Access Management, what is the key difference between authentication and authorization?

Authentication is the process of logging user actions, while authorization is the process of reviewing those logs.
Authentication is the process of verifying a user's identity, while authorization is the process of granting or denying access to specific resources. (Correct answer)
Authentication involves managing the user lifecycle, while authorization is focused on password policies.
Authentication determines if a user is an administrator, while authorization determines if they are a standard user.

Correct answer: Authentication is the process of verifying a user's identity, while authorization is the process of granting or denying access to specific resources.

Authentication is the first step, where a system verifies that users are who they claim to be, typically through credentials like a password, a biometric scan, or a security token. Once a user is authenticated, authorization takes place to determine what specific resources, files, or actions they are permitted to access based on predefined policies.

Question 32: A financial institution's web application has a vulnerability where an attacker can insert malicious commands into the application's database queries. This allows the attacker to view, modify, or delete sensitive customer data. What type of vulnerability is being exploited?

XML External Entity (XXE)
SQL Injection (Correct answer)
Cross-Site Scripting (XSS)
Server-Side Request Forgery (SSRF)

Correct answer: SQL Injection

This scenario describes a SQL Injection attack. SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It allows them to view data that they are not normally able to retrieve. XSS involves injecting malicious scripts into trusted websites, SSRF tricks a server into making requests to an unintended location, and XXE is an attack against applications that parse XML input.

Question 33: Data masking is primarily used to:

Hash passwords before storing them in a database
Replace sensitive data with realistic but fictitious values for non-production use (Correct answer)
Tokenize payment card data for PCI-DSS compliance
Encrypt data during transmission over public networks

Correct answer: Replace sensitive data with realistic but fictitious values for non-production use

Data masking substitutes sensitive production data with structurally similar but non-sensitive values so developers and testers can work with realistic datasets safely.

Question 34: What is risk acceptance?

Removing all users.
Choosing to tolerate a known risk without mitigation (Correct answer)
Ignoring the risk.
Eliminating all risk.

Correct answer: Choosing to tolerate a known risk without mitigation

Risk acceptance is a deliberate decision by an organization to acknowledge a known risk and choose not to take any action to mitigate or transfer it. This decision is typically made when the cost of mitigation outweighs the potential impact of the risk, or when the risk is deemed to be within acceptable tolerance levels. It is a conscious choice, not simply ignoring the risk.

Question 35: What is the role of a firewall in network security?

To log user keystrokes.
To block unauthorized access and allow safe traffic (Correct answer)
To increase bandwidth.
To install applications.

Correct answer: To block unauthorized access and allow safe traffic

A firewall acts as a security barrier between a trusted internal network and untrusted external networks, such as the internet. Its primary role is to monitor and control incoming and outgoing network traffic based on predefined security rules. By filtering data packets, a firewall effectively blocks unauthorized access attempts and malicious traffic while permitting legitimate and safe communication, thereby protecting the network from external threats.

Question 36: Why is containment a key step in incident response?

It increases system logs.
It slows down the internet.
It prevents further damage during an attack (Correct answer)
It restarts the servers.

Correct answer: It prevents further damage during an attack

Containment is a critical step in incident response because its primary goal is to stop the spread of an attack and prevent further damage to systems and data. This phase involves isolating affected systems, disconnecting networks, or implementing other measures to limit the scope and impact of the security incident, thereby minimizing losses.

Question 37: What is a common risk mitigation strategy?

Decreasing system performance.
Implementing security controls (Correct answer)
Ignoring the issue.
Increasing exposure.

Correct answer: Implementing security controls

Risk mitigation involves taking proactive steps to reduce the likelihood or impact of a risk. Implementing security controls, such as firewalls, access controls, encryption, and intrusion detection systems, directly addresses vulnerabilities and threats. These controls are designed to prevent, detect, or respond to security incidents, thereby reducing overall risk exposure.

Question 38: Which log source is most useful for auditing API calls and administrative actions in a cloud environment?

DNS query logs
Cloud provider audit logs (e.g., AWS CloudTrail, Azure Activity Log) (Correct answer)
NetFlow records
Endpoint antivirus logs

Correct answer: Cloud provider audit logs (e.g., AWS CloudTrail, Azure Activity Log)

Cloud audit logs record every API call, configuration change, and administrative action, making them essential for forensic investigation and compliance.

Question 39: Which cloud security control helps detect unauthorized changes to cloud resource configurations in near real time?

Cloud Security Posture Management (CSPM) (Correct answer)
Cloud DLP
Cloud WAF
Cloud SIEM integration

Correct answer: Cloud Security Posture Management (CSPM)

CSPM tools continuously audit cloud configurations against security benchmarks and alert on deviations or misconfigurations.

Question 40: What does data sovereignty mean in the context of cloud security?

Ensuring data is subject to the laws of the country where it is stored or processed (Correct answer)
Allowing only the data owner to decrypt sensitive information
Maintaining a single copy of data for audit purposes
Encrypting data before it leaves the organization

Correct answer: Ensuring data is subject to the laws of the country where it is stored or processed

Data sovereignty means that data stored in a particular country is governed by that nation's laws, which can affect privacy and compliance requirements.

Question 41: Which standard provides a framework for protecting cardholder data and applies to any organization that stores, processes, or transmits payment card information?

PCI-DSS (Correct answer)
HIPAA
SOX
FISMA

Correct answer: PCI-DSS

The Payment Card Industry Data Security Standard (PCI-DSS) was created by major card brands to protect cardholder data and reduce credit card fraud.

Question 42: An employee inadvertently downloads a malicious software program that was disguised as a free utility. Once executed, the software encrypts all the files on their computer and displays a message demanding payment in exchange for the decryption key. This is an example of what type of malware?

Adware
Worm
Ransomware (Correct answer)
Virus

Correct answer: Ransomware

Ransomware is a type of malicious software designed to block access to a computer system or encrypt its data until a sum of money is paid. A virus attaches itself to other programs to replicate, a worm is a standalone malware that replicates itself to spread to other computers, and adware is software that displays unwanted advertisements.

Question 43: What is the first step in a risk assessment?

Blocking network traffic.
Installing antivirus.
Identifying assets and their value (Correct answer)
Patching systems.

Correct answer: Identifying assets and their value

The first step in any effective risk assessment is to identify and understand the assets that need protection, along with their value to the organization. This involves cataloging hardware, software, data, intellectual property, and critical business processes. By knowing what assets exist and their importance, organizations can then prioritize which ones require the most robust security measures against potential threats.

Question 44: What is a honeypot in cybersecurity?

A type of backup server.
An email filter.
A decoy system to detect and study attacks (Correct answer)
An antivirus update.

Correct answer: A decoy system to detect and study attacks

A honeypot is a cybersecurity mechanism that acts as a decoy system, intentionally designed to attract and trap cyber attackers. Its purpose is to detect unauthorized access attempts, gather intelligence on attack methods, and study attacker behavior without risking actual production systems. This allows organizations to learn about new threats and improve their defenses proactively.

Question 45: In a Public Key Infrastructure (PKI), what is the primary role of a Certificate Authority (CA)?

To encrypt and decrypt user data.
To create and maintain the Certificate Revocation List (CRL) exclusively.
To verify the identity of entities and issue digital certificates. (Correct answer)
To generate and securely store users' private keys.

Correct answer: To verify the identity of entities and issue digital certificates.

The fundamental role of a Certificate Authority (CA) is to act as a trusted third party that validates the identity of entities (like websites, organizations, or individuals) and binds that identity to a public key by issuing a signed digital certificate.

Question 46: What is the principle of least privilege as applied to cloud IAM?

Every user receives admin rights to ensure they can complete their work
Cloud resources are restricted to a single geographic region
All API calls must go through a single privileged gateway
Users and services are granted only the minimum permissions necessary for their specific tasks (Correct answer)

Correct answer: Users and services are granted only the minimum permissions necessary for their specific tasks

Least privilege in cloud IAM ensures that each identity has only the permissions it needs, minimizing the blast radius of compromised credentials.

Question 47: A company is setting up an internal network and needs to issue certificates for its internal servers and devices. The company wants full control over the certificate issuance process and does not require public trust. Which PKI component should they implement?

A Private Certificate Authority (Correct answer)
A Public Certificate Authority
A Registration Authority
A Validation Authority

Correct answer: A Private Certificate Authority

A Private Certificate Authority (or internal CA) is set up and managed by an organization for its own internal use. This allows the organization to issue and manage certificates for internal servers, devices, and users without needing validation from a public CA, providing complete control over the trust hierarchy.

Question 48: What is the shared responsibility model in cloud security?

The cloud provider is responsible for all security
A third-party auditor handles all security requirements
Security duties are divided between the cloud provider and the customer based on the service model (Correct answer)
Customers are solely responsible for all security controls

Correct answer: Security duties are divided between the cloud provider and the customer based on the service model

In the shared responsibility model, the cloud provider secures the underlying infrastructure while customers secure their data, identities, and configurations.

Question 49: Which type of backup site is fully equipped and operational, allowing near-immediate failover during a disaster?

Mobile site
Hot site (Correct answer)
Warm site
Cold site

Correct answer: Hot site

A hot site is a fully mirrored, always-on facility that can take over operations within minutes of a primary site failure.

Question 50: A security administrator is configuring access for a new database administrator (DBA). Following the principle of least privilege, which approach should the administrator take?

Grant the DBA full administrative rights to all servers on the network to ensure they can perform any necessary task.
Provide the DBA with administrative access only to the specific database servers they are responsible for managing. (Correct answer)
Assign the DBA to a standard user group and have them request elevated privileges for each specific task.
Clone the permissions of the previous DBA who had broad access to multiple systems.

Correct answer: Provide the DBA with administrative access only to the specific database servers they are responsible for managing.

The principle of least privilege dictates that users should only be granted the minimum level of access and permissions necessary to perform their job functions. Providing administrative access only to the specific database servers the DBA manages directly aligns with this principle, minimizing the potential attack surface if the account were to be compromised.

Question 51: Within a cybersecurity governance structure, what is the hierarchical relationship between policies, standards, and procedures?

Policies are high-level statements of intent, supported by mandatory standards, which are implemented through step-by-step procedures.
Procedures are high-level statements, which are supported by standards and enforced by policies.
Standards and policies are interchangeable, while procedures describe the technology used. (Correct answer)
Standards are high-level goals, which are implemented by policies and detailed in procedures.

Correct answer: Standards and policies are interchangeable, while procedures describe the technology used.

The correct hierarchy is that Policies are high-level statements of management's intent. Standards provide mandatory, specific requirements to support the policies. Procedures are detailed, step-by-step instructions that document how to implement the standards and, by extension, the policies.

Question 52: What is the function of an Identity and Access Management (IAM) role in cloud environments?

It scans cloud workloads for malware
It encrypts communication between cloud services
It grants a set of permissions to cloud resources or services without using long-term credentials (Correct answer)
It creates virtual network segments within the cloud

Correct answer: It grants a set of permissions to cloud resources or services without using long-term credentials

IAM roles provide temporary, scoped permissions to cloud resources or services, eliminating the need to embed static credentials in code or config.

Question 53: What is a zero-day vulnerability?

A password reset.
A routine update.
An unknown and unpatched software flaw (Correct answer)
A blocked firewall port.

Correct answer: An unknown and unpatched software flaw

A zero-day vulnerability refers to a software flaw that is unknown to the vendor and for which no patch or fix has been released. Attackers can exploit these vulnerabilities 'on day zero' of their discovery, before developers have a chance to address them. This makes them particularly dangerous as there is no immediate defense available.

Question 54: Which of the following BEST describes the primary function of Security Assertion Markup Language (SAML) in an Identity and Access Management framework?

To directly query user attributes and credentials stored in a directory service like LDAP or Active Directory.
To enforce multi-factor authentication (MFA) by providing a standardized method for transmitting one-time passwords.
To exchange authentication and authorization data between an identity provider (IdP) and a service provider (SP) to enable single sign-on (SSO). (Correct answer)
To provide a framework for creating and managing digital identities and their lifecycles within an organization.

Correct answer: To exchange authentication and authorization data between an identity provider (IdP) and a service provider (SP) to enable single sign-on (SSO).

SAML is an open standard specifically designed for exchanging authentication and authorization information between parties, most commonly an Identity Provider (IdP) and a Service Provider (SP). Its primary use case is to facilitate web-based, cross-domain single sign-on (SSO), allowing a user to log in once and gain access to multiple separate systems without re-entering credentials.

Question 55: Which of the following enterprise architecture frameworks is specifically focused on being business-driven and uses a six-layered model (Contextual, Conceptual, Logical, Physical, Component, and Operational) to align security with business objectives?

Control Objectives for Information and Related Technologies (COBIT)
The Open Group Architecture Framework (TOGAF)
Zachman Framework
Sherwood Applied Business Security Architecture (SABSA) (Correct answer)

Correct answer: Sherwood Applied Business Security Architecture (SABSA)

SABSA is a business-driven framework for enterprise security architecture. It emphasizes aligning security with business goals from the start and uses a six-layered model to view the architecture from different perspectives. TOGAF and Zachman are broader enterprise architecture frameworks, and COBIT is a framework for IT governance and management.

Question 56: What does a packet sniffer do?

Captures and analyzes network traffic (Correct answer)
Patches software.
Deletes logs.
Creates firewall rules.

Correct answer: Captures and analyzes network traffic

A packet sniffer, also known as a network analyzer, is a tool that intercepts and logs network traffic passing over a digital network. Its purpose is to capture individual data packets, allowing security professionals and network administrators to examine their contents. This analysis helps in diagnosing network problems, monitoring network usage, and detecting suspicious activities or security breaches by inspecting the raw data being transmitted.

Question 57: Which of the following BEST describes the primary purpose of a Business Impact Analysis (BIA) within a GRC framework?

To assign roles and responsibilities for the incident response team.
To identify critical business functions and determine the potential effects of a disruption to those functions. (Correct answer)
To identify and catalog all organizational assets and their monetary value.
To select and implement specific security controls to mitigate threats.

Correct answer: To identify critical business functions and determine the potential effects of a disruption to those functions.

A Business Impact Analysis (BIA) is a systematic process to identify critical business functions and evaluate the potential effects of a disruption on them. The BIA helps determine recovery priorities, recovery time objectives (RTOs), and the resources required to maintain operational resilience, forming the foundation for business continuity planning.

Question 58: A cybersecurity analyst receives a threat intelligence report detailing the specific Tactics, Techniques, and Procedures (TTPs) used by a newly identified advanced persistent threat (APT) group that targets financial institutions. What type of threat intelligence is this?

Tactical
Operational (Correct answer)
Technical
Strategic

Correct answer: Operational

Operational threat intelligence provides insights into the 'how' and 'where' of an attack, focusing on the TTPs, motives, and campaign plans of specific threat actors. This information helps security teams understand the nature of attacks and anticipate future actions. Tactical intelligence is more focused on immediate indicators like malicious IPs or hashes.

Question 59: A company has a high turnover rate in its sales department. Which automated IAM process is most critical to implement to mitigate the security risk associated with departing employees?

Multi-factor authentication (MFA) enrollment
User provisioning
User deprovisioning (Correct answer)
Access certification campaigns

Correct answer: User deprovisioning

User deprovisioning is the process of promptly revoking a user's access to all corporate systems and data when their employment is terminated. Automating this process is critical in a high-turnover environment to ensure that former employees cannot retain access, which would create a significant security vulnerability known as an 'orphaned account'.

Question 60: The Zachman Framework provides a structure for enterprise architecture by using a matrix that relates different stakeholder perspectives to various aspects of the enterprise. Which of the following correctly identifies the two dimensions of the Zachman Framework matrix?

Business Drivers and Technology Constraints
Phases of the SDLC and Data Classification Levels
Security Controls and Risk Levels
Stakeholder Perspectives (Rows) and Interrogatives/Abstractions (Columns) (Correct answer)

Correct answer: Stakeholder Perspectives (Rows) and Interrogatives/Abstractions (Columns)

The Zachman Framework is structured as a two-dimensional matrix. The rows represent different stakeholder perspectives (e.g., Planner, Owner, Designer), and the columns represent different aspects or interrogatives (What, How, Where, Who, When, Why).

Question 61: What is the purpose of a risk matrix?

To document employee benefits.
To manage payroll data.
To assess the probability and severity of risks (Correct answer)
To create new network protocols.

Correct answer: To assess the probability and severity of risks

A risk matrix is a fundamental tool in risk management used to visually assess and prioritize various risks. It typically plots the likelihood or probability of a risk event occurring against the potential impact or severity of that event. This helps organizations understand which risks are most critical and require immediate attention.

Question 62: What physical security measure uses biometric data such as fingerprints or retinal scans as an authentication factor?

Something you have
Something you are (Correct answer)
Somewhere you are
Something you know

Correct answer: Something you are

Biometric authentication is classified as 'something you are' because it relies on unique physical or behavioral characteristics of the individual.

Question 63: Which of the following BEST describes the concept of data minimization?

Deleting all data after a project is complete
Collecting only the data necessary for a specified purpose (Correct answer)
Encrypting data to reduce its readable size
Compressing data to reduce storage costs

Correct answer: Collecting only the data necessary for a specified purpose

Data minimization is a privacy principle requiring organizations to collect and retain only the minimum amount of personal data necessary to fulfill a specific, stated purpose.

Question 64: What is serverless computing from a security perspective?

A deployment with no network exposure at all
A private cloud architecture with no external connections
A model that eliminates the need for any encryption
A model where the provider manages all OS patching and the customer focuses on function-level code security (Correct answer)

Correct answer: A model where the provider manages all OS patching and the customer focuses on function-level code security

In serverless (FaaS) environments, the cloud provider abstracts the OS and runtime, but customers remain responsible for their function code and configurations.

Question 65: Under GDPR, organizations are required to report a personal data breach to the supervisory authority within:

72 hours of discovery (Correct answer)
7 days of discovery
48 hours of discovery
24 hours of discovery

Correct answer: 72 hours of discovery

GDPR Article 33 requires that a personal data breach likely to result in risk to individuals must be reported to the relevant supervisory authority within 72 hours of becoming aware of it.

Question 66: What is a Cloud Access Security Broker (CASB)?

A tool for scanning cloud storage for malware
A security policy enforcement point between cloud users and cloud services (Correct answer)
An identity provider for single sign-on to cloud apps
A firewall appliance deployed in the cloud

Correct answer: A security policy enforcement point between cloud users and cloud services

A CASB sits between users and cloud services to enforce security policies such as data loss prevention, access control, and threat protection.

Question 67: Which data classification label is typically assigned to information that, if disclosed, would cause serious damage to national security?

Secret
Confidential
Sensitive
Top Secret (Correct answer)

Correct answer: Top Secret

Top Secret is the highest government classification level and is applied to information whose unauthorized disclosure could cause exceptionally grave damage to national security.

Question 68: A network architect is designing a corporate network and wants to logically divide a single physical network into multiple, isolated broadcast domains. The goal is to improve security by containing traffic within specific departments (e.g., Finance, HR, Engineering) and reducing unnecessary network traffic. Which technology is MOST suitable for this purpose?

Virtual Local Area Networks (VLANs) (Correct answer)
Network Address Translation (NAT)
Subnetting
Dynamic Host Configuration Protocol (DHCP)

Correct answer: Virtual Local Area Networks (VLANs)

Virtual Local Area Networks (VLANs) are used to logically segment a network into different broadcast domains. This allows devices to be grouped together by function or department regardless of their physical location, improving security by isolating traffic and enhancing performance by reducing broadcast traffic.

Question 69: Which key management practice is MOST critical for maintaining long-term data confidentiality?

Embedding encryption keys within the encrypted data for easy recovery
Using the same encryption key for all data types to simplify management
Sharing encryption keys with all authorized administrators via email
Regularly rotating encryption keys and securely storing them separately from the data (Correct answer)

Correct answer: Regularly rotating encryption keys and securely storing them separately from the data

Regular key rotation limits the exposure window if a key is compromised, and storing keys separately from encrypted data ensures that gaining access to the ciphertext alone is insufficient.

Question 70: Which of the following hashing algorithms is now considered insecure and vulnerable to collision attacks, making it unsuitable for modern security applications like password storage?

Bcrypt
MD5 (Correct answer)
SHA-256
SHA-3

Correct answer: MD5

MD5 is an older hashing algorithm that has been found to have significant vulnerabilities, most notably its susceptibility to collision attacks, where two different inputs can produce the same hash value. Due to this weakness, it is considered insecure for modern cryptographic purposes.

Question 71: Why is incident detection important?

To respond promptly and limit damage (Correct answer)
To replace firewalls.
To increase system downtime.
To test backup systems.

Correct answer: To respond promptly and limit damage

Incident detection is critical because it enables an organization to identify security breaches or anomalies as quickly as possible. Early detection allows for a prompt response, which is essential to contain the incident, limit the extent of damage, and minimize potential data loss or operational disruption. Timely awareness is key to effective incident management.

Question 72: What is the primary risk of using public APIs without authentication in a cloud-hosted application?

Unauthorized parties can query, modify, or delete application data (Correct answer)
It prevents multi-region deployment
APIs become incompatible with IAM roles
Increased latency due to encryption overhead

Correct answer: Unauthorized parties can query, modify, or delete application data

Unauthenticated public APIs allow any internet user to interact with backend services, potentially exposing or corrupting sensitive data.

Question 73: What is the purpose of a Security Information and Event Management (SIEM) system?

To manage user passwords.
To design firewalls.
To update software.
To monitor and analyze security logs in real time (Correct answer)

Correct answer: To monitor and analyze security logs in real time

A Security Information and Event Management (SIEM) system is designed to centralize and analyze security data from various sources across an organization's IT infrastructure. Its primary purpose is to collect, aggregate, and analyze security logs and events in real-time. This allows for the detection of potential security threats, policy violations, and suspicious activities, enabling rapid response and improved overall security posture.

Question 74: What term describes the practice of spreading data and workloads across multiple cloud providers to avoid vendor lock-in and increase resilience?

Cloud federation
Hybrid deployment
Cloud bursting
Multi-cloud strategy (Correct answer)

Correct answer: Multi-cloud strategy

A multi-cloud strategy uses two or more cloud providers, reducing dependency on any single vendor and improving availability.

Question 75: What is the fundamental difference between a digital signature and a digital certificate?

A digital certificate is used to prove ownership of a public key, while a digital signature is used to verify the integrity and authenticity of data. (Correct answer)
A digital signature uses symmetric keys, while a digital certificate uses asymmetric keys.
A digital certificate is created by the user, while a digital signature is issued by a Certificate Authority.
A digital signature encrypts data, while a digital certificate hashes it.

Correct answer: A digital certificate is used to prove ownership of a public key, while a digital signature is used to verify the integrity and authenticity of data.

A digital certificate is an electronic document issued by a CA that binds an identity to a public key, proving who owns it. A digital signature is a cryptographic mechanism used to verify the authenticity (proof of sender) and integrity (proof the data wasn't altered) of a message or document.

Question 76: Which of the following is considered Protected Health Information (PHI) under HIPAA?

General wellness information in a fitness app
Anonymized clinical trial data
A patient's name combined with their medical diagnosis (Correct answer)
Aggregated, de-identified patient statistics

Correct answer: A patient's name combined with their medical diagnosis

PHI is individually identifiable health information that includes any combination of an identifier (such as a name) and health-related data (such as a diagnosis or treatment).

Question 77: A financial services company is implementing a new access control policy. They require a dynamic model that can make access decisions based on a user's role, the sensitivity of the data they are trying to access, their current geographic location, and the time of day. Which of the following access control models would be MOST suitable for these requirements?

Discretionary Access Control (DAC)
Role-Based Access Control (RBAC)
Mandatory Access Control (MAC)
Attribute-Based Access Control (ABAC) (Correct answer)

Correct answer: Attribute-Based Access Control (ABAC)

Attribute-Based Access Control (ABAC) is the most suitable model because it uses policies that evaluate multiple attributes of the user, resource, and environment to make real-time access decisions. This allows for the creation of complex, context-aware rules that can factor in variables like location and time, which is not possible with the other models. RBAC is based solely on user roles, while MAC and DAC are less flexible for this kind of dynamic environment.

Question 78: A software developer wants to ensure that the source code of an application has not been altered since it was created and to provide proof of its origin. Which cryptographic control should be used to achieve both data integrity and non-repudiation?

A message digest
A digital certificate
A digital signature (Correct answer)
A symmetric key

Correct answer: A digital signature

A digital signature, created by hashing the data and then encrypting the hash with the sender's private key, provides both integrity (ensuring the data hasn't changed) and non-repudiation (proving the sender's identity, as only they could have used the private key).

Question 79: A financial services company is designing a new system to handle sensitive customer transaction data. The primary security concern is to prevent unauthorized modification of this data by both internal and external actors. Which security model would be most appropriate to ensure data integrity?

Take-Grant Model
Bell-LaPadula Model
Access Control Matrix
Biba Model (Correct answer)

Correct answer: Biba Model

The Biba Model is specifically designed to address data integrity. It uses rules such as 'no read down' and 'no write up' to prevent subjects at a lower integrity level from corrupting data at a higher integrity level. The Bell-LaPadula model focuses on confidentiality, not integrity. The Take-Grant and Access Control Matrix are models for representing access rights but do not inherently enforce integrity in the same way as Biba.

Question 80: A network administrator wants to implement the most current and secure standard for a new corporate wireless network. The new standard must provide robust protection against offline dictionary attacks and ensure that even if a password is compromised, past session traffic cannot be decrypted. Which of the following wireless security protocols should be implemented?

WPA3 (Wi-Fi Protected Access 3) (Correct answer)
WPA2 (Wi-Fi Protected Access 2)
WEP (Wired Equivalent Privacy)
WPA (Wi-Fi Protected Access)

Correct answer: WPA3 (Wi-Fi Protected Access 3)

WPA3 is the latest wireless security standard that offers significant improvements over WPA2. It replaces the Pre-Shared Key (PSK) with Simultaneous Authentication of Equals (SAE), which provides stronger protection against offline dictionary attacks. WPA3 also mandates Perfect Forward Secrecy (PFS), ensuring that compromising a session key does not allow an attacker to decrypt previously captured traffic.

Question 81: What is the purpose of a succession plan in business continuity?

To document alternate network paths in case of an outage
To schedule automated failover between primary and secondary data centers
To identify and prepare backups for key personnel whose absence could disrupt critical operations (Correct answer)
To define the order in which systems are restored after a disaster

Correct answer: To identify and prepare backups for key personnel whose absence could disrupt critical operations

Succession planning ensures that if key individuals become unavailable, trained successors can assume their roles and maintain business continuity.

Question 82: Which method is MOST secure for disposing of sensitive data stored on magnetic hard drives?

Degaussing or physical destruction (Correct answer)
Formatting the drive and reinstalling the OS
Overwriting the drive once with zeros
Deleting all files and emptying the recycle bin

Correct answer: Degaussing or physical destruction

Degaussing uses a powerful magnetic field to destroy data on magnetic media, while physical destruction (shredding/crushing) ensures data cannot be recovered by any means.

Question 83: Which environmental control is used to suppress fires in a data center without damaging electronic equipment?

Sand buckets
CO2 flooding at high concentration
Water sprinkler system
Clean agent fire suppression (e.g., FM-200) (Correct answer)

Correct answer: Clean agent fire suppression (e.g., FM-200)

Clean agent systems suppress fire using gas compounds that do not leave residue or damage sensitive electronics, unlike water-based suppression.

Question 84: Which cloud deployment model provides infrastructure exclusively for a single organization and may be hosted on-premises or by a third party?

Private cloud (Correct answer)
Public cloud
Hybrid cloud
Community cloud

Correct answer: Private cloud

A private cloud dedicates resources to a single organization, offering greater control and privacy than public alternatives.

Question 85: A developer is building a web page that displays user-provided comments. To prevent stored Cross-Site Scripting (XSS) attacks, what is the MOST critical security control to implement before rendering the comments in the user's browser?

Using a Web Application Firewall (WAF)
Implementing strong server-side input validation
Performing context-aware output encoding (Correct answer)
Encrypting the comments in the database

Correct answer: Performing context-aware output encoding

While input validation is an important part of a defense-in-depth strategy, the primary and most effective defense against XSS is performing context-aware output encoding. This process ensures that any user-provided data is treated as displayable text by the browser, rather than as executable code, regardless of the characters it contains.

Question 86: A global company is looking to implement a comprehensive framework that is primarily focused on IT governance and aligning IT processes with business goals to deliver value. Which of the following frameworks would be the MOST appropriate choice?

CIS Controls
COBIT (Control Objectives for Information and Related Technologies) (Correct answer)
NIST Cybersecurity Framework (CSF)
ISO/IEC 27001

Correct answer: COBIT (Control Objectives for Information and Related Technologies)

COBIT is a framework developed by ISACA specifically for the governance and management of enterprise IT. Its primary focus is on aligning IT with business objectives, ensuring that IT investments deliver real value, and managing IT-related risks. While other frameworks focus more on security controls (NIST, CIS) or establishing an ISMS (ISO 27001), COBIT is distinct in its business-driven governance approach.

Question 87: What is a threat in cybersecurity?

A user policy.
A secure system.
A backup plan.
A potential cause of an unwanted incident (Correct answer)

Correct answer: A potential cause of an unwanted incident

In cybersecurity, a threat refers to a potential cause of an unwanted incident that could harm an organization's assets or operations. Threats can be intentional, such as cyberattacks from malicious actors, or unintentional, like human error or natural disasters. Identifying threats is crucial for understanding potential vulnerabilities and developing effective security measures to mitigate risks.

Question 88: A SOC team is configuring its logging and monitoring strategy. Which of the following is a primary goal of continuous monitoring in a security operations context?

To replace the need for an incident response plan.
To exclusively track the performance and uptime of network hardware.
To perform a one-time, comprehensive security audit of all systems.
To maintain ongoing awareness of the organization's security posture and risks. (Correct answer)

Correct answer: To maintain ongoing awareness of the organization's security posture and risks.

Continuous monitoring is the process of maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. It is a proactive and iterative process, not a one-time audit, and it complements, rather than replaces, incident response planning.

Question 89: Which of the following is an example of two-factor authentication?

Just a username and password.
Password plus a one-time code sent to a phone (Correct answer)
PIN number only.
Email and name.

Correct answer: Password plus a one-time code sent to a phone

Two-factor authentication (2FA) significantly enhances security by requiring users to provide two different types of verification factors to gain access. A common example is combining something the user knows (like a password) with something the user has (like a one-time code sent to their phone or generated by an authenticator app). This makes it much harder for unauthorized individuals to access an account, even if they compromise one factor.

Question 90: A security architect is applying the principle of 'least privilege' to a new application's design. Which of the following actions BEST exemplifies this principle?

Granting a user account only the specific permissions needed to perform its intended function. (Correct answer)
Requiring two separate administrators to approve a high-risk change.
Encrypting all data both in transit and at rest.
Ensuring the application defaults to the most secure settings upon installation.

Correct answer: Granting a user account only the specific permissions needed to perform its intended function.

The principle of least privilege dictates that a subject (user, process, or system) should be given only the minimum levels of access – or permissions – needed to perform its required functions. Encrypting data is a confidentiality control, requiring two administrators is separation of duties, and setting secure defaults is another important, but distinct, design principle.

CompTIA Security+ SY0-701 (CyberVista Practice Test)

CyberVista's (N2K) practice test for CompTIA Security+ SY0-701, assessing cybersecurity knowledge across five domains including threats, security architecture, operations, and governance. Validates skills for entry-level security practitioner roles.

Questions

90 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds