CompTIA Security+ Practice Test

Answer: B
Non-repudiation combines integrity and authentication (typically via digital signatures) so the sender cannot deny having sent the message. Confidentiality only protects against disclosure, availability ensures access to systems/data, and obfuscation merely hides data's meaning without providing proof of origin or authorship.

Answer: C
Defense in depth layers multiple independent controls so that failure of one does not expose the whole environment. Security through obscurity relies on secrecy rather than layered controls, least functionality is about disabling unneeded services/ports, and fail-open design intentionally permits access on failure, which is the opposite of this scenario.

Answer: A
Separation of duties splits critical tasks between multiple people to prevent a single person from committing fraud unilaterally. Job rotation and mandatory vacation are detective controls that expose fraud over time by moving people between roles or forcing absence, and least privilege limits the access a single account has rather than dividing a process across roles.

Answer: C
A compensating control is deployed when the primary or required control cannot be implemented on a system; it provides a comparable level of protection by other means. Here MFA is the required control, the legacy controller cannot support it, and network restriction plus a monitored jump host substitutes for it. Detective is the most tempting distractor because the scenario does mention enhanced session logging, but logging is only one part of the response and it merely records events after they occur. The classification question asks about the VLAN and jump host restriction, which actively prevents unauthorized reachability rather than discovering misuse afterward, so detective does not describe the control being asked about.

Answer: A
A deterrent control discourages a threat actor from attempting an action by raising the perceived cost or likelihood of being caught, without physically blocking the action. Signage warning of surveillance and prosecution is the classic example. Preventive is the tempting wrong choice because signage is placed at the perimeter alongside preventive measures such as fences, but a preventive control physically or logically stops the act from occurring; a sign cannot stop anyone who chooses to ignore it, which the stem states explicitly. Detective would describe the cameras themselves, not the notice about them.

Answer: D
Directive controls guide or mandate behavior through policy, standards, and procedures; enforcement depends on personnel compliance rather than on a technical mechanism. A written standard on credential handling is directive. Preventive is the most tempting answer because the intent of the standard is to prevent hardcoded secrets, but intent does not determine the control type. A preventive control would be a pre-commit hook or repository scanner that actually blocks the commit. The stem states the standard relies on people and later audits, which is precisely the distinction between directing behavior and preventing it.

Answer: B
Key stretching intentionally makes password hashing expensive so that an attacker who steals the password store must spend far more time per candidate guess, cutting offline cracking throughput by orders of magnitude. Option A is the most tempting distractor because it describes a real and valuable property of the scheme described, but that property is delivered by the unique random value, the salt, and not by the iteration count; salting defeats precomputed tables and stops identical passwords from sharing a digest, while iteration count is what raises the per guess cost. Options C and D misstate hashing entirely: hashing is one way, so the plaintext cannot be recovered or decrypted, which is the point of storing a digest rather than the password.

Answer: A
OCSP lets a client ask the certificate authority for the real time status of a single certificate, returning good, revoked, or unknown, which avoids the bandwidth and staleness problems of a bulk list. A certificate revocation list is the strongest distractor because it also answers the revocation question, but a CRL is exactly the large periodically published list the stem rules out; between publication intervals it can be stale. A certificate signing request is what an applicant submits to obtain a certificate and has nothing to do with revocation status.

Answer: C
A wildcard certificate is issued for a name such as an asterisk followed by the domain, so it validates any single level subdomain of that domain and can be deployed across many hosts under one issuance and renewal cycle. A self signed certificate is the most tempting alternative because it is free and easy to issue internally, but it still has to be created and distributed per host and, more importantly, is not chained to a trusted authority, so clients raise warnings unless the certificate is manually trusted everywhere. An extended validation certificate changes the identity vetting level, not the number of hostnames covered.

Answer: D
Key escrow stores a copy of the encryption or recovery key with a trusted third party or internal custodian so the organization retains lawful access to its own data when the primary key holder is unavailable. A trusted platform module is the most tempting distractor because TPMs are genuinely part of most full disk encryption deployments, but a TPM seals the key to that specific machine and to its boot state, which makes recovery harder rather than easier when the user cannot authenticate. Longer keys and forward secrecy improve cryptographic strength but do nothing to restore organizational access.

Answer: B
Steganography conceals data inside another file, commonly an image or audio file, so that the carrier appears entirely normal and the existence of the hidden message is not apparent. That is exactly what the slightly oversized photographs with embedded design data describe. Data masking is the most tempting wrong answer because it is also an obfuscation technique, but masking replaces sensitive values with fictitious ones so the data can be used safely in a lower trust environment; it hides the value, not the existence of a second payload. Salting adds random input to a hash and does not conceal anything inside a file.

Answer: C
The policy enforcement point sits in the data plane, receives the decision, and allows, denies, or terminates the session. The policy engine is the strongest distractor because it is the component that actually makes the decision, and candidates frequently conflate deciding with enforcing; the stem separates the two roles deliberately and asks for the one in the traffic path. The policy administrator is the control plane element that communicates the engine's decision and establishes or tears down the connection, but it is not itself the in line enforcement device.

Answer: B
A digital signature is produced by encrypting a hash of the content with the signer's private key, and anyone holding the signer's public key can verify it, which proves both integrity and origin. Option C is the classic trap because it names the right two keys but reverses their roles; signing with a public key would let anyone forge a signature, since public keys are by definition distributed openly. Option D fails because a symmetric key shipped with the installer would be available to any attacker who downloads it, so it could not prove origin and would provide no non repudiation.

Answer: D
Perfect forward secrecy uses ephemeral key exchange so that each session's symmetric key is derived from short lived values that are discarded afterward and never recoverable from the long term certificate key. Compromising the server key later therefore does not unlock previously captured sessions. Option B is the most tempting choice because a longer key does make direct factoring harder, but it does nothing about the stated threat: if the long term key is eventually compromised by any means, every session that used it for key transport can still be decrypted regardless of its length. Pinning and mutual TLS address impersonation and authentication, not retrospective decryption.

Answer: C
A gap analysis compares a desired or required control state against the current state and enumerates the differences so remediation can be prioritized, which is exactly the described sequence. A business impact analysis is the most tempting alternative because it also produces a prioritized output, but its subject is the operational and financial consequence of losing a process, expressed through metrics such as recovery objectives, not the presence or absence of framework controls. A quantitative risk assessment assigns monetary loss values to risks and likewise does not inventory control coverage.

Answer: A
Phishing uses a fraudulent message, typically email, that impersonates a trusted entity to trick the victim into entering credentials on a fake site. Pretexting involves a fabricated scenario used in a direct social engineering conversation rather than a spoofed website, tailgating is physically following someone through a secured door, and a watering hole attack compromises a legitimate site the victim is expected to visit rather than sending a direct impersonation email.

Answer: A
Concatenating unvalidated user input directly into a SQL statement lets an attacker alter the query's logic, which is the definition of SQL injection; the fix is parameterized queries or prepared statements. Cross-site scripting injects script into pages viewed by other users, buffer overflow involves writing past allocated memory bounds, and a race condition exploits timing between concurrent operations, none of which describes unsafely built SQL strings.

Answer: B
High-volume queries to random-looking subdomains are a classic indicator of DNS tunneling used by malware to exfiltrate data or receive commands from a command-and-control server, since DNS is often allowed outbound even when other channels are restricted. DHCP renewal, software updates, and CDN lookups do not generate high-volume randomized subdomain queries to a single unfamiliar domain.

Answer: A
Privilege escalation is gaining higher-level permissions than originally granted, exactly as described. Lateral movement and pivoting involve moving to other hosts or network segments rather than escalating rights on the same machine, and footprinting is early reconnaissance performed before any access is gained.

Answer: A
Double extortion combines encryption with data theft and the threat of public leak, adding a second layer of pressure beyond just withholding decryption. Typosquatting involves registering misspelled domain names, credential stuffing reuses breached credentials at scale, and business email compromise is a targeted social-engineering fraud scheme, none of which match the encrypt-plus-leak-threat pattern described.

Answer: A
A zero-day is a vulnerability that is unknown to the vendor or unpatched, meaning defenders have had zero days to prepare a fix. It is not a known-exploited vulnerability unless active exploitation is confirmed, it is not a false positive since the flaw is real, and a compensating control is a mitigation technique, not a category of vulnerability.

Answer: D
An evil twin is a rogue access point impersonating a legitimate SSID to lure victims into connecting so traffic can be intercepted. Bluejacking targets Bluetooth devices with unsolicited messages, ARP poisoning manipulates layer-2 address tables on an existing network rather than impersonating an SSID, and a deauthentication flood alone only disconnects clients without impersonating the network.

Answer: A
A signed rules-of-engagement agreement defining scope and boundaries is the hallmark of authorized penetration testing, regardless of whether the tester has prior system knowledge (white-box) or not (black-box). An advanced persistent threat is an unauthorized, often nation-state-affiliated long-term intrusion; hacktivism is unauthorized activity motivated by ideology; and insider threat activity originates from a trusted person acting outside authorized bounds.

Answer: B
Virtual machine escape is the breach of the isolation boundary a hypervisor is supposed to enforce, letting guest code execute at the hypervisor layer and reach other guests, which is the most severe class of virtualization vulnerability. Resource reuse is the closest distractor because it also results in one tenant obtaining another tenant's data, but it does so passively through recycled memory or storage that was not sanitized before reallocation, with no compromise of the hypervisor. VM sprawl is an operational management problem that increases attack surface but does not itself cross the isolation boundary.

Answer: C
Writing beyond the end of a fixed length buffer overwrites adjacent stack memory, including saved return addresses, which is what allows arbitrary code execution; validating and bounding the length before the copy removes the root cause. Option B is tempting because both are input handling failures and candidates group them together, but a parameterized query defends against an interpreter parsing attacker data as commands, and there is no query or interpreter here. Compiler and platform defenses such as stack canaries, address space layout randomization, and non executable stacks raise the difficulty of exploitation but do not fix the missing length check itself.

Answer: D
A time of check to time of use flaw arises when a program validates a resource and then acts on it as a separate, non atomic step, allowing an attacker to substitute the resource in the window between the two. The fix is to bind the check and the use to the same resource handle rather than re-resolving the name. Directory traversal is the most tempting distractor because the exploit also ends with access to a file outside the intended scope, but traversal succeeds because the path itself was never sanitized; here the path was checked correctly and passed validation, and the defect is purely the timing gap between validation and use.

Answer: B
Password spraying tries a very small number of common passwords across a very large number of accounts specifically so that no account accumulates enough failures to trip lockout, which matches the two attempts per account across 4,000 accounts. Credential stuffing is the closest distractor because it also targets many accounts, but stuffing replays username and password pairs harvested from a breach elsewhere, so each account would be tried with its own leaked password rather than the same two seasonal guesses. A brute force attack concentrates many guesses on one account and would rapidly trigger lockout, and a rainbow table attack is performed offline against stolen hashes, producing no authentication log entries at all.

Answer: C
A watering hole attack compromises a legitimate third party site that the intended victims are known to frequent, then serves malicious content from it, often filtered to the target organization's address range as described here. Typosquatting is the most tempting distractor because it also involves victims reaching a hostile site through the browser, but typosquatting depends on the victim mistyping a domain and landing on a lookalike; in this scenario the engineers reached the correct, legitimate site, which had itself been compromised. Business email compromise is ruled out explicitly, since no malicious email was involved.

Answer: C
Business email compromise targets an employee with financial authority using a message that appears to originate from a trusted executive, exploits authority and urgency, and seeks a fraudulent funds transfer rather than malware execution. Credential harvesting is the tempting wrong answer because both start with a deceptive email, but a harvesting attack drives the victim to a fake login page to capture a password; here there is no link or portal, and the requested action is the wire itself. Smishing is ruled out because the delivery channel is email rather than SMS.

Answer: D
Typosquatting registers a domain that is a plausible misspelling of a legitimate one and relies on user typing errors to deliver visitors to attacker infrastructure. DNS poisoning is the strongest distractor because its effect on the victim looks similar, sending users to a hostile site, but poisoning corrupts resolution for the correct domain name; here the retailer's real domain still resolves correctly and a separate lookalike domain was registered. Domain hijacking would mean the attacker seized control of the retailer's actual domain registration, which the stem does not describe.

Answer: B
A logic bomb is dormant code that executes its payload only when a defined condition is met, such as a date, an event, or, as here, the absence of a specific account. A trojan is the most tempting alternative because both hide malicious functionality inside otherwise legitimate software, but a trojan's defining trait is that it deceives the user into installing or running it by masquerading as something desirable; this code was placed directly into an application the developer was authorized to modify, and its defining trait is the trigger condition. A worm self propagates across hosts, which is absent here.

Answer: A
A rootkit operates at or below the operating system boundary and intercepts the calls that enumerate files, processes, and registry keys, so on host tools receive falsified results while an offline examination of the same disk sees the real contents. That asymmetry between live and offline analysis is the diagnostic clue. Option C is the tempting distractor because fileless malware also evades file scanning, but fileless malware leaves nothing on disk, whereas offline analysis here found malicious drivers and files present. An out of date signature database would fail equally in both live and offline scanning and would not explain the difference.

Answer: A
A downgrade attack manipulates protocol negotiation so the endpoints agree on a weaker algorithm or version than either was capable of using, which is why servers should refuse deprecated versions outright rather than negotiating them. A replay attack is the most tempting distractor because both require the attacker to sit on the traffic path, but replay captures valid data and retransmits it later to impersonate a legitimate action; nothing is retransmitted here, and the compromise comes from the weakened cipher agreement. A birthday attack targets hash collision probability and is unrelated to negotiation.

Answer: C
Directory traversal, also called path traversal, abuses unsanitized relative path input so that file access escapes the intended base directory and reaches arbitrary files on the host. Server side request forgery is the strongest distractor because it also makes the server fetch a resource the attacker names, but SSRF causes the server to issue a network request to an attacker chosen URL, typically to reach internal services; here the server is reading directly from its own file system by path. Cross site scripting and cross site request forgery both execute in the victim's browser and do not read server files.

Answer: D
Stored cross site scripting persists the payload in server side storage so it executes for every user who loads the affected content, without any interaction from the attacker after submission, which is why it is the most damaging variant. Reflected cross site scripting is the classic trap here because both execute script in a victim's browser, but reflected attacks require each victim to follow a crafted link that carries the payload in the request; no link delivery occurs in this scenario since the signature is served from the database to everyone. Cross site request forgery does not inject script at all; it induces the browser to submit a state changing request.

Answer: B
Reflection means the attacker spoofs the victim's address as the source so third party servers direct their replies to the victim; amplification means the reply is substantially larger than the request, multiplying the attacker's bandwidth. Both traits appear here. Option A is the tempting distractor because it is also a volumetric denial of service pattern, but a half open connection flood consumes connection state on the target through incomplete handshakes and does not involve third party reflectors or size amplification. Option D is wrong because nothing is being intercepted or altered; the resolvers are answering normally to a forged source address.

Answer: C
The defect exploited is that a bearer token remains valid regardless of who presents it or from where, so the defense is to shorten the token's usable window and tie it to context such as the originating client, causing a replayed token to fail validation. Multifactor authentication is the most tempting distractor because it is the reflexive answer to account takeover, but it is exercised only when a session is created; the attacker here never authenticates at all and instead inherits a session the legitimate user already established after completing every factor. Lockout thresholds and password hashing are likewise never reached, because no password is guessed, submitted, or cracked.

Answer: C
Shadow IT is technology procured and used by business units without the knowledge or approval of the IT and security functions, which places data outside sanctioned controls, monitoring, and contractual protections. The malicious insider option is the most tempting because the outcome, corporate data sitting in an uncontrolled external service, resembles exfiltration, but insider threat classification turns on intent; the marketing team is trying to do its job and has no intent to harm the organization. Treating it as malicious would also drive the wrong response, which is provisioning a sanctioned alternative and tightening procurement rather than pursuing an investigation.

Answer: D
An allow list permits only enumerated, approved software to execute and blocks everything else by default, so an unknown variant is stopped regardless of whether a signature exists. It is especially well suited to fixed function endpoints whose approved software set rarely changes, as described. Option A is the most tempting because faster updates feel like the direct fix, but signature based detection is inherently reactive and cannot match a variant no vendor has yet analyzed, which is exactly the failure mode stated. Detection in alert only mode does not block execution, and awareness training does not address malware that these fixed function workstations encounter outside of user email behavior.

Answer: C
Vishing is voice phishing: social engineering conducted over a telephone call, typically combining impersonation of a trusted internal function with manufactured urgency to extract credentials or one time codes. Smishing is the most tempting distractor because a text message does appear in the scenario, but the text is the legitimate multifactor code sent by the company's own system; the attacker's delivery channel and the deception both occur on the phone call. Shoulder surfing requires physical proximity to observe the screen or keypad, and tailgating is unauthorized physical entry behind an authorized person.

Answer: C
Bloatware is unnecessary preinstalled software shipped by a manufacturer that provides no value to the organization while consuming resources and adding unpatched, unsupported code to the attack surface, which is why removing it is part of a standard imaging and hardening baseline. Spyware is the tempting distractor because both are unwanted and both may be removed by the same tooling, but spyware is defined by covertly collecting and transmitting information about the user; the stem states explicitly that the software is not malicious. Ransomware encrypts data for extortion, which is not described.

Answer: C
Missing logs are themselves an indicator of compromise: adversaries frequently clear or truncate event records during the anti forensics stage, and an unexplained gap bounded by normal activity on both sides is a strong signal, which is why forwarding logs to a write protected central collector matters. Option B is the most tempting because rotation genuinely does create gaps in local files, but rotation is scheduled, recurring, and would produce comparable gaps at other times rather than a single unexplained window aligned with the intrusion. Option D inverts the reasoning, since a truly offline server would show a corresponding gap in network and infrastructure telemetry as well.

Answer: A
Hardening is the process of reducing a system's attack surface by disabling unnecessary services, closing unused ports, and removing default accounts. Fuzzing is a testing technique that feeds malformed input to find bugs, threat hunting is proactively searching for signs of compromise, and steganography hides data within other files, none of which describe reducing exposed attack surface.

Answer: A
Segmentation with a controlled boundary isolates sensitive OT/ICS systems from the general corporate network while permitting tightly controlled, monitored data flow across a well-defined chokepoint. A flat network provides no isolation, a full mesh VPN would multiply direct paths between all systems rather than restrict them, and removing firewalls between zones eliminates the very boundary the scenario requires.

Answer: A
Zero trust assumes no implicit trust for any user, device, or service regardless of network location, requiring continuous verification of every request, which matches the gateway enforcing authentication/authorization on every call. An implicit trust model is the opposite, assuming internal traffic is safe; perimeter-only security relies solely on a network edge boundary; and an air-gapped network is physically isolated with no connectivity at all, which does not match a cloud API gateway design.

Answer: A
Tokenization substitutes sensitive data with a non-sensitive token that has no exploitable value outside the secure vault that maps it back to the original, which is exactly the recurring-billing scenario described. Unsalted hashing is not reversible so it cannot be mapped back for legitimate reuse, display-only masking still leaves the real number stored elsewhere, and encrypting the whole database still stores the actual card number, just protected differently, rather than replacing it with a token.

Answer: A
Planning for failover to a secondary site with minimal data loss and downtime is core to resilience and recovery architecture, encompassing high availability, replication, and disaster recovery. Data classification concerns labeling data sensitivity, least privilege concerns access rights scoping, and vulnerability scanning identifies weaknesses rather than ensuring continued operation after an outage.

Answer: A
An HSM is a dedicated, tamper-resistant hardware device built to generate, store, and manage cryptographic keys securely, isolating key material from general-purpose servers. A load balancer distributes traffic across servers, a jump server is a hardened intermediary for administrative access, and a proxy server relays and can filter client requests, none of which are purpose-built for cryptographic key custody.

Answer: B
A fail-closed configuration denies traffic when the device cannot inspect it, which enforces the stated priority that uninspected transactions are never acceptable, at the cost of an outage during appliance failure. Option A is the most tempting because fail-open is the common default in many deployments and it protects the business from downtime, but it does exactly what leadership prohibited by allowing uninspected payments through. Option D is wrong because fail-closed does not create redundancy by itself; achieving both inspection and availability requires a separate high availability pair, not a change of failure mode.

Answer: D
A jump server, also called a bastion host, is a single hardened, monitored system that administrators authenticate to first and from which all administrative connections into a protected zone originate, collapsing the firewall rule set to one permitted source. A reverse proxy is the most tempting distractor because it is also an intermediary that other systems connect through, but a reverse proxy fronts published application services for external clients; it is not an interactive administrative pivot and does not provide the session logging and account controls the scenario requires. A network tap only copies traffic for monitoring and carries no sessions.

Answer: A
A reverse proxy accepts inbound connections on behalf of internal servers, terminates and inspects TLS, and conceals back end addressing, which is precisely the published application pattern described. A forward proxy is the most tempting distractor because both are called proxies and both inspect TLS, but a forward proxy serves internal clients making outbound requests and has no role in protecting inbound published services. A network tap is passive and cannot terminate connections, and host based firewalls filter per server without providing a single inspection point or hiding the servers.

Answer: C
A web application firewall parses HTTP requests and evaluates parameters, headers, and body content against rules describing valid application input, which is what catches injection and scripting payloads carried inside otherwise legitimate requests. Option B is the most tempting because a unified threat management appliance bundles many functions and feels like a superset, but its consolidated inspection is broad rather than application aware, and it does not model a specific application's expected parameters. Option D fails the requirement outright because detection in monitor only mode raises an alert without blocking the request, and option A operates below the application layer entirely.

Answer: B
A passive, out of band sensor receives a copy of traffic from a tap or mirror port, so production packets never traverse the sensor and its failure or overload cannot affect the link, at the cost of being able only to detect rather than block. Option C is the most tempting because a hardware bypass module does protect against total device failure, but the sensor is still inline in the packet path during normal operation, which adds latency and gives it the ability to interrupt traffic, both of which the requirements forbid. Option D likewise places the device in the path.

Answer: D
In an infrastructure service the customer is issued a virtual machine and owns everything from the guest operating system upward, including its patching. In a software service the customer receives only the application, so the provider owns the operating system, platform, and application maintenance while the customer retains responsibility for its data, identities, and access configuration. Option B is the most tempting because data ownership does remain with the firm in both models and candidates over extend that principle, but data ownership does not confer operating system access in a software service; the firm has no ability to patch a host it cannot reach.

Answer: A
Infrastructure as code expresses environment definitions as templates that can be peer reviewed, versioned, scanned before deployment, and applied identically everywhere, which eliminates the configuration drift and repeated misconfiguration described. Software defined networking is the most tempting distractor because it also brings programmability to infrastructure, but it addresses how network forwarding decisions are centralized and abstracted, not how full environment definitions are authored, reviewed, and reproduced. Containerization and serverless change the workload packaging and hosting model without themselves preventing drift in the surrounding configuration.

Answer: A
Containers share the host kernel and are separated by namespaces and control groups, so a kernel level compromise can affect every container on that host. Virtual machines each run their own kernel with separation enforced by the hypervisor, which is a stronger isolation boundary for this specific threat. Option D is the most tempting because reduced image size is a genuine container security advantage and candidates generalize it, but a minimal image reduces the software inventory inside the container without changing the fact that all containers depend on one shared kernel, which is the exact boundary the requirement concerns.

Answer: B
Operational technology commonly cannot be patched on the enterprise cycle because of vendor certification and process continuity constraints, so the recognized approach is to reduce exposure around the device: place it in a tightly restricted zone, permit only explicitly required flows, and monitor it closely. Option A is the tempting answer for candidates who treat patching as an absolute, but in a process control environment an unplanned halt can have safety consequences, and vendor certification loss can leave the utility unable to obtain support at all. Option C is inadequate because accepting risk without compensating controls leaves a known vulnerable system fully exposed.

Answer: D
Secure access service edge converges wide area connectivity with cloud delivered security services, applying identity and context aware policy at distributed points of presence so that branch and remote users receive equivalent enforcement without backhauling. Option C is the strongest distractor because software defined wide area networking is genuinely a component of this design, but on its own it optimizes and orchestrates transport selection; it does not by itself provide the secure web gateway, identity aware policy, and data loss inspection the requirement names. A VPN concentrator at headquarters reintroduces exactly the backhaul the company is eliminating.

Answer: B
Tunnel mode encapsulates the whole original packet, headers included, within a new packet whose outer addresses are the two gateways, which conceals internal addressing and suits gateway to gateway deployment. Option A is the most tempting because transport mode is genuinely used for IPSec and does encrypt the payload, but it preserves the original IP header in the clear, violating requirement one, and it is designed for host to host protection rather than gateway enforcement. Option D fails because Authentication Header provides integrity and authentication but no encryption, so encapsulation without Encapsulating Security Payload leaves the inner packet readable.

Answer: C
Geographic restriction, sometimes implemented as region pinning or geofencing, constrains where data may physically reside and where it may be replicated, which is the direct control for a residency obligation. Encryption is the most tempting distractor because it is the reflexive answer to any data protection requirement and it does protect confidentiality, but an encrypted copy replicated to another region is still stored in that region and still violates the residency constraint. Tokenization and masking alter the values rather than the location and likewise do not satisfy a requirement expressed in terms of physical placement.

Answer: B
A cold site supplies only the physical environment, so it is the cheapest option and carries the longest recovery time because hardware, software, and data must all be brought in and built before use. A warm site is the most tempting distractor because both are cheaper than a hot site and both require work before cutover, but a warm site already contains installed hardware and often periodically refreshed data, needing only current data restoration and start up. The stem states explicitly that no servers, software, or data are present, which excludes warm.

Answer: A
An uninterruptible power supply provides immediate, seamless transfer but has limited runtime, whereas a generator has effectively unlimited runtime but requires time to start and reach stable output. Together they cover both the instantaneous and the sustained requirement. Option D is the most tempting because it also pairs the two devices and sounds like sensible redundancy, but it inverts the sequence: if the battery only engaged after the generator failed to start, the load would already have dropped during the generator's start interval, defeating the requirement for uninterrupted power.

Answer: C
An air gap is physical isolation: no network path exists at all, so data crosses only by deliberate manual transfer, which is why it is reserved for the highest value assets such as offline signing keys. Logical segmentation is the most tempting distractor because it also separates systems and is far more common, but virtual local area networks and access lists still depend on a shared physical network and on the correct configuration of shared devices, so a misconfiguration or switch compromise can bridge the separation. An air gap has no such shared path to misconfigure.

Answer: D
A trade secret derives its value from secrecy itself and is protected by the owner's own confidentiality measures rather than by registration, which is what distinguishes it from other intellectual property. Regulated data is the most tempting distractor because it is also highly sensitive and heavily protected, but regulated data is classified that way because an external law or standard imposes handling requirements on it, such as payment card or health information; the manufacturing process in this scenario carries no such external mandate, and its protection obligation arises purely from the business's own interest in confidentiality.

Answer: A
Determining whether an alert represents a true positive versus benign activity is part of the detection and analysis phase, which occurs before any response action is taken. Eradication removes confirmed malicious artifacts after an incident is validated, lessons learned occurs after the incident closes, and containment limits spread only after malicious activity has been confirmed, all of which come after the triage step described.

Answer: C
Isolating an infected host to stop lateral spread while preserving evidence is the definition of containment. Preparation happens before an incident occurs and involves building capability and plans, post-incident reporting occurs after the incident is resolved, and identification is simply recognizing that an incident occurred, which is distinct from actively isolating the host.

Answer: D
The order of volatility for digital forensics begins with the most transient data (CPU registers/cache), followed by RAM, then local disk storage, and finally offline backups or archival media, which persist the longest. The other options reverse or scramble this sequence, which would risk losing the most fragile evidence before it is captured, violating proper forensic procedure.

Answer: A
Chain of custody is the chronological documentation showing who collected, handled, and analyzed evidence, ensuring its integrity and admissibility. Data minimization limits the amount of personal data collected/retained, a legal hold suspends normal data destruction when litigation is anticipated, and non-repudiation proves the origin of a message rather than tracking evidence handling.

Answer: A
Correlating login timestamps and geolocation across systems to flag physically implausible travel between logins is a classic SIEM use case for impossible travel detection, useful for spotting compromised credentials. DLP inspects data content for policy violations, static application security testing analyzes source code for flaws before runtime, and vulnerability scanning identifies unpatched weaknesses, none of which involve correlating authentication geolocation and timing.

Answer: A
An IPS sits inline with traffic and can actively block or drop packets matching malicious signatures or behavior, unlike a passive IDS which only alerts without intervening. A vulnerability scanner assesses systems for weaknesses rather than inspecting live traffic, and a plain packet sniffer captures traffic for analysis but has no enforcement capability.

Answer: A
NAC solutions perform posture assessment, checking device compliance such as patch level and antivirus status, before granting or restricting network access, exactly matching the scenario. A stateless packet filter only inspects header fields without evaluating device health, a CDN caches and distributes content rather than gating network admission, and a spam filter screens email content and is unrelated to device posture checks.

Answer: A
Risk-based prioritization weighs exploitability, exposure (e.g., internet-facing), and business context alongside a base severity score to decide what to remediate first, rather than relying on severity alone. Alphabetical patching ignores risk entirely, ignoring anything below a fixed CVSS threshold discards context like active exploitation, and waiting for an audit finding is reactive rather than a structured prioritization method.

Answer: A
Audit logs capture who accessed which records and when, and periodic review of those logs allows detection of unauthorized or unnecessary access after the fact. Full-disk encryption protects data at rest from offline theft but doesn't record who viewed live records, rate limiting only throttles authentication attempts, and time synchronization ensures accurate timestamps but by itself does not detect inappropriate access.

Answer: C
A credentialed scan authenticates to the target and enumerates installed packages, patch levels, and local configuration directly, which reveals the host level findings that an unauthenticated scan can only infer from exposed services. Option D is the most tempting because widening the port range genuinely does find more listening services, but it still only observes the host from the outside, so missing local patches and registry settings that expose no network service remain invisible. Changing frequency or scan origin affects timeliness and network reachability, not the depth of inspection.

Answer: B
SAML carries signed authentication assertions and attributes from an identity provider to a service provider, which is the standard pattern for federated browser based single sign-on. OAuth is an authorization framework that issues scoped access tokens so an application can act on a resource on the user's behalf without handling the user's credentials. Option C is the classic trap because it names the correct two standards but assigns each to the other's job. LDAP is a directory access protocol rather than a federation standard, and RADIUS and TACACS plus serve network and device administration authentication.

Answer: A
Attribute based access control evaluates policies over attributes of the subject, the object, the action, and the environment, so conditions such as department, record sensitivity, time, and device posture combine in a single policy without multiplying identities. Option B is the most tempting because adding roles is the natural incremental fix and role based control is far more widely deployed, but that is exactly the role explosion the stem describes as the problem, since each new attribute combination requires another role. Discretionary control puts the decision with individual owners, and mandatory control applies fixed clearance labels that cannot express device or time conditions.

Answer: B
Degaussing works by disrupting a magnetic field and therefore has no effect on solid state media, which store data as electrical charge in flash cells. For a self encrypting drive that must be returned intact, cryptographic erase, which destroys the media encryption key so all remaining ciphertext is unrecoverable, is both effective and non destructive. Option D is the most tempting because it sounds appropriately rigorous and destruction is genuinely the strongest sanitization method, but shredding is incompatible with the stated requirement to return the drives to the lessor. Deleting a partition table removes only the map to the data, leaving the data itself intact.

Answer: D
DMARC builds on the other two mechanisms by publishing the domain owner's policy for handling messages that fail authentication and alignment, such as quarantine or reject, and by requesting aggregate and forensic reports back to the domain owner. Sender Policy Framework is the most tempting distractor because it is the record listing authorized sending servers, but the stem states that record already exists; SPF publishes who may send and produces a pass or fail result without telling the receiver what to do with a failure. DomainKeys Identified Mail supplies the signature, which the stem also states is already in place.

Answer: C
Data loss prevention inspects content in motion, at rest, and in use against classification rules and patterns, and can block or quarantine a transfer that would move regulated data outside policy across email, web, and removable media channels. A security information and event management platform is the most tempting alternative because it also sees a great deal of activity and can alert on it, but it correlates log records after the fact rather than inspecting message content in the transfer path, so it cannot stop the transfer. File integrity monitoring watches for changes to files, not for their egress.

Answer: B
File integrity monitoring records a cryptographic hash of each protected file and alerts when a recomputed hash no longer matches the baseline, which detects modification regardless of whether the replacement is recognized as malicious. Antivirus is the most tempting distractor because it is also a scanning control on the same host, but it detects files that match known malicious patterns; a custom backdoor built for one target will not match a signature, and the stem states the replaced binary continued to function normally. Encryption protects data if the disk is removed and does nothing about authorized changes made on a running system.

Answer: D
A false positive is a reported finding that does not actually exist, which describes the first server where the library and service are absent. A false negative is a real weakness the tool failed to report, which describes the second server that was compromised through an issue reported as clean. Option C is the classic trap because the two terms are easily transposed under time pressure; the reliable check is that the label always describes what the tool said, so a positive report that turns out to be untrue is a false positive, and silence that turns out to conceal a real issue is a false negative. False negatives are the more dangerous of the two because nothing prompts investigation.

Answer: A
When a finding cannot be remediated on the normal cycle, the correct response is a formally approved exception that documents the business justification, records the compensating controls, assigns an owner, and sets a review date so the acceptance does not become permanent by neglect. Option C is the most tempting because both involve a decision not to patch, but avoidance means ceasing the activity that creates the exposure entirely, and the stem states the system keeps running. Option B is wrong and dangerous, because the finding is described as confirmed; closing a real vulnerability as a false positive removes it from tracking without reducing the risk.

Answer: A
Validation closes the loop in vulnerability management: a rescan or equivalent verification confirms that the applied change actually removed the finding, since patches can fail to install, be rolled back, or require a restart that never happened. Option D is the most tempting because prioritization is a genuine and adjacent step in the same lifecycle, but it governs what to work on next rather than proving that completed work succeeded. Option B is incorrect because an exception is used when a finding will not be remediated, which is the opposite of the situation described.

Answer: C
Alert tuning refines a rule so it stops firing on a specifically identified benign condition while preserving detection of the same behavior in every other context, which restores analyst trust without creating a blind spot. Option D is the most tempting because it produces the same immediate relief from noise and analysts are already ignoring the alerts, but disabling the rule removes detection of genuinely malicious instances of that behavior, converting an alert fatigue problem into a coverage gap. Archiving the output has the same effect while hiding it, and retention changes affect storage of records rather than which conditions raise an alert.

Answer: B
Mandatory access control enforces a system wide policy of labels and clearances that individual users, including the owner of an object, cannot override, which is why it is used in classified environments. Discretionary access control is the direct opposite and is the most tempting distractor because it is the familiar model on ordinary file systems, where the owner sets permissions and may grant access to whomever they choose; the stem specifically forbids that, which rules it out. Role based control groups permissions by job function and does not use clearance comparison at all.

Answer: C
Just in time privileged access grants elevation only on an approved request and only for a limited period, after which entitlement is revoked automatically, which shrinks the window in which a compromised account carries administrative power from continuous to minutes. Option A is the most tempting because credential rotation is a real privileged access management practice and does limit the life of a stolen secret, but the engineers still hold standing membership between rotations, so a compromise at any moment still yields immediate administrative rights. Stronger passphrases and stricter policy on the accounts do not change the standing entitlement at all.

Answer: D
Multifactor authentication requires credentials drawn from different categories, namely something you know, something you have, and something you are. A password and a security answer are both knowledge, so presenting them together is multi step single factor authentication regardless of how many items are supplied. Option B is the most tempting because candidates equate more credentials with more factors, but the requirement is about category diversity rather than count; adding a fourth knowledge question would still not satisfy it, while adding one hardware token would.

Answer: A
Access attestation, also called recertification, requires an accountable reviewer to periodically confirm that each user's entitlements still match their current duties, and to revoke what no longer applies, which is the standard defense against privilege creep from internal transfers. Option D is the most tempting because identity proofing is a genuine and important identity lifecycle step, but it verifies who a person is at enrollment and never revisits what they may access afterward, so it cannot detect entitlements accumulated years later. Password rotation and federation change how credentials are managed, not what permissions an identity holds.

Answer: A
De-provisioning must disable authentication at the moment employment ends; data retrieval is accomplished by delegating the mailbox or exporting it administratively, which requires no active user account. Leaving the account enabled preserves exactly the access the termination was meant to remove. Option D is the most tempting because the abuse involved a logon and passwords feel like the relevant control, but the account's password was presumably valid and known to its legitimate owner, so no complexity rule would have prevented that person from using it; the defect is that a valid credential was still accepted after the person's authorization ended.

Answer: C
Content categorization applies a continuously updated vendor classification of sites into categories, so policy is written once against a category rather than against individual domains, and different rules can be bound to different user groups such as students and staff. Option A is the most tempting because address based blocking is a genuine perimeter technique and feels equivalent, but modern sites sit behind shared hosting and content delivery networks, so a single address may serve many unrelated sites, making address blocking both over broad and quickly stale. Rate limiting and certificate pinning address performance and impersonation, not site classification.

Answer: D
A DNS sinkhole intercepts resolution for known malicious domains, returns a controlled address so the malware never reaches its infrastructure, and records the internal client that asked, which simultaneously blocks the channel and identifies infected hosts. Option A is the most tempting because it also stops external resolution, but blanket blocking of outbound resolution breaks name resolution for every legitimate purpose unless internal resolvers are permitted, and it produces a generic denial rather than an attributable record of which host sought which malicious domain. Full packet capture provides evidence but blocks nothing.

Answer: A
Version 3 of the simple network management protocol introduces a user based security model with authentication and privacy, which is the only option that actually satisfies both the authentication and confidentiality requirement in the protocol itself. Option B is the most tempting because a long random community string does raise the guessing bar, but the string is still transmitted in the clear, so anyone able to observe the traffic simply reads it, and the retrieved data remains unencrypted. Option C reduces who can observe the traffic without meeting the stated requirement, and would at best be a compensating control rather than remediation.

Answer: A
A risk appetite or tolerance statement formally documents the level of risk an organization's leadership is willing to accept, guiding decisions about which risks require further mitigation. An incident response playbook details technical response steps, a network diagram documents topology, and a change management ticket records a specific proposed change, none of which capture organizational risk tolerance.

Answer: A
Requiring questionnaires and independent audit evidence (such as a SOC 2 report) before onboarding a vendor is core to third-party/vendor risk management, assessing supply chain risk before granting access or trust. Business continuity planning addresses maintaining operations during disruptions, change management governs internal system modifications, and asset inventory management tracks organizational assets, none of which describe vetting an external vendor's security posture.

Answer: A
Change management formalizes the review, approval, testing, and rollback planning required before implementing changes to reduce the risk of unintended outages or security gaps. Data classification labels information by sensitivity, penetration testing simulates attacks to find weaknesses, and onboarding covers bringing new employees or systems into the organization, none of which describe the structured change-approval workflow described.

Answer: A
Identifying which regional or national laws (such as GDPR for EU residents) govern data handling based on data subject location is a matter of regulatory and jurisdictional compliance. A business impact analysis assesses the operational effect of disruptions, vulnerability scanning cadence concerns technical testing frequency, and awareness training frequency concerns employee education scheduling, none of which relate to determining applicable data protection law.

Answer: D
RTO defines the maximum acceptable duration of downtime after a disruption before unacceptable business impact occurs, directly informing decisions about redundancy and failover investment. MTBF measures average time between failures of a component, ALE estimates yearly expected monetary loss from a risk, and SLE estimates the monetary loss from a single occurrence of a risk event, none of which define an acceptable downtime duration.

Answer: A
Defining data owners, custodians, and classification labels as part of formal policy is data governance, a component of security program management and oversight. Cryptographic key exchange concerns securely establishing shared keys between parties, wireless network configuration concerns radio-based network setup, and malware analysis examines malicious code behavior, none of which involve assigning organizational data roles and classification policy.

Answer: A
Reconciling differing national encryption export laws before deploying a feature across jurisdictions is a legal and regulatory compliance consideration tied to where the company operates. Physical security controls address facility protections, endpoint detection and response concerns host-based threat monitoring, and password complexity policy governs authentication requirements, none of which relate to cross-border legal restrictions on cryptography.

Answer: A
Mean time to repair measures how long restoration takes, so anything that removes delay from the repair process, such as having spares on hand, reduces it directly. Mean time between failures describes the reliability of the hardware itself and is improved by better components or reduced load, not by parts logistics. Option C is the most tempting because a recovery time objective is also a duration and the two are frequently confused, but it is a business target that leadership sets for acceptable downtime, whereas mean time to repair is an observed measurement of actual repair performance; the target does not change simply because spares are stocked.