CompTIA Security+ Practice Test

Answer: C
Isolating an infected host to stop lateral spread while preserving evidence is the definition of containment. Preparation happens before an incident occurs and involves building capability and plans, post-incident reporting occurs after the incident is resolved, and identification is simply recognizing that an incident occurred, which is distinct from actively isolating the host.

Answer: D
The order of volatility for digital forensics begins with the most transient data (CPU registers/cache), followed by RAM, then local disk storage, and finally offline backups or archival media, which persist the longest. The other options reverse or scramble this sequence, which would risk losing the most fragile evidence before it is captured, violating proper forensic procedure.

Answer: A
Audit logs capture who accessed which records and when, and periodic review of those logs allows detection of unauthorized or unnecessary access after the fact. Full-disk encryption protects data at rest from offline theft but doesn't record who viewed live records, rate limiting only throttles authentication attempts, and time synchronization ensures accurate timestamps but by itself does not detect inappropriate access.

Answer: A
Risk-based prioritization weighs exploitability, exposure (e.g., internet-facing), and business context alongside a base severity score to decide what to remediate first, rather than relying on severity alone. Alphabetical patching ignores risk entirely, ignoring anything below a fixed CVSS threshold discards context like active exploitation, and waiting for an audit finding is reactive rather than a structured prioritization method.

Answer: A
NAC solutions perform posture assessment, checking device compliance such as patch level and antivirus status, before granting or restricting network access, exactly matching the scenario. A stateless packet filter only inspects header fields without evaluating device health, a CDN caches and distributes content rather than gating network admission, and a spam filter screens email content and is unrelated to device posture checks.

Answer: A
Determining whether an alert represents a true positive versus benign activity is part of the detection and analysis phase, which occurs before any response action is taken. Eradication removes confirmed malicious artifacts after an incident is validated, lessons learned occurs after the incident closes, and containment limits spread only after malicious activity has been confirmed, all of which come after the triage step described.

Answer: A
An IPS sits inline with traffic and can actively block or drop packets matching malicious signatures or behavior, unlike a passive IDS which only alerts without intervening. A vulnerability scanner assesses systems for weaknesses rather than inspecting live traffic, and a plain packet sniffer captures traffic for analysis but has no enforcement capability.

Answer: A
Correlating login timestamps and geolocation across systems to flag physically implausible travel between logins is a classic SIEM use case for impossible travel detection, useful for spotting compromised credentials. DLP inspects data content for policy violations, static application security testing analyzes source code for flaws before runtime, and vulnerability scanning identifies unpatched weaknesses, none of which involve correlating authentication geolocation and timing.

Answer: A
Chain of custody is the chronological documentation showing who collected, handled, and analyzed evidence, ensuring its integrity and admissibility. Data minimization limits the amount of personal data collected/retained, a legal hold suspends normal data destruction when litigation is anticipated, and non-repudiation proves the origin of a message rather than tracking evidence handling.

Answer: A
A legal hold suspends routine destruction of potentially relevant records once litigation is anticipated, and it overrides the ordinary retention schedule; failing to preserve those records constitutes spoliation and can result in court sanctions and adverse inference. Option D is the most tempting because both concepts concern evidence handling in a legal context, but chain of custody documents who possessed evidence after it was collected, whereas a legal hold governs whether the material continues to exist at all. Option B inverts the direction entirely, since a right to be forgotten request seeks deletion rather than preservation.

Answer: D
Threat hunting is proactive, hypothesis driven searching through existing telemetry for adversary behavior that automated detection has not flagged, and it deliberately begins without an alert or a declared incident. Option A is the most tempting for candidates who associate any deep investigation with incident response, but eradication is a phase that occurs after an incident has been confirmed and its purpose is to remove the adversary's presence, not to determine whether one exists. Vulnerability scanning enumerates weaknesses in systems rather than searching for evidence of an active adversary.

Answer: B
Degaussing works by disrupting a magnetic field and therefore has no effect on solid state media, which store data as electrical charge in flash cells. For a self encrypting drive that must be returned intact, cryptographic erase, which destroys the media encryption key so all remaining ciphertext is unrecoverable, is both effective and non destructive. Option D is the most tempting because it sounds appropriately rigorous and destruction is genuinely the strongest sanitization method, but shredding is incompatible with the stated requirement to return the drives to the lessor. Deleting a partition table removes only the map to the data, leaving the data itself intact.

Answer: C
Just in time privileged access grants elevation only on an approved request and only for a limited period, after which entitlement is revoked automatically, which shrinks the window in which a compromised account carries administrative power from continuous to minutes. Option A is the most tempting because credential rotation is a real privileged access management practice and does limit the life of a stolen secret, but the engineers still hold standing membership between rotations, so a compromise at any moment still yields immediate administrative rights. Stronger passphrases and stricter policy on the accounts do not change the standing entitlement at all.

Answer: D
Multifactor authentication requires credentials drawn from different categories, namely something you know, something you have, and something you are. A password and a security answer are both knowledge, so presenting them together is multi step single factor authentication regardless of how many items are supplied. Option B is the most tempting because candidates equate more credentials with more factors, but the requirement is about category diversity rather than count; adding a fourth knowledge question would still not satisfy it, while adding one hardware token would.

Answer: B
File integrity monitoring records a cryptographic hash of each protected file and alerts when a recomputed hash no longer matches the baseline, which detects modification regardless of whether the replacement is recognized as malicious. Antivirus is the most tempting distractor because it is also a scanning control on the same host, but it detects files that match known malicious patterns; a custom backdoor built for one target will not match a signature, and the stem states the replaced binary continued to function normally. Encryption protects data if the disk is removed and does nothing about authorized changes made on a running system.

Answer: A
Zero trust assumes no implicit trust for any user, device, or service regardless of network location, requiring continuous verification of every request, which matches the gateway enforcing authentication/authorization on every call. An implicit trust model is the opposite, assuming internal traffic is safe; perimeter-only security relies solely on a network edge boundary; and an air-gapped network is physically isolated with no connectivity at all, which does not match a cloud API gateway design.

Answer: A
Tokenization substitutes sensitive data with a non-sensitive token that has no exploitable value outside the secure vault that maps it back to the original, which is exactly the recurring-billing scenario described. Unsalted hashing is not reversible so it cannot be mapped back for legitimate reuse, display-only masking still leaves the real number stored elsewhere, and encrypting the whole database still stores the actual card number, just protected differently, rather than replacing it with a token.

Answer: A
An HSM is a dedicated, tamper-resistant hardware device built to generate, store, and manage cryptographic keys securely, isolating key material from general-purpose servers. A load balancer distributes traffic across servers, a jump server is a hardened intermediary for administrative access, and a proxy server relays and can filter client requests, none of which are purpose-built for cryptographic key custody.

Answer: A
Planning for failover to a secondary site with minimal data loss and downtime is core to resilience and recovery architecture, encompassing high availability, replication, and disaster recovery. Data classification concerns labeling data sensitivity, least privilege concerns access rights scoping, and vulnerability scanning identifies weaknesses rather than ensuring continued operation after an outage.

Answer: A
Segmentation with a controlled boundary isolates sensitive OT/ICS systems from the general corporate network while permitting tightly controlled, monitored data flow across a well-defined chokepoint. A flat network provides no isolation, a full mesh VPN would multiply direct paths between all systems rather than restrict them, and removing firewalls between zones eliminates the very boundary the scenario requires.

Answer: A
Hardening is the process of reducing a system's attack surface by disabling unnecessary services, closing unused ports, and removing default accounts. Fuzzing is a testing technique that feeds malformed input to find bugs, threat hunting is proactively searching for signs of compromise, and steganography hides data within other files, none of which describe reducing exposed attack surface.

Answer: D
Secure access service edge converges wide area connectivity with cloud delivered security services, applying identity and context aware policy at distributed points of presence so that branch and remote users receive equivalent enforcement without backhauling. Option C is the strongest distractor because software defined wide area networking is genuinely a component of this design, but on its own it optimizes and orchestrates transport selection; it does not by itself provide the secure web gateway, identity aware policy, and data loss inspection the requirement names. A VPN concentrator at headquarters reintroduces exactly the backhaul the company is eliminating.

Answer: D
A jump server, also called a bastion host, is a single hardened, monitored system that administrators authenticate to first and from which all administrative connections into a protected zone originate, collapsing the firewall rule set to one permitted source. A reverse proxy is the most tempting distractor because it is also an intermediary that other systems connect through, but a reverse proxy fronts published application services for external clients; it is not an interactive administrative pivot and does not provide the session logging and account controls the scenario requires. A network tap only copies traffic for monitoring and carries no sessions.

Answer: C
An air gap is physical isolation: no network path exists at all, so data crosses only by deliberate manual transfer, which is why it is reserved for the highest value assets such as offline signing keys. Logical segmentation is the most tempting distractor because it also separates systems and is far more common, but virtual local area networks and access lists still depend on a shared physical network and on the correct configuration of shared devices, so a misconfiguration or switch compromise can bridge the separation. An air gap has no such shared path to misconfigure.

Answer: A
Infrastructure as code expresses environment definitions as templates that can be peer reviewed, versioned, scanned before deployment, and applied identically everywhere, which eliminates the configuration drift and repeated misconfiguration described. Software defined networking is the most tempting distractor because it also brings programmability to infrastructure, but it addresses how network forwarding decisions are centralized and abstracted, not how full environment definitions are authored, reviewed, and reproduced. Containerization and serverless change the workload packaging and hosting model without themselves preventing drift in the surrounding configuration.

Answer: A
An uninterruptible power supply provides immediate, seamless transfer but has limited runtime, whereas a generator has effectively unlimited runtime but requires time to start and reach stable output. Together they cover both the instantaneous and the sustained requirement. Option D is the most tempting because it also pairs the two devices and sounds like sensible redundancy, but it inverts the sequence: if the battery only engaged after the generator failed to start, the load would already have dropped during the generator's start interval, defeating the requirement for uninterrupted power.

Answer: A
Containers share the host kernel and are separated by namespaces and control groups, so a kernel level compromise can affect every container on that host. Virtual machines each run their own kernel with separation enforced by the hypervisor, which is a stronger isolation boundary for this specific threat. Option D is the most tempting because reduced image size is a genuine container security advantage and candidates generalize it, but a minimal image reduces the software inventory inside the container without changing the fact that all containers depend on one shared kernel, which is the exact boundary the requirement concerns.

Answer: B
A passive, out of band sensor receives a copy of traffic from a tap or mirror port, so production packets never traverse the sensor and its failure or overload cannot affect the link, at the cost of being able only to detect rather than block. Option C is the most tempting because a hardware bypass module does protect against total device failure, but the sensor is still inline in the packet path during normal operation, which adds latency and gives it the ability to interrupt traffic, both of which the requirements forbid. Option D likewise places the device in the path.

Answer: D
In an infrastructure service the customer is issued a virtual machine and owns everything from the guest operating system upward, including its patching. In a software service the customer receives only the application, so the provider owns the operating system, platform, and application maintenance while the customer retains responsibility for its data, identities, and access configuration. Option B is the most tempting because data ownership does remain with the firm in both models and candidates over extend that principle, but data ownership does not confer operating system access in a software service; the firm has no ability to patch a host it cannot reach.

Answer: B
A cold site supplies only the physical environment, so it is the cheapest option and carries the longest recovery time because hardware, software, and data must all be brought in and built before use. A warm site is the most tempting distractor because both are cheaper than a hot site and both require work before cutover, but a warm site already contains installed hardware and often periodically refreshed data, needing only current data restoration and start up. The stem states explicitly that no servers, software, or data are present, which excludes warm.

Answer: B
Default credentials are published in manuals and scanned for constantly, so internet-reachable devices still using them are effectively open to anyone; setting unique credentials and pulling the devices behind the firewall or onto a segmented network closes the immediate hole. Resolution upgrades change image quality only, accounting schedules have no security effect, and retaining more footage does nothing to stop unauthorized control of the devices.

Answer: A
A zero-day is a vulnerability that is unknown to the vendor or unpatched, meaning defenders have had zero days to prepare a fix. It is not a known-exploited vulnerability unless active exploitation is confirmed, it is not a false positive since the flaw is real, and a compensating control is a mitigation technique, not a category of vulnerability.

Answer: D
Publicly readable storage that should be private is a misconfiguration, the leading cause of cloud data exposure, and continuous automated checks of settings against secure baselines catch such drift before attackers do. No software flaw is involved, so zero-day intelligence does not apply; firmware and boot integrity concern device startup; and injection defenses address application queries rather than storage permissions.

Answer: D
An evil twin is a rogue access point impersonating a legitimate SSID to lure victims into connecting so traffic can be intercepted. Bluejacking targets Bluetooth devices with unsolicited messages, ARP poisoning manipulates layer-2 address tables on an existing network rather than impersonating an SSID, and a deauthentication flood alone only disconnects clients without impersonating the network.

Answer: D
No traveler covers that distance in forty minutes, so the two sessions cannot both be the legitimate user from those locations, making impossible travel a high-value indicator of credential compromise even when the activity within each session looks routine. VPN load does not relocate logins across continents, device enrollment does not explain a foreign source address, and clock drift would distort timestamps uniformly rather than produce two coherent remote sessions.

Answer: A
Privilege escalation is gaining higher-level permissions than originally granted, exactly as described. Lateral movement and pivoting involve moving to other hosts or network segments rather than escalating rights on the same machine, and footprinting is early reconnaissance performed before any access is gained.

Answer: B
Once a product passes end of support, the vendor stops shipping security fixes, so every vulnerability discovered afterward remains permanently exploitable on that system, which is why unsupported platforms demand isolation or other offsetting safeguards. Power draw, licensing fees, and training needs may be real operational concerns, but they are not security consequences of running the platform.

Answer: A
A signed rules-of-engagement agreement defining scope and boundaries is the hallmark of authorized penetration testing, regardless of whether the tester has prior system knowledge (white-box) or not (black-box). An advanced persistent threat is an unauthorized, often nation-state-affiliated long-term intrusion; hacktivism is unauthorized activity motivated by ideology; and insider threat activity originates from a trusted person acting outside authorized bounds.

Answer: A
Isolating the affected system stops the encryption from spreading to other shares and hosts and preserves the state responders need for investigation, making containment the correct first move. Payment is never a first step, funds criminals, and guarantees nothing; renaming files does not decrypt them and destroys evidence; and rebooting can wipe volatile evidence while allowing persistence mechanisms to resume the attack.

Answer: A
Phishing uses a fraudulent message, typically email, that impersonates a trusted entity to trick the victim into entering credentials on a fake site. Pretexting involves a fabricated scenario used in a direct social engineering conversation rather than a spoofed website, tailgating is physically following someone through a secured door, and a watering hole attack compromises a legitimate site the victim is expected to visit rather than sending a direct impersonation email.

Answer: B
Attacker-supplied script that the application saves and later serves to every visitor is stored cross-site scripting, the most damaging XSS variant because one submission compromises all subsequent viewers, and output encoding with a content security policy is the core defense. Object-level authorization flaws expose records through predictable identifiers, an open relay abuses mail forwarding, and a weak key-exchange group is a cryptographic negotiation issue.

Answer: A
Concatenating unvalidated user input directly into a SQL statement lets an attacker alter the query's logic, which is the definition of SQL injection; the fix is parameterized queries or prepared statements. Cross-site scripting injects script into pages viewed by other users, buffer overflow involves writing past allocated memory bounds, and a race condition exploits timing between concurrent operations, none of which describes unsafely built SQL strings.

Answer: B
When no patch exists, virtual patching, meaning an intrusion prevention or web application firewall rule that recognizes and blocks the exploit traffic, reduces exposure immediately without touching the vulnerable code. Backups aid recovery after compromise but prevent nothing, renaming an account does not address a code execution flaw, and waiting for a quarterly cycle ignores confirmed active exploitation of an internet-facing system.

Answer: B
High-volume queries to random-looking subdomains are a classic indicator of DNS tunneling used by malware to exfiltrate data or receive commands from a command-and-control server, since DNS is often allowed outbound even when other channels are restricted. DHCP renewal, software updates, and CDN lookups do not generate high-volume randomized subdomain queries to a single unfamiliar domain.

Answer: B
When a program validates a resource and then uses it as two separate steps, an attacker who changes the resource in between exploits a time-of-check to time-of-use race condition; the fix is making validation and use atomic or operating on file handles rather than paths. Integer overflows corrupt arithmetic rather than timing, request forgery abuses browser sessions, and downgrade attacks weaken protocol negotiation, none of which involve winning a timing gap.

Answer: A
Double extortion combines encryption with data theft and the threat of public leak, adding a second layer of pressure beyond just withholding decryption. Typosquatting involves registering misspelled domain names, credential stuffing reuses breached credentials at scale, and business email compromise is a targeted social-engineering fraud scheme, none of which match the encrypt-plus-leak-threat pattern described.

Answer: C
Removing direct internet exposure so the service is reachable only through an authenticated VPN or gateway, with multifactor authentication in front, eliminates the open target rather than merely inconveniencing attackers. Port changes are trivially defeated by scanners that fingerprint services, a banner has no technical effect on guessing, and a longer idle timeout actually keeps sessions open longer without addressing entry at all.

Answer: D
An allow list permits only enumerated, approved software to execute and blocks everything else by default, so an unknown variant is stopped regardless of whether a signature exists. It is especially well suited to fixed function endpoints whose approved software set rarely changes, as described. Option A is the most tempting because faster updates feel like the direct fix, but signature based detection is inherently reactive and cannot match a variant no vendor has yet analyzed, which is exactly the failure mode stated. Detection in alert only mode does not block execution, and awareness training does not address malware that these fixed function workstations encounter outside of user email behavior.

Answer: A
An attack delivered by voice call is vishing, and the invented help desk scenario is the pretext that makes the request seem legitimate; the real goal is capturing the one-time code to defeat multifactor authentication. Smishing arrives by text message rather than a call, tailgating is following someone through a controlled door, and dumpster diving recovers discarded documents, none of which happen over the phone.

Answer: C
Writing beyond the end of a fixed length buffer overwrites adjacent stack memory, including saved return addresses, which is what allows arbitrary code execution; validating and bounding the length before the copy removes the root cause. Option B is tempting because both are input handling failures and candidates group them together, but a parameterized query defends against an interpreter parsing attacker data as commands, and there is no query or interpreter here. Compiler and platform defenses such as stack canaries, address space layout randomization, and non executable stacks raise the difficulty of exploitation but do not fix the missing length check itself.

Answer: B
Long dwell time, bespoke tooling, patient targeting of intellectual property, and the absence of any financial demand are hallmarks of state-sponsored espionage, which is resourced for stealth rather than quick profit. Unskilled attackers lack custom implants, criminal groups monetize access quickly through ransom or fraud, and hacktivists announce themselves because publicity is the point.

Answer: C
The defect exploited is that a bearer token remains valid regardless of who presents it or from where, so the defense is to shorten the token's usable window and tie it to context such as the originating client, causing a replayed token to fail validation. Multifactor authentication is the most tempting distractor because it is the reflexive answer to account takeover, but it is exercised only when a session is created; the attacker here never authenticates at all and instead inherits a session the legitimate user already established after completing every factor. Lockout thresholds and password hashing are likewise never reached, because no password is guessed, submitted, or cracked.

Answer: D
Seeding tempting removable media and relying on human curiosity to get it connected is a baiting attack through the removable device vector, and the enticing payroll label is the lure. Deauthentication targets wireless sessions, on-path attacks intercept traffic between two parties already communicating, and server-side request forgery abuses a web application into making internal requests; none involve planted hardware.

Answer: D
Typosquatting registers a domain that is a plausible misspelling of a legitimate one and relies on user typing errors to deliver visitors to attacker infrastructure. DNS poisoning is the strongest distractor because its effect on the victim looks similar, sending users to a hostile site, but poisoning corrupts resolution for the correct domain name; here the retailer's real domain still resolves correctly and a separate lookalike domain was registered. Domain hijacking would mean the attacker seized control of the retailer's actual domain registration, which the stem does not describe.

Answer: C
Cross-site request forgery abuses the browser's habit of sending session cookies with every request to a site, letting a third-party page perform state-changing actions as the victim; anti-forgery tokens and SameSite cookie attributes are the standard defenses. Reflected XSS requires injected script echoing back from the target site, DLL injection is a local process manipulation technique, and credential stuffing replays breached passwords at login pages.

Answer: C
Bloatware is unnecessary preinstalled software shipped by a manufacturer that provides no value to the organization while consuming resources and adding unpatched, unsupported code to the attack surface, which is why removing it is part of a standard imaging and hardening baseline. Spyware is the tempting distractor because both are unwanted and both may be removed by the same tooling, but spyware is defined by covertly collecting and transmitting information about the user; the stem states explicitly that the software is not malicious. Ransomware encrypts data for extortion, which is not described.

Answer: C
Compromising a third-party site that the intended victims habitually visit, then serving malware to them there, is a watering hole attack, useful when the target's own perimeter is too hard to breach directly. Password spraying guesses common passwords across many accounts, domain hijacking steals control of a victim's own domain registration, and bluejacking pushes unsolicited Bluetooth messages, none of which involve poisoning a frequented site.

Answer: B
Virtual machine escape is the breach of the isolation boundary a hypervisor is supposed to enforce, letting guest code execute at the hypervisor layer and reach other guests, which is the most severe class of virtualization vulnerability. Resource reuse is the closest distractor because it also results in one tenant obtaining another tenant's data, but it does so passively through recycled memory or storage that was not sanitized before reallocation, with no compromise of the hypervisor. VM sprawl is an operational management problem that increases attack surface but does not itself cross the isolation boundary.

Answer: B
Bug bounty programs invite a standing crowd of external researchers to probe defined scope continuously, compensating validated findings by severity, which yields diverse techniques and year-round coverage a scheduled engagement cannot match. An annual test provides a snapshot from one team, internal audit rotations examine processes and controls rather than hunting vulnerabilities, and vendor questionnaires assess third parties instead of the platform itself.

Answer: A
Reconciling differing national encryption export laws before deploying a feature across jurisdictions is a legal and regulatory compliance consideration tied to where the company operates. Physical security controls address facility protections, endpoint detection and response concerns host-based threat monitoring, and password complexity policy governs authentication requirements, none of which relate to cross-border legal restrictions on cryptography.

Answer: B
The recovery point objective caps acceptable data loss at one hour, but nightly backups mean a failure just before midnight loses nearly twenty-four hours of orders, a massive gap between commitment and capability closed only by continuous replication, journaling, or hourly-or-better backups. Reducing frequency widens the gap, databases certainly can lose committed data in a disaster, and schedules must be derived from objectives rather than assumed adequate.

Answer: A
Change management formalizes the review, approval, testing, and rollback planning required before implementing changes to reduce the risk of unintended outages or security gaps. Data classification labels information by sensitivity, penetration testing simulates attacks to find weaknesses, and onboarding covers bringing new employees or systems into the organization, none of which describe the structured change-approval workflow described.

Answer: A
A service level agreement defines measurable performance commitments such as uptime percentages and response times, together with remedies like service credits when the provider misses them. A non-disclosure agreement protects confidential information, a memorandum of understanding records a non-binding statement of intent between parties, and a business partners agreement structures a commercial relationship rather than measurable service targets.

Answer: A
A risk appetite or tolerance statement formally documents the level of risk an organization's leadership is willing to accept, guiding decisions about which risks require further mitigation. An incident response playbook details technical response steps, a network diagram documents topology, and a change management ticket records a specific proposed change, none of which capture organizational risk tolerance.

Answer: B
Data minimization means collecting only the personal data necessary for the stated purpose, and declining fields with no delivery function is that principle in action; whatever is never collected can never be breached, misused, or subpoenaed. Sovereignty concerns which jurisdiction's laws govern stored data, forward secrecy is a cryptographic property of session keys, and availability targeting is not a privacy principle at all.

Answer: A
Identifying which regional or national laws (such as GDPR for EU residents) govern data handling based on data subject location is a matter of regulatory and jurisdictional compliance. A business impact analysis assesses the operational effect of disruptions, vulnerability scanning cadence concerns technical testing frequency, and awareness training frequency concerns employee education scheduling, none of which relate to determining applicable data protection law.

Answer: A
Procedures are the step-by-step instructions for completing a task, which is exactly what an ordered build walkthrough provides. A policy states management's high-level intent and rules, a standard specifies mandatory uniform requirements such as which baseline to meet, and a guideline offers recommended but non-mandatory advice, so none of those capture a numbered sequence of build steps.

Answer: D
RTO defines the maximum acceptable duration of downtime after a disruption before unacceptable business impact occurs, directly informing decisions about redundancy and failover investment. MTBF measures average time between failures of a component, ALE estimates yearly expected monetary loss from a risk, and SLE estimates the monetary loss from a single occurrence of a risk event, none of which define an acceptable downtime duration.

Answer: B
Insurance shifts the financial consequences of a risk event to another party for a premium, which is the definition of risk transference, though the operational disruption itself still lands on the insured. Avoidance would mean eliminating the risky activity, mitigation means applying controls to reduce likelihood or impact, and an exemption is a documented policy carve-out rather than a treatment that moves financial burden.

Answer: A
Defining data owners, custodians, and classification labels as part of formal policy is data governance, a component of security program management and oversight. Cryptographic key exchange concerns securely establishing shared keys between parties, wireless network configuration concerns radio-based network setup, and malware analysis examines malicious code behavior, none of which involve assigning organizational data roles and classification policy.

Answer: D
Risk does not stop at the contracted third party: subcontractors the vendor engages, often invisibly, handle the same sensitive data with unknown controls, which is fourth-party risk, managed through disclosure obligations, flow-down security requirements, and subcontractor approval rights. Typosquatting is a domain impersonation attack, a zero-day is a software flaw rather than a relationship risk, and the mailroom scenario involves the insurer's own staff.

Answer: A
Requiring questionnaires and independent audit evidence (such as a SOC 2 report) before onboarding a vendor is core to third-party/vendor risk management, assessing supply chain risk before granting access or trust. Business continuity planning addresses maintaining operations during disruptions, change management governs internal system modifications, and asset inventory management tracks organizational assets, none of which describe vetting an external vendor's security posture.

Answer: B
Insider threat programs depend on the workforce noticing behavioral precursors, such as unexplained data gathering, control evasion, and expressed grievances, and reporting them through safe channels early enough for intervention. Ransomware speed and volumetric floods are technical phenomena that awareness of colleagues' behavior cannot influence, and certificate expiration is an operational hygiene issue unrelated to personnel indicators.

Answer: C
The right to be forgotten, or right to erasure, entitles a data subject to have their personal data deleted where no overriding legal basis for retention exists, and honoring it in practice depends on a complete and current data inventory, since data the company cannot find is data it cannot delete. Option A is the most tempting because minimization is a closely related privacy principle that also reduces stored data, but it constrains what is collected and retained as a matter of policy and creates no obligation triggered by an individual's request. Data sovereignty concerns geographic location rather than deletion.

Answer: A
Audit independence requires that examiners not answer to the management whose work they assess, and a direct line to the audit committee ensures uncomfortable findings reach governance unfiltered. The reporting line increases rather than removes documentation discipline, no structure guarantees clean results, and accountability for operating controls stays with management; the board oversees rather than absorbs it.

Answer: D
A service level agreement defines measurable performance commitments such as availability and response times, together with the remedies or credits owed when they are not met. A master service agreement is the most tempting alternative because it is also a formal commercial contract that governs the same vendor relationship, but it establishes the overarching legal terms, liability, and payment framework under which individual engagements operate; the specific measurable performance thresholds and their penalties live in the service level agreement rather than in the master terms. A non-disclosure agreement concerns confidentiality only.

Answer: A
Rules of engagement govern an authorized offensive engagement: scope boundaries, permitted and prohibited techniques, timing, escalation contacts, and evidence handling, protecting both the testers legally and the business operationally. The acceptable use policy binds employees generally rather than a testing engagement, a certificate signing request belongs to PKI issuance, and disaster recovery runbooks script restoration, not testing conduct.

Answer: C
A right-to-audit clause is the contractual provision that grants the customer authority to examine the vendor's controls, records, and facilities during the term, which is the only mechanism that converts an expectation of transparency into an enforceable entitlement. A non-disclosure agreement is the most tempting distractor because it also concerns access to the vendor's sensitive documentation, but it restricts what may be disclosed about information already shared; it grants no right to obtain anything. A service level agreement governs performance thresholds and remedies, not inspection rights.

Answer: D
Gathering intelligence exclusively from public sources, without touching the target's systems, is passive reconnaissance, which builds an attack picture while generating no detectable traffic. Active scanning probes targets directly and is inherently observable, privilege escalation happens after a foothold is gained, and exfiltration staging occurs deep in an operation, long after this pre-contact research phase.

Answer: C
Qualitative analysis ranks risks on descriptive scales using expert judgment and is the appropriate method when reliable frequency and loss data are unavailable, provided the report states that the output is a relative ordering influenced by participant subjectivity. Options A and B are tempting because monetary outputs appear more rigorous to executives, but running quantitative formulas over invented inputs produces figures whose apparent precision is unfounded and which are more likely to mislead a decision maker than a clearly labeled ranking. Option D is unacceptable because deferring the assessment leaves leadership with no risk information at all during the intervening months.

Answer: A
Point-in-time questionnaires age immediately, so mature programs layer continuous signals: mandatory breach notification clauses, external security rating services, and periodic evidence refreshes tuned to vendor criticality, ensuring material changes surface within days rather than at renewal. Lengthening the interval widens the blind window, abandoning assessment removes oversight entirely, and geographic proximity has no bearing on security posture.

Answer: D
Click rate measures only failure. In a real campaign the decisive variable is how quickly someone alerts the security team, because the first report lets responders pull the message from other mailboxes, block the sender and destination, and hunt for compromised accounts before the campaign spreads. Option A is the most tempting because completion statistics are easy to gather and are commonly reported to leadership, but completing a module records attendance rather than behavior and does not indicate whether an employee would recognize or report a live lure. Option C describes an unrealistic behavior that would prevent employees from doing their jobs.

Answer: D
Residual risk is what remains after controls are applied, and it is the quantity leadership must formally accept or treat further. Inherent risk is the exposure that existed before any controls, transferred risk describes consequences shifted contractually to another party, and emergent risk is a general term for newly arising threats rather than the post-control remainder the question describes.

Answer: A
Passive reconnaissance collects information from third party and public sources without touching the target, so it generates no traffic for the target's monitoring to record and cannot alert defenders. Option C is the most tempting because the information genuinely describes live production systems and candidates classify by what is learned rather than by how, but the active and passive distinction turns entirely on whether the tester interacts with the target; port scanning and service enumeration are active precisely because they generate observable traffic. Exploitation and lateral movement occur after access is obtained.

Answer: B
Contemporary identity guidance found that mandatory periodic resets push users toward incremental, predictable variations, while length and screening against known-breached values deliver real resistance to guessing and stuffing attacks, reserving resets for actual compromise. Strong passwords complement rather than replace multifactor authentication, passphrases are longer rather than shorter, and credential sharing remains prohibited under any policy.

Answer: D
Due diligence is the investigative work of researching and verifying before a decision is made, such as assessing a supplier's controls prior to award. Due care is the ongoing exercise of reasonable prudence in operating and maintaining protections once the relationship exists. Option B is the standard trap because it names the correct pair and reverses them; a durable mnemonic is that diligence is the homework done first and care is the conduct sustained afterward. Attestation and acknowledgement are compliance mechanisms in which parties formally certify or confirm a state, not the standards of conduct the regulator is assessing.

Answer: B
Non-repudiation combines integrity and authentication (typically via digital signatures) so the sender cannot deny having sent the message. Confidentiality only protects against disclosure, availability ensures access to systems/data, and obfuscation merely hides data's meaning without providing proof of origin or authorship.

Answer: A
Separation of duties splits critical tasks between multiple people to prevent a single person from committing fraud unilaterally. Job rotation and mandatory vacation are detective controls that expose fraud over time by moving people between roles or forcing absence, and least privilege limits the access a single account has rather than dividing a process across roles.

Answer: C
Defense in depth layers multiple independent controls so that failure of one does not expose the whole environment. Security through obscurity relies on secrecy rather than layered controls, least functionality is about disabling unneeded services/ports, and fail-open design intentionally permits access on failure, which is the opposite of this scenario.

Answer: B
Key stretching intentionally makes password hashing expensive so that an attacker who steals the password store must spend far more time per candidate guess, cutting offline cracking throughput by orders of magnitude. Option A is the most tempting distractor because it describes a real and valuable property of the scheme described, but that property is delivered by the unique random value, the salt, and not by the iteration count; salting defeats precomputed tables and stops identical passwords from sharing a digest, while iteration count is what raises the per guess cost. Options C and D misstate hashing entirely: hashing is one way, so the plaintext cannot be recovered or decrypted, which is the point of storing a digest rather than the password.

Answer: B
Steganography conceals data inside another file, commonly an image or audio file, so that the carrier appears entirely normal and the existence of the hidden message is not apparent. That is exactly what the slightly oversized photographs with embedded design data describe. Data masking is the most tempting wrong answer because it is also an obfuscation technique, but masking replaces sensitive values with fictitious ones so the data can be used safely in a lower trust environment; it hides the value, not the existence of a second payload. Salting adds random input to a hash and does not conceal anything inside a file.

Answer: C
A gap analysis compares a desired or required control state against the current state and enumerates the differences so remediation can be prioritized, which is exactly the described sequence. A business impact analysis is the most tempting alternative because it also produces a prioritized output, but its subject is the operational and financial consequence of losing a process, expressed through metrics such as recovery objectives, not the presence or absence of framework controls. A quantitative risk assessment assigns monetary loss values to risks and likewise does not inventory control coverage.

Answer: D
Directive controls guide or mandate behavior through policy, standards, and procedures; enforcement depends on personnel compliance rather than on a technical mechanism. A written standard on credential handling is directive. Preventive is the most tempting answer because the intent of the standard is to prevent hardcoded secrets, but intent does not determine the control type. A preventive control would be a pre-commit hook or repository scanner that actually blocks the commit. The stem states the standard relies on people and later audits, which is precisely the distinction between directing behavior and preventing it.

Answer: D
Key escrow stores a copy of the encryption or recovery key with a trusted third party or internal custodian so the organization retains lawful access to its own data when the primary key holder is unavailable. A trusted platform module is the most tempting distractor because TPMs are genuinely part of most full disk encryption deployments, but a TPM seals the key to that specific machine and to its boot state, which makes recovery harder rather than easier when the user cannot authenticate. Longer keys and forward secrecy improve cryptographic strength but do nothing to restore organizational access.

Answer: A
OCSP lets a client ask the certificate authority for the real time status of a single certificate, returning good, revoked, or unknown, which avoids the bandwidth and staleness problems of a bulk list. A certificate revocation list is the strongest distractor because it also answers the revocation question, but a CRL is exactly the large periodically published list the stem rules out; between publication intervals it can be stale. A certificate signing request is what an applicant submits to obtain a certificate and has nothing to do with revocation status.

Answer: A
A deterrent control discourages a threat actor from attempting an action by raising the perceived cost or likelihood of being caught, without physically blocking the action. Signage warning of surveillance and prosecution is the classic example. Preventive is the tempting wrong choice because signage is placed at the perimeter alongside preventive measures such as fences, but a preventive control physically or logically stops the act from occurring; a sign cannot stop anyone who chooses to ignore it, which the stem states explicitly. Detective would describe the cameras themselves, not the notice about them.

Answer: D
Perfect forward secrecy uses ephemeral key exchange so that each session's symmetric key is derived from short lived values that are discarded afterward and never recoverable from the long term certificate key. Compromising the server key later therefore does not unlock previously captured sessions. Option B is the most tempting choice because a longer key does make direct factoring harder, but it does nothing about the stated threat: if the long term key is eventually compromised by any means, every session that used it for key transport can still be decrypted regardless of its length. Pinning and mutual TLS address impersonation and authentication, not retrospective decryption.

Answer: B
A digital signature is produced by encrypting a hash of the content with the signer's private key, and anyone holding the signer's public key can verify it, which proves both integrity and origin. Option C is the classic trap because it names the right two keys but reverses their roles; signing with a public key would let anyone forge a signature, since public keys are by definition distributed openly. Option D fails because a symmetric key shipped with the installer would be available to any attacker who downloads it, so it could not prove origin and would provide no non repudiation.

Answer: C
A wildcard certificate is issued for a name such as an asterisk followed by the domain, so it validates any single level subdomain of that domain and can be deployed across many hosts under one issuance and renewal cycle. A self signed certificate is the most tempting alternative because it is free and easy to issue internally, but it still has to be created and distributed per host and, more importantly, is not chained to a trusted authority, so clients raise warnings unless the certificate is manually trusted everywhere. An extended validation certificate changes the identity vetting level, not the number of hostnames covered.

Answer: C
A compensating control is deployed when the primary or required control cannot be implemented on a system; it provides a comparable level of protection by other means. Here MFA is the required control, the legacy controller cannot support it, and network restriction plus a monitored jump host substitutes for it. Detective is the most tempting distractor because the scenario does mention enhanced session logging, but logging is only one part of the response and it merely records events after they occur. The classification question asks about the VLAN and jump host restriction, which actively prevents unauthorized reachability rather than discovering misuse afterward, so detective does not describe the control being asked about.