CompTIA Security+ 701 Practice Test 2
These flashcards cover fundamental security principles and controls, including the CIA triad (Confidentiality, Integrity, Availability), types of controls like managerial, operational, and deterrent controls, and their application in maintaining secure systems and practices.
Which of the following is a primary goal of the CIA triad?
A. Integrity
B. Non-repudiation
C. Authentication
D. Authorization
Integrity
A component of the CIA triad, which stands for Confidentiality, Integrity, and Availability.
Key Terms
Which of the following is a primary goal of the CIA triad?
A. Integrity
B. Non-repudiation
C. Authentication
D. Authorization
Integrity
A component of the CIA triad, which stands for Confidentiality, Integrity, and Availability.
What is the main purpose of managerial controls?
A. To detect anomalies or intrusions
B. To mandate specific actions or processes
C. To physically secure assets
D. To establish policies and procedures
To establish policies and procedures
Managerial controls establish policies, procedures, and governance.
Which of the following is an example of an operational control?
A. Incident response plan
B. Security policy
C. Access badge
D. Firewall
Incident response plan
An operational control as it involves day-to-day security operations.
Which type of control is primarily focused on discouraging potential attacks?
A. Corrective
B. Deterrent
C. Detective
D. Directive
Deterrent
Deterrent controls focus on discouraging potential attacks.
What type of security control is a biometric authentication system?
A. Physical
B. Managerial
C. Technical
D. Operational
Technical
As it involves hardware or software.
Which of the following is NOT a component of the Zero Trust model?
A. Policy Enforcement Point
B. Policy Engine
C. Policy Administrator
D. Policy Execution Point
Policy Execution Point
Not a component of the Zero Trust model.
Related Flashcard Decks
Study Tips
- Press F to enter focus mode for distraction-free studying
- Review cards regularly to improve retention
- Try to recall the answer before flipping the card
- Share this deck with friends to study together
| Term | Definition |
|---|---|
Which of the following is a primary goal of the CIA triad? A. Integrity | Integrity A component of the CIA triad, which stands for Confidentiality, Integrity, and Availability. |
What is the main purpose of managerial controls? A. To detect anomalies or intrusions | To establish policies and procedures Managerial controls establish policies, procedures, and governance. |
Which of the following is an example of an operational control? A. Incident response plan | Incident response plan An operational control as it involves day-to-day security operations. |
Which type of control is primarily focused on discouraging potential attacks? A. Corrective | Deterrent Deterrent controls focus on discouraging potential attacks. |
What type of security control is a biometric authentication system? A. Physical | Technical As it involves hardware or software. |
Which of the following is NOT a component of the Zero Trust model? A. Policy Enforcement Point | Policy Execution Point Not a component of the Zero Trust model. |
What is the primary purpose of key stretching? A. To revoke digital certificates. | To increase the computational effort required to brute force a password. Key stretching is a technique used to make brute force attacks more computationally intensive and time-consuming by repeatedly hashing a password. |
What is the primary purpose of a backout plan in the change management process? A. To schedule a specific time frame for performing maintenance or changes to the IT systems. | To define the steps to revert to the original state if the change is unsuccessful. A backout plan is a plan that defines the steps to revert to the original state if the change is unsuccessful or causes unforeseen problems. |
What is the primary purpose of salting in cryptographic solutions? A. To verify the integrity and authenticity of a digital message or document. | To add randomness to a password before hashing it. Salting is the process of adding random data, called a salt, to a password before hashing it. This ensures that the same password will produce different hash values, making it more resistant to rainbow table attacks. |
What is the primary purpose of a certificate revocation list (CRL)? A. To securely generate, store, and manage cryptographic keys. | To list digital certificates that have been revoked by the certificate authority. A certificate revocation list (CRL) is a list of digital certificates that have been revoked by the certificate authority (CA) and are no longer valid. |
Which of the following is a form of obfuscation? A. Data masking | Data masking A form of obfuscation where sensitive data is replaced with fictitious or non-sensitive data. |
Which of the following best describes the motivations of a threat actor involved in data exfiltration? A. Espionage | Espionage Involves collecting, processing, and analyzing information that is of strategic or tactical value, which includes data exfiltration. |
An attacker tricks a user into visiting a malicious website that appears to be identical to a legitimate site. Once on the site, the user unknowingly enters their login credentials, which the attacker captures. This type of attack is known as: A. Watering hole | Phishing Involves tricking a target into revealing sensitive information, often by creating fake websites that appear to be legitimate. |
Which of the following best describes the attributes of an internal threat actor? A. Level of sophistication/capability | Insider threat This directly refers to an internal threat actor as it’s someone within the organization. |
Which of the following motivations is most commonly associated with shadow IT activities? A. Disruption/chaos | Disruption/chaos Shadow IT involves using unauthorized devices or software within an organization, which can lead to disruption or chaos due to lack of control and potential security risks. |
An attacker registers a domain that is a common misspelling of a legitimate domain. The attacker sets up a website on the malicious domain that appears to be identical to the legitimate site to deceive users into entering their login credentials. This type of attack is known as: A. Phishing | Typosquatting Specifically involves registering domains that are similar to legitimate ones to deceive users, which matches the scenario described. |
Which cryptographic solution ensures data remains unreadable if intercepted during transmission between two parties? A. Digital signatures | Transport/communication encryption Ensures data confidentiality during transmission. |
Which of the following vulnerabilities is specific to cloud infrastructure? A. Side loading | Cloud-specific Pertains specifically to cloud infrastructures. |
An attacker who gains access by leveraging a gap between when a vulnerability is found and when it’s fixed is exploiting: A. Zero-day | Zero-day A vulnerability that is known but not yet fixed, giving attackers this window to exploit. |
Malware designed to spread without user intervention and replicate itself is called: A. Ransomware | Worm Designed to spread and replicate without user intervention. |
In the context of Public Key Infrastructure (PKI), what is the main function of a Certificate Authority (CA)? A. Issuing and verifying digital certificates | Issuing and verifying digital certificates Certificate Authorities (CAs) are responsible for issuing digital certificates and validating the entities’ identities. |
What is the primary goal of a Distributed Denial-of-Service (DDoS) attack? A. To guess user passwords | To overwhelm resources and disrupt service availability DDoS attacks flood resources to disrupt services and make them unavailable. |
In the context of vulnerabilities, what does “Time-of-use (TOU)” refer to? A. The time an application is most actively used by employees. | The moment a resource is accessed in a race condition. Time-of-use (TOU) is about accessing the resource, especially when discussing race conditions. |
An administrator notices a sudden spike in system resource consumption, especially bandwidth, with no obvious reason. What might this indicate? A. A scheduled backup process | An ongoing Distributed Denial-of-Service (DDoS) attack Sudden and unexplained spikes in resource consumption, especially bandwidth, may indicate a DDoS attack. |
A security consultant recommends restricting software that can run on systems to a known list of accepted programs. This is an example of: A. Application allow list | Application allow list Specifies approved applications that can run on systems. |
Which of the following is NOT a mitigation technique used to secure an enterprise? A. Least privilege | Side loading Related to mobile devices, not a mitigation technique. |
What distinguishes a serverless architecture? A. Offloading server management tasks to cloud providers and only focusing on application code. | Offloading server management tasks to cloud providers and only focusing on application code. Serverless architectures allow developers to focus on code, while the cloud provider manages server provisioning and scaling. |
When designing a cloud infrastructure, which of the following best describes “Infrastructure as Code” (IaC)? A. Applying real-time patches to cloud servers. | Managing and provisioning computing resources using machine-readable definition files. Infrastructure as Code (IaC) allows for automatic setup, modification, and management of infrastructure using code. |
A type of malware that holds user data hostage by encrypting it and demanding payment for the decryption key is known as: A. Worm | Ransomware Encrypts data and demands payment for decryption. |
Which of the following best defines software-defined networking (SDN)? A. It is a protocol used for web traffic encryption. | A networking approach where network control is decoupled from forwarding hardware and is given to a software application. SDN allows dynamic, programmatically efficient network configuration. |
For an organization that needs to manage its own hardware and have complete control over its data, which architecture is most appropriate? A. Microservices | On-premises Solutions that give organizations complete control over their hardware and data. |
A security engineer is trying to ensure a particular service is only active when needed and not continuously running. Which principle is he emphasizing? A. Responsiveness | Cost-effectiveness By ensuring services only run when needed, the engineer can reduce unnecessary costs. |
In securing an enterprise infrastructure, why is the concept of “Attack surface” critical? A. It relates to the physical placement of network devices. | It represents all the potential vulnerabilities and entry points an attacker could exploit. Minimizing the attack surface helps to reduce the potential risks and vulnerabilities. |
Which of the following firewall types focuses specifically on the security of web applications by inspecting HTTP traffic? A. Layer 4 firewall | Web application firewall (WAF) Specifically designed to inspect web traffic and protect web applications. |
What primary security benefit does an Extensible Authentication Protocol (EAP) provide? A. It actively blocks malicious web traffic. | It offers a framework for secure authentication on wireless networks and Point-to-Point connections. Extensible Authentication Protocol (EAP) provides support for multiple authentication mechanisms and is widely used in wireless networks. |
A company needs a solution to ensure its remote workers can securely access the corporate network. Which of the following is best suited for this purpose? A. Load balancer | Virtual private network (VPN) Allow remote workers to securely connect to corporate networks over the internet. |
In the event of a network device failure, which mode ensures that no traffic is allowed through the device? A. Inline | Fail-closed The device will stop all traffic when it fails to ensure security. |
In a cloud environment, which practice ensures that only necessary services are running, limiting the potential attack surface? A. Using heat maps for deployment. | Establishing a secure baseline. Defines a standard for a secure state of systems and ensures only necessary services run. |
Which wireless security protocol provides the strongest encryption and security capabilities as of the most recent standards? A. WPA. | WPA3. The latest and most secure version of the Wi-Fi Protected Access protocol. |
Why might an organization opt for a Corporate-owned, personally enabled (COPE) model for mobile devices? A. To maintain tighter control over device security while allowing personal use. | To maintain tighter control over device security while allowing personal use. COPE devices are company-owned but can still be used for personal tasks. |
If a company needs to ensure that old hard drives are entirely unreadable, which process would be the most thorough? A. Physical destruction. | Physical destruction. Physically damaging the drive makes it virtually impossible to recover data. |
Which process in software development aims to identify potential security flaws by examining the application’s code without executing it? A. Static code analysis. | Static code analysis. Examining the source code without running the application. |
In vulnerability management, which component would provide real-time updates on emerging threats and vulnerabilities? A. Static code analysis. | Threat feed. Provides continuous data streams about new and emerging threats and vulnerabilities. |
How does the Common Vulnerability Scoring System (CVSS) assist organizations in vulnerability management? A. It lists all software without vulnerabilities. | It offers a standardized method for rating the severity of vulnerabilities. CVSS provides a framework for assessing vulnerability impact. |
An organization that cannot immediately address a vulnerability due to operational requirements might issue a formal document to allow its temporary existence. What is this document called? A. Exception. | Exception. A formal allowance for non-compliance or deviation from expected security controls. |
What is the primary goal of a Responsible Disclosure Program? A. To rank companies based on their security posture. | To provide a structured process for reporting vulnerabilities to organizations. Encourages ethical behavior in reporting and allows organizations to address them securely. |
In order to enhance web security, a company wants to filter web traffic based on website reputation. Which tool or feature should they employ? A. Email security gateway | Web filter reputation Categorizes and filters web traffic based on the reputation of websites. |
Given an application that regularly experiences performance degradation, which tool would be best suited to gather long-term performance data for analysis? A. Simple Network Management Protocol (SNMP) traps | Simple Network Management Protocol (SNMP) traps Can provide alerts and gather data about performance and other system metrics. |
When an organization allows employees to access corporate resources using their personal devices, which tool would be crucial to ensuring security and policy compliance for these devices? A. Group Policy | Network access control (NAC) Determines which devices can connect to the network based on compliance with security policies. |
In a scenario where you need to enforce security settings across multiple Windows machines in an enterprise, which tool would be most appropriate? A. NAC | Group Policy Allows administrators to implement specific configurations for users and computers within an Active Directory environment. |
Which of the following ensures that the sender of an email has permission to send emails on behalf of a domain and reduces the chance of spoofing? A. Endpoint detection and response (EDR) | Sender Policy Framework (SPF) Verifies if the mail server sending the email is authorized to send emails for the domain. |
A user has been given temporary elevated access to a database for a specific task. Which concept best describes this kind of permission granting? A. Role-based access control | Just-in-time permissions Involves providing elevated permissions temporarily. |
Which of the following is NOT a type of access control? A. Rule-based access control | Traffic-based access control No common access control type with this name. |
For which of the following reasons might an organization use a password vault? A. To securely store multiple passwords | To securely store multiple passwords Designed to keep various passwords in an encrypted format. |
An organization wishes to enable single sign-on (SSO) capabilities to streamline access to multiple applications. Which protocol is commonly associated with this functionality? A. Security Assertions Markup Language (SAML) | Security Assertions Markup Language (SAML) Provides a standard for exchanging authentication and authorization data between parties and is commonly used for SSO. |
Which of the following accurately describes the “Something you are” factor in multifactor authentication? A. A security key | A fingerprint or retina scan You are your fingerprint/retinal pattern. |
When implementing multifactor authentication, what describes the “Something you have” factor? A. Security key | Security key A physical item or device a user possesses, relating to the “Something you have” factor. |
When considering automation in security operations, which term refers to automatically granting a new user the appropriate access rights and resources? A. Ticket creation | User provisioning Refers to the creation and management of user accounts and access rights within systems. |
In the incident response process, what is the primary objective during the “containment” phase? A. Gathering digital evidence for legal actions | Preventing the incident from causing further damage The containment phase aims to limit the spread of an incident. |
When considering the benefits of automation in security operations, which advantage focuses on the ability of automation to replicate the workload of many employees with fewer resources? A. Workforce multiplier | Workforce multiplier Signifies achieving more with fewer resources due to automation. |
Which of the following log types would provide the most direct insights into a suspicious application’s behavior on a specific host? A. Application logs | Application logs Provide detailed information about specific application behaviors and activities. |
During a digital forensic investigation, ensuring that digital evidence remains intact and unchanged during collection is known as maintaining what? A. Chain of custody | Chain of custody Ensures that evidence remains untouched and is transferred and stored correctly. |
What aspect of automation can potentially introduce new challenges or issues if not managed properly? A. Enforcing baselines | Complexity Over-automation or poorly planned automation can introduce unnecessary complexities. |
An organization is trying to understand the vulnerabilities present in their network. Which of the following data sources would be most appropriate for this purpose? A. OS-specific security logs | Vulnerability scans Specifically identify and report potential vulnerabilities within a network. |
In the context of governance structures, which of the following is responsible for ensuring the integrity, reliability, and accuracy of data within an organization? A. Owner | Custodian/steward Responsible for the day-to-day management and protection of data. |
Which part of the incident response process involves a systematic process to identify and address the underlying cause of an incident? A. Eradication | Eradication Removing the root cause of the incident. |
Which document would an organization use to establish guidelines for acceptable behavior by users of the company’s IT resources? A. Acceptable use policy (AUP) | Acceptable use policy (AUP) Establishes what behaviors are acceptable when using the company’s IT resources. |
When conducting a risk assessment, which method focuses on the potential financial losses associated with risks? A. Qualitative | Quantitative Evaluates risks based on numerical values, often representing financial figures. |
Which risk management strategy is implemented when an organization buys insurance to cover potential losses from a specific risk? A. Accept | Transfer The organization is passing the financial burden of a risk to another entity, like an insurance company. |
In third-party risk assessment, what term describes the explicit boundaries and behaviors that should be followed during a penetration test? A. Right-to-audit clause | Rules of engagement Defines the scope, methods, and boundaries during assessments like penetration testing. |
An organization has a predetermined level at which risks need immediate attention and possible action. This level is known as: A. Risk analysis | Risk threshold Represents a boundary beyond which risks require immediate attention. |
When an organization decides to stop a project or close a business segment to avoid a potential risk, they are employing which risk management strategy? A. Avoid | Avoid Taking action to ensure the risk doesn’t materialize. |
In the context of third-party risk assessment, which document provides a detailed understanding between two organizations without a legally binding commitment? A. Service-level agreement (SLA) | Memorandum of understanding (MOU) Signifies a mutual understanding between parties without legal obligations. |
Which concept in risk management helps an organization to identify how much total financial loss they can expect over a year due to potential risks? A. Risk scenario | Annualized loss expectancy (ALE) Quantifies the expected financial loss over a year. |
An organization has a policy that requires employees to lock their computer screens when they are away from their desks. This policy is primarily aimed at preventing which of the following? A. Malware infections | Unauthorized access by internal entities Locking screens prevents opportunistic or malicious access by co-workers or other internal personnel. |
A company wants to determine where personal data is stored, processed, and transmitted within its environment. This process is best described as: A. Data inventory | Data inventory Identifying and cataloging data within an organization. |
If an individual wants to ensure their personal data is deleted from an online service’s database, this is termed as: A. Data retention | Right to be forgotten An individual’s right to have their personal data deleted. |
A third-party organization is employed by a bank to review its financial transactions to ensure there’s no fraud or anomalies. This is an example of: A. Self-assessment | Independent third-party audit An external party reviewing an organization’s operations. |
An organization periodically sends its employees simulated phishing emails to test their ability to recognize malicious attempts. This is an example of: A. Phishing campaigns | Phishing campaigns Simulated attempts to test users’ ability to recognize phishing. |
During penetration testing, the testers only have knowledge about the specific IT systems they are supposed to test. This scenario is termed as: A. Active reconnaissance | Partially known environment Testers have knowledge about certain systems but not everything. |
What is the main goal of conducting external examinations in an organization? A. To verify the organization’s compliance with external regulations. | To verify the organization’s compliance with external regulations. External examinations aim to ensure compliance with regulations. |
When an employee is taught the dangers of writing down passwords or storing them in easily accessible locations, this training is primarily to prevent which type of threat? A. Social engineering | Insider threat Encompasses threats posed by individuals within an organization, such as employees mishandling sensitive information. |
In the context of privacy, which entity primarily determines how personal data is stored and for how long? A. Processor | Controller Decide how personal data should be stored and the duration for the same. |
During a security awareness session, employees are informed of the dangers of disclosing their work details in online forums or social media. This training aims to mitigate which of the following threats? A. Password attacks | Operational security breaches Maintaining operational information, including non-disclosure of sensitive operational details. |
If an organization is seeking to understand the potential consequences of not adhering to a newly implemented data protection regulation, they are primarily concerned with: A. Privacy implications | Consequences of non-compliance Focuses on understanding the repercussions of not adhering to regulations. |
Which cryptographic method involves hiding a message within another message or image, such that it’s not detectable? A. Tokenization | Steganography The technique of hiding data within other data. |