CompTIA Security+ (SY0-701)

Question 1

A security analyst reviews authentication logs and discovers that a user account successfully logged in from New York at 09:00 AM EST and then from Tokyo at 09:45 AM EST on the same day. The account shows no other anomalies, and the user is currently on vacation. Which indicator of malicious activity is MOST likely present?

Accepted Answer

Impossible travel

Answer

Concurrent session usage

Answer

Account lockout

Answer

Out-of-cycle logging

Question 2

A company owns a data center server valued at $80,000. A risk analyst determines that a flood would destroy 25% of the asset's value, and historical data indicates such a flood occurs approximately once every four years at this location. What is the annualized loss expectancy (ALE) that should be recorded in the risk register?

Accepted Answer

$5,000

Answer

$20,000

Answer

$80,000

Answer

$1,250

Question 3

A cloud engineering team uses infrastructure-as-code to let developers self-provision resources. Management is concerned that developers could accidentally spin up publicly accessible storage buckets or oversized virtual machines that violate company standards. The security team wants an automated mechanism that automatically rejects or corrects any provisioning request that does not conform to approved configuration policies, without requiring manual review of each request. Which automation use case BEST addresses this requirement?

Accepted Answer

Guard rails

Answer

Ticket creation

Answer

Continuous integration/continuous deployment

Answer

Escalation

Question 4

A financial services company owns a database server valued at $200,000. A risk analyst determines that a ransomware attack would render 40% of the asset's value unusable, and historical data indicates such an attack is likely to occur twice per year. Which value should the analyst record in the risk register as the annualized loss expectancy (ALE) for this scenario?

Accepted Answer

$160,000

Answer

$80,000

Answer

$40,000

Answer

$400,000

Question 5

A financial services company owns a database server valued at $200,000. A risk analyst estimates that a ransomware event would destroy 25% of the asset's value each time it occurs, and historical data suggests such an event happens about twice per year. The security manager needs the annualized loss expectancy (ALE) to justify a proposed backup investment. What is the correct ALE?

Accepted Answer

$100,000

Answer

$50,000

Answer

$25,000

Answer

$400,000

Question 6

A security analyst is conducting a quantitative risk analysis for a database server that stores customer payment information. The server is valued at $45,000, and a successful ransomware attack would result in 60% loss of the asset's value. Historical data indicates that ransomware attacks targeting similar systems in the organization occur approximately 3 times per year. What is the Annualized Loss Expectancy (ALE) for this risk?

Accepted Answer

$81,000

Answer

$27,000

Answer

$45,000

Answer

$135,000

Question 7

A company's financial analysis reveals that a critical database server has an asset value of $120,000. Historical data shows this server experiences a catastrophic failure approximately once every four years. When such failures occur, the company typically loses 40% of the server's value due to data recovery costs, business interruption, and partial hardware replacement. What is the Annualized Loss Expectancy (ALE) for this risk?

Accepted Answer

$12,000

Answer

$30,000

Answer

$48,000

Answer

$120,000

Question 8

A security administrator needs to implement a certificate validation method that provides real-time revocation status checks with minimal overhead. The solution must allow clients to query the status of a single certificate without downloading large files. Which protocol should be implemented?

Accepted Answer

Online Certificate Status Protocol (OCSP)

Answer

Certificate Revocation List (CRL)

Answer

Certificate Signing Request (CSR)

Answer

Public Key Infrastructure (PKI)

Question 9

A software company distributes desktop applications to customers over the internet. Users have reported warnings that the installer's publisher cannot be verified, and the security team is concerned that attackers could distribute tampered versions of the software. Which application security technique should the company implement to allow customers to confirm the software originated from the company and has not been altered?

Accepted Answer

Code signing

Answer

Input validation

Answer

Static code analysis

Answer

Sandboxing

Question 10

A company runs a legacy payment application on an outdated operating system that cannot be patched to remediate a known critical vulnerability. Business requirements prevent decommissioning the system for another 18 months. To reduce risk in the interim, the security team places the server on an isolated network segment behind a dedicated firewall with strict access rules and enhanced logging. Which type of security control does this MOST accurately describe?

Accepted Answer

Compensating control

Answer

Corrective control

Answer

Directive control

Answer

Deterrent control

Question 11

A hospital runs a legacy application on an unsupported operating system that can no longer receive security patches. Management refuses to decommission the system because it is critical to patient scheduling. To reduce risk, the security team isolates the server on a dedicated VLAN and places a next-generation firewall in front of it to inspect all traffic. Which type of security control BEST describes this approach?

Accepted Answer

Compensating control

Answer

Corrective control

Answer

Deterrent control

Answer

Directive control

Question 12

A security analyst reviewing authentication logs notices that a user account shows login activity from New York at 9:00 AM EST and from Singapore at 9:15 AM EST on the same day. The account has not logged out between these sessions. Which indicator of malicious activity is MOST likely present?

Accepted Answer

Impossible travel

Answer

Concurrent session usage

Answer

Account lockout

Answer

Out-of-cycle logging

Question 13

A security analyst reviews authentication logs and discovers that a user account from the finance department is currently logged in from two different locations: one session from the corporate office in New York at 2:15 PM EST, and another session from an IP address in Romania at 2:17 PM EST. Both sessions are actively accessing financial records. What type of indicator of malicious activity is MOST clearly demonstrated?

Accepted Answer

Impossible travel

Answer

Concurrent session usage

Answer

Account lockout

Answer

Resource consumption

Question 14

A payment processing company needs to store customer credit card information for recurring billing purposes while minimizing the risk of exposing sensitive cardholder data. The security team wants to replace the actual credit card numbers with randomly generated values that can be mapped back to the original data only through a secure lookup service. Which cryptographic solution should be implemented?

Accepted Answer

Tokenization

Answer

Hashing with salt

Answer

Data masking

Answer

Steganography

Question 15

A healthcare organization stores patient records in a database on physical servers in their data center. The Chief Information Security Officer (CISO) is concerned about unauthorized access to sensitive patient information if storage media is physically stolen or improperly disposed of. Which cryptographic solution should be implemented to protect this data?

Accepted Answer

Full disk encryption using AES-256

Answer

TLS 1.3 encryption for database connections

Answer

IPsec tunneling between database servers

Answer

Hashing patient records with SHA-256

Question 16

A security analyst is reviewing vulnerability scan results for the company's environment. Two findings must be prioritized for remediation: Finding 1 has a CVSS base score of 9.8 but affects an isolated internal test server with no network access to production. Finding 2 has a CVSS base score of 7.5 and affects a customer-facing web server that processes payment data. Company risk tolerance is low, and PCI DSS compliance is required. Which finding should the analyst remediate first, and why?

Accepted Answer

Finding 2, because environmental variables and organizational impact raise its effective risk despite the lower base score

Answer

Finding 1, because its higher CVSS base score indicates greater technical severity

Answer

Finding 1, because a score above 9.0 is always classified as critical and must be patched immediately

Answer

Finding 2, because a lower CVSS base score is easier and faster to remediate

Question 17

A healthcare organization is implementing a new customer service system where call center representatives need to verify patient identities but should not have access to full Social Security Numbers or complete credit card details. The organization wants to maintain the original data format while protecting sensitive information from unauthorized viewing. Which data protection method should be implemented?

Accepted Answer

Data masking

Answer

Tokenization

Answer

Hashing

Answer

Encryption

Question 18

A multinational pharmaceutical company is migrating patient trial data to a cloud provider. The company must comply with regulations requiring that EU citizen health data remain physically stored within EU borders and cannot be transferred to other jurisdictions. Which of the following should the security architect implement to meet this requirement?

Accepted Answer

Configure geolocation restrictions to ensure data residency within EU data centers

Answer

Implement encryption at rest and in transit for all stored patient data

Answer

Deploy tokenization to replace sensitive patient identifiers with non-sensitive equivalents

Answer

Enable data classification tags to mark all records as confidential or restricted

Question 19

A European healthcare organization is migrating patient health records to a cloud service provider. Regulatory requirements mandate that all patient data must be processed and stored within the European Union to comply with GDPR. Which data protection consideration is primarily being addressed?

Accepted Answer

Data sovereignty

Answer

Data classification

Answer

Data masking

Answer

Data segmentation

Question 20

A multinational healthcare organization is migrating patient records to a cloud provider. The organization operates in the European Union and must comply with GDPR requirements that mandate patient data remain within EU borders. Which of the following should the security architect prioritize when selecting cloud storage regions?

Accepted Answer

Data sovereignty

Answer

Data masking

Answer

Data segmentation

Answer

Data tokenization

Question 21

A multinational financial services company stores customer account data in a cloud database hosted in the United States. New regulations in the European Union require that all personal data of EU citizens must be processed and stored within EU borders. The company needs to comply while maintaining operational efficiency. Which solution BEST addresses this data sovereignty requirement?

Accepted Answer

Implement geolocation-based data storage routing to store EU customer data in EU-region cloud data centers

Answer

Enable AES-256 encryption for all customer data stored in the US data centers

Answer

Apply data masking to EU customer records before storing them in the US database

Answer

Use tokenization to replace EU customer sensitive data with non-sensitive equivalents

Question 22

A multinational financial services company is expanding operations into the European Union and must comply with GDPR requirements for customer data. The company currently stores all customer records in a centralized database hosted in their US-based data center. Which approach BEST addresses data sovereignty concerns while maintaining operational efficiency?

Accepted Answer

Implement data tokenization to replace EU customer data with tokens stored in the US while keeping actual data in EU-based storage

Answer

Deploy encryption for all customer records using AES-256 and store encrypted EU customer data in the US data center

Answer

Configure data masking to hide sensitive EU customer information when accessed by US-based administrators

Answer

Enable database replication to mirror all customer records across multiple geographic regions for redundancy

Question 23

A retail organization is redesigning its point-of-sale system to reduce the scope of PCI DSS compliance. The security team needs to protect credit card numbers while still allowing the system to reference transactions for returns and customer service inquiries. The solution must ensure that if the database is compromised, actual card numbers cannot be retrieved. Which data protection method best meets these requirements?

Accepted Answer

Tokenization with tokens stored in the transaction database and card data stored in a separate secure vault

Answer

Data masking by displaying only the last four digits of card numbers in all system interfaces

Answer

AES-256 encryption of card numbers with keys stored in a hardware security module

Answer

SHA-256 hashing of card numbers before storing them in the transaction database

Question 24

A healthcare organization is implementing encryption for its patient database to protect data at rest. The security team needs to ensure cryptographic keys are stored securely and isolated from the application servers. The solution must provide dedicated hardware for key management with tamper-resistant properties and meet compliance requirements for protecting sensitive health information. Which cryptographic tool should the organization implement?

Accepted Answer

Hardware Security Module (HSM)

Answer

Trusted Platform Module (TPM)

Answer

Secure enclave

Answer

Key management system (KMS)

Question 25

A security analyst discovers that several employees in the marketing department have been using personal cloud storage accounts to share large campaign files with external contractors, bypassing the company's approved file transfer system. The IT department was not aware of these services being used. Which type of threat actor does this scenario represent?

Accepted Answer

Shadow IT

Answer

Insider threat

Answer

Unskilled attacker

Answer

Organized crime

Question 26

A healthcare organization stores nightly database backups on tape media that are transported by a third-party courier to an offsite facility 50 miles away. The security team is concerned about protecting patient health information during transit. Which cryptographic solution should be implemented to protect the confidentiality of the data if the tapes are lost or stolen during transport?

Accepted Answer

Data at rest encryption

Answer

Data in transit encryption

Answer

Digital signatures

Answer

Data masking

Question 27

A security engineer wants to be automatically alerted whenever critical system binaries or configuration files on production web servers are modified, as unauthorized changes have recently gone unnoticed until after an incident. Which enterprise capability should the engineer deploy to meet this requirement?

Accepted Answer

File integrity monitoring (FIM)

Answer

Data loss prevention (DLP)

Answer

Network access control (NAC)

Answer

DNS filtering

Question 28

A financial services company is migrating customer credit card data to a cloud storage solution. Regulatory requirements mandate that cardholder data must be protected from unauthorized access even if storage media is physically compromised. The security team needs to select the most appropriate data protection method that addresses this specific compliance requirement while maintaining the ability to process transactions.

Accepted Answer

Implement encryption at rest using AES-256 with hardware security module (HSM) key management

Answer

Configure tokenization to replace card numbers with randomly generated surrogate values

Answer

Apply data masking to display only the last four digits of card numbers in all interfaces

Answer

Enable transport layer security (TLS) 1.3 for all data transmission to the cloud storage

Question 29

A financial services company is migrating customer credit card data to a cloud-based payment processing system. The security team must ensure that cardholder data is protected both when stored in the database and when transmitted between the payment gateway and third-party processors. Which combination of data protection methods should be implemented to meet PCI DSS compliance requirements?

Accepted Answer

Encryption for data at rest and TLS 1.2 or higher for data in transit

Answer

Tokenization for data at rest and IPSec VPN for data in transit

Answer

Data masking for data at rest and SSH tunneling for data in transit

Answer

Hashing for data at rest and SSL 3.0 for data in transit

Question 30

A manufacturing plant runs a SCADA system that controls production line machinery. The vendor no longer provides firmware updates, and the embedded controllers cannot be taken offline without halting production for days. A recent assessment flagged several unpatchable vulnerabilities in these controllers. Which architectural consideration is the security team primarily dealing with, and what is the most appropriate response?

Accepted Answer

Inability to patch — isolate the controllers in a segmented network zone with strict access controls

Answer

Risk transference — purchase cyber insurance to cover any losses from the SCADA system

Answer

Ease of deployment — redeploy the controllers using infrastructure as code templates

Answer

Responsiveness — add a load balancer in front of the controllers to improve availability

Question 31

A security analyst reviewing authentication logs notices that a sales manager's account successfully logged in from an office in Chicago at 9:02 AM, and then a second successful login for the same account appeared from an IP address geolocated in Singapore at 9:14 AM. Both sessions remained active simultaneously. Which indicator of malicious activity BEST describes what the analyst has observed?

Accepted Answer

Impossible travel

Answer

Account lockout

Answer

Resource consumption

Answer

Out-of-cycle logging

Question 32

A security analyst reviewing authentication logs notices that a user account successfully logged in from an office in Chicago at 9:02 AM and then logged in again from an IP address geolocated in Singapore at 9:14 AM the same day. Both sessions authenticated successfully with the correct password. Which indicator of malicious activity does this BEST represent?

Accepted Answer

Impossible travel

Answer

Account lockout

Answer

Resource consumption

Answer

Out-of-cycle logging

Question 33

A security analyst reviews authentication logs and discovers that a user account successfully authenticated from New York at 09:15 AM EST, and the same account authenticated from Tokyo at 09:45 AM EST on the same day. No VPN connections were recorded for this user. What type of indicator of malicious activity has been identified?

Accepted Answer

Impossible travel

Answer

Concurrent session usage

Answer

Account lockout

Answer

Out-of-cycle logging

Question 34

A security analyst reviews authentication logs and discovers that a user account successfully authenticated from Tokyo, Japan at 08:15 UTC, and then the same account authenticated from New York, USA at 09:30 UTC the same day. There are no VPN connections associated with either login. Both authentication attempts were successful and used correct credentials. What indicator of malicious activity does this scenario BEST represent?

Accepted Answer

Impossible travel

Answer

Concurrent session usage

Answer

Credential replay attack

Answer

Account lockout pattern

Question 35

A security analyst reviews authentication logs and discovers that a user account successfully authenticated from New York at 09:15 AM EST and then authenticated again from Tokyo at 09:45 AM EST on the same day. Both login attempts were successful, and no VPN connections were detected. Which indicator of malicious activity is MOST likely present?

Accepted Answer

Impossible travel

Answer

Concurrent session usage

Answer

Account lockout

Answer

Out-of-cycle logging

Question 36

A financial services company wants to reduce the risk associated with administrators holding standing access to production database servers. The security team needs a solution that grants elevated privileges only for the duration of an approved task and automatically revokes them afterward, while also recording all privileged sessions. Which approach best meets these requirements?

Accepted Answer

Implement a PAM solution with just-in-time permissions and password vaulting

Answer

Assign administrators to a permanent role-based access control group with least privilege applied

Answer

Enable time-of-day restrictions on all administrator accounts during business hours

Answer

Require multifactor authentication for all administrative logins to the database

Question 37

A healthcare organization is decommissioning 50 mobile devices that were previously used by clinical staff to access patient records through a mobile app. The devices contain cached data and are enrolled in the organization's MDM solution. Which of the following actions should be performed FIRST to ensure proper data sanitization before disposal?

Accepted Answer

Issue a remote wipe command through the MDM platform to factory reset all devices

Answer

Physically destroy the devices using a certified shredding service

Answer

Remove the devices from the MDM enrollment and donate them to a charity

Answer

Perform a manual factory reset on each device through the device settings menu

Question 38

A security analyst reviews authentication logs and discovers that a user account successfully authenticated from New York at 09:15 AM EST and then authenticated again from Singapore at 09:45 AM EST on the same day. The user is a marketing manager with no international travel scheduled. Which indicator of malicious activity is MOST clearly demonstrated?

Accepted Answer

Impossible travel

Answer

Concurrent session usage

Answer

Account lockout

Answer

Credential replay attack

Question 39

A hospital data center must keep critical patient monitoring systems running through both brief power fluctuations and multi-hour utility outages. The facilities team needs a resilience design that provides instantaneous, uninterrupted power the moment utility power fails, while also sustaining the load for many hours during extended outages. Which combination should the team implement?

Accepted Answer

A UPS to bridge the outage instantly, backed by a standby generator for extended runtime

Answer

A standby generator alone, since it will start automatically when utility power drops

Answer

Managed PDUs on each rack to redistribute load during the outage

Answer

A second utility feed from the same provider for redundancy

Question 40

A retail company processes thousands of credit card transactions daily. Compliance auditors require that primary account numbers (PANs) not be stored in the company's databases or analytics systems, yet the marketing team still needs a consistent value to link repeat purchases from the same card without ever seeing the real card number. Which data protection method best satisfies both requirements?

Accepted Answer

Tokenization

Answer

Full-disk encryption of the database volumes

Answer

Data masking on all reports

Answer

Hashing the PANs with a salt

Question 41

A retail company stores customer credit card numbers to enable recurring subscription billing. Auditors require that the actual card numbers not be present in the company's transaction database, yet the billing system must still be able to reference the same card for repeat charges without a customer re-entering it. Which data protection method best meets these requirements?

Accepted Answer

Tokenization

Answer

Hashing

Answer

Data masking

Answer

Symmetric encryption stored alongside the data

Question 42

A financial services company allows a team of data analysts to run queries against a production customer database that contains full account numbers. The analysts only need to see partial account numbers to perform trend analysis, and they must never be able to view the complete values. Which data protection method best meets this requirement while keeping the data usable for the analysts?

Accepted Answer

Data masking

Answer

Full-disk encryption

Answer

Hashing

Answer

Tokenization

Question 43

A financial services company is building a new analytics platform in a non-production environment. Developers need realistic customer records that preserve referential integrity across tables (so the same customer account number consistently links related records), but the actual account numbers must never be exposed. The company also wants the ability to reverse the process in a secured production system to retrieve original values when required for reconciliation. Which data protection method BEST meets these requirements?

Accepted Answer

Tokenization using a centralized token vault

Answer

One-way hashing of the account numbers with a salt

Answer

Static data masking that overwrites account numbers with random values

Answer

Full-disk encryption of the development database server

Question 44

A financial services company is building a test environment that mirrors production. Developers need realistic customer records to test an application, but the company must ensure that actual credit card numbers are never exposed in non-production systems while keeping the same data format so validation logic still functions. Which method best meets these requirements?

Accepted Answer

Tokenization

Answer

Full-disk encryption of the test database

Answer

Hashing the credit card numbers

Answer

Data segmentation into a separate VLAN

Question 45

A security analyst is performing a quantitative risk analysis for a critical database server. The asset value is $500,000, and a successful ransomware attack would cause 60% damage to the asset. Historical data indicates this type of attack occurs twice per year on average. What is the Annualized Loss Expectancy (ALE) for this risk scenario?

Accepted Answer

$600,000

Answer

$300,000

Answer

$500,000

Answer

$1,000,000

Question 46

A financial services company is evaluating the risk of a potential cloud provider outage that could disrupt critical trading systems. The annual cost of mitigation controls would be $180,000, while the estimated single loss from an outage is $2,500,000 with an expected occurrence of once every 10 years. The company decides to purchase cyber insurance with a $200,000 annual premium that covers up to $3,000,000 in losses. Which risk management strategy is the company implementing?

Accepted Answer

Risk transfer

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 47

A manufacturing company has identified a critical vulnerability in a legacy industrial control system that manages production line operations. The system cannot be patched due to vendor end-of-life, and replacing it would cost $2 million with 18 months downtime. A security analysis estimates the annual loss expectancy at $150,000. The company purchases a cyber insurance policy covering up to $5 million in losses related to this specific system. Which risk management strategy is the company primarily implementing?

Accepted Answer

Risk transfer

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 48

A financial services company has identified that ransomware attacks pose a significant threat to their operations. After conducting a risk analysis, they determine the annualized loss expectancy (ALE) is $2.4 million. The company decides to implement offline encrypted backups, endpoint detection and response (EDR) solutions, and security awareness training at a total annual cost of $480,000, which reduces the ALE to $600,000. Which risk management strategy is the company primarily employing?

Accepted Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk acceptance

Question 49

A healthcare organization has identified a critical vulnerability in its legacy radiology system that could allow ransomware attacks. The system cannot be patched due to vendor end-of-life status, and replacing it would cost $2 million with an 18-month implementation timeline. The organization has determined the annualized loss expectancy (ALE) for a ransomware incident is $800,000. The CISO purchases a cyber insurance policy with ransomware coverage for an annual premium of $150,000. Which risk management strategy is the organization primarily implementing?

Accepted Answer

Risk transfer

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 50

A healthcare organization operates a legacy medical imaging system that contains vulnerabilities but cannot be patched because the vendor no longer supports it. The system processes critical patient data daily. Replacing the system would cost $500,000 and take 18 months. A recent risk assessment calculated the annualized loss expectancy (ALE) at $75,000. The organization has implemented network segmentation, strict access controls, and enhanced monitoring around this system. Which risk management strategy has the organization primarily adopted?

Accepted Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk acceptance

Question 51

A healthcare organization has identified that a legacy medical imaging system contains a critical vulnerability that could expose patient data. The system cannot be patched due to vendor end-of-life status, and replacing it would cost $850,000 with an 18-month implementation timeline. A security assessment determines the annual loss expectancy (ALE) is $45,000. The organization purchases a cyber insurance policy with a $50,000 annual premium that covers losses from this specific risk. Which risk management strategy is the organization implementing?

Accepted Answer

Risk transfer

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 52

A financial services company is implementing a formal risk management program. The security team has identified various risks and needs to track them systematically. They want to document each risk's likelihood, potential impact, current mitigation status, and assign accountability. The CISO has asked for a centralized system that will also allow monitoring of metrics indicating when risks are materializing. Which of the following should the security team implement?

Accepted Answer

Risk register with key risk indicators and risk owners

Answer

Business impact analysis with RTO and RPO values

Answer

Qualitative risk assessment with exposure factor calculations

Answer

Risk tolerance matrix with risk appetite statements

Question 53

A security administrator is implementing various controls to protect a data center. They install surveillance cameras, deploy an intrusion detection system (IDS) to monitor network traffic, require visitors to sign in at reception, and configure firewall rules to block unauthorized access. Which category does the IDS primarily represent?

Accepted Answer

Technical

Answer

Physical

Answer

Operational

Answer

Managerial

Question 54

A security administrator configures firewall rules to block inbound traffic on port 23 (Telnet) and enforce SSH connections on port 22 instead. The administrator then creates a policy document requiring all remote access to use encrypted protocols. Which combination of control category and type best describes these actions?

Accepted Answer

Technical preventive control and managerial directive control

Answer

Physical preventive control and operational detective control

Answer

Technical detective control and operational corrective control

Answer

Managerial preventive control and technical compensating control

Question 55

A security analyst receives an alert that a user's account authenticated successfully from New York at 9:00 AM EST and then authenticated again from Tokyo at 9:45 AM EST on the same day. The user is a finance employee who typically works from the New York office. Which indicator of malicious activity is MOST likely being observed?

Accepted Answer

Impossible travel

Answer

Concurrent session usage

Answer

Account lockout

Answer

Out-of-cycle logging

Question 56

A SOC analyst is overwhelmed by thousands of daily alerts from the SIEM, most of which are triggered by a routine backup job that connects to multiple internal servers each night. Legitimate threats are being missed in the noise. Which activity should the analyst perform to reduce these unnecessary alerts while preserving detection of genuine threats?

Accepted Answer

Alert tuning

Answer

Log aggregation

Answer

Archiving

Answer

Quarantine

Question 57

A security analyst is configuring a SIEM to detect potential brute force attacks against the organization's web application. The analyst wants to generate an alert when multiple failed login attempts from the same source IP address occur within a short time window, followed by a successful login. Which SIEM capability should the analyst primarily utilize to achieve this detection?

Accepted Answer

Correlation

Answer

Log aggregation

Answer

Archiving

Answer

Reporting

Question 58

A financial services company owns a database server valued at $200,000. A risk analyst determines that a ransomware event would render approximately 40% of the asset's value unusable, and historical data suggests such an event occurs roughly twice per year. Which value represents the annualized loss expectancy (ALE) the analyst should record in the risk register?

Accepted Answer

$160,000

Answer

$80,000

Answer

$40,000

Answer

$200,000

Question 59

A financial services company owns a customer database valued at $500,000. A risk analyst determines that a specific ransomware event would render 40% of the asset unusable, and historical industry data indicates this type of event occurs about twice every five years. Which value represents the annualized loss expectancy (ALE) that the analyst should record in the risk register?

Accepted Answer

$80,000

Answer

$200,000

Answer

$100,000

Answer

$500,000

Question 60

A company wants employees to log in once with their corporate credentials and then access multiple third-party SaaS applications without re-entering passwords. The identity provider must send authentication assertions to the external service providers using an XML-based standard. Which solution best meets these requirements?

Accepted Answer

Implement SAML-based federation between the corporate identity provider and the SaaS service providers

Answer

Deploy a local password vault on each workstation to auto-fill credentials for each application

Answer

Configure RADIUS authentication on the corporate wireless network for all users

Answer

Enable Kerberos ticket-granting within the on-premises Active Directory domain

Question 61

A healthcare organization is finalizing a contract with a cloud service provider that will store and process electronic protected health information (ePHI). The security team wants to ensure they can verify the vendor's security controls and compliance status throughout the contract period. Which contract provision should the organization prioritize to maintain ongoing visibility into the vendor's security posture?

Accepted Answer

Right-to-audit clause

Answer

Service level agreement (SLA)

Answer

Non-disclosure agreement (NDA)

Answer

Business partnership agreement (BPA)

Question 62

A security analyst is investigating a breach where attackers gained access to the organization's research and development servers containing proprietary manufacturing designs for military equipment. The attackers spent three months conducting reconnaissance, used custom malware with advanced anti-forensics capabilities, and exfiltrated data without causing any system disruptions or requesting ransom. Which threat actor is MOST likely responsible for this attack?

Accepted Answer

Nation-state

Answer

Organized crime

Answer

Hacktivist

Answer

Insider threat

Question 63

A retail organization processes credit card transactions and needs to reduce PCI DSS scope by ensuring that sensitive payment card data is not stored in their e-commerce application database. The solution must allow the organization to reference transactions for refunds and chargebacks while minimizing the risk of data exposure. Which data protection method should be implemented?

Accepted Answer

Tokenization

Answer

Data masking

Answer

Symmetric encryption

Answer

Hashing with salt

Question 64

A finance employee reports that after clicking a link in an internal-looking email, they entered credentials on a portal at 'micorsoft-login.com'. The company normally uses 'microsoft.com' services. The IT security team confirms the fraudulent site is nearly identical to the legitimate Microsoft login page. Which threat vector BEST describes the technique used to register the malicious domain?

Accepted Answer

Typosquatting

Answer

Watering hole attack

Answer

On-path attack

Answer

Business email compromise

CompTIA Security+ (SY0-701) (SY0-701) full-length practice exam

How this timed SY0-701 mock exam works

What your SY0-701 results show

How to get the most out of it

Ready for the full SY0-701 mock exam?