CompTIA Security+ Practice Test (SY0-701)

Encryption is the process of converting plaintext into a coded format known as ciphertext, which can only be read by authorized parties who have the decryption key. This process uses an algorithm and a key to transform the readable data into an unreadable format, thereby protecting the data from unauthorized access or eavesdropping.

The correct answer is 'Potential impact on business operations' because when prioritizing vulnerabilities, the primary concern is how a vulnerability might affect critical business functions and operations. If the impact is high, it could lead to significant loss or damage, so these vulnerabilities need to be addressed first. Other options such as the ease of implementation, popularity of the software, and personal preference are considered, but they do not outweigh the importance of the potential impact on business operations.

The correct answer is the one that aligns with the goal of adhering to the highest regulatory requirements across regions. This ensures that the financial institution complies with all regional regulations while maintaining a uniform standard of security. Implementing the strictest regulatory standard as the company-wide standard is a common approach to simplifying compliance and ensuring the highest security posture is maintained throughout the organization, regardless of location. Options involving conflicting national and local standards, as well as those suggesting the development of new internal standards or solely following the least strict, do not address the overarching need to meet all regional compliance requirements efficiently.

Having an approval process for the updated security policies is the best method to ensure they are correctly understood and enforced, as it involves reviewing and formally accepting the changes by authorized stakeholders. An approval process typically includes checks and balances to prevent errors and omissions and establishes a clear understanding of new policies before they are implemented.

Allow lists specify which entities are permitted access, enhancing security by restricting unauthorized access.

Snapshots indeed record the system's state at a particular moment, allowing for restoration to that exact point if needed. This is a common method used in backups to ensure data consistency and quick recovery.

Containment is the correct answer because the immediate priority in incident response, following detection and analysis, is to contain the incident to prevent further damage or spread of the threat. Eradication and Recovery are subsequent steps that cannot be effectively performed unless the threat is first contained.

Security cameras are a form of deterrent control designed to discourage unauthorized individuals from attempting to access a secure area. Their presence is often enough to dissuade potential attackers as it increases the likelihood of being caught and recorded, which can lead to identification and potential prosecution. In contrast, badge readers and mantraps, while part of physical security measures, are types of preventive controls that actively prevent unauthorized access. Security awareness posters do not directly discourage trespassers from entering secured premises, as they are more focused on educating authorized personnel on maintaining security practices.

The correct answer is 'Compromised hardware or software' because suppliers have direct access to the components and programs that enterprises use, making it possible for them to introduce compromised products into an organization's infrastructure. 'Data corruption during transmission' focuses on data in transit rather than supply chain vulnerabilities. 'Inadequate customer service' does not directly relate to security issues, and 'Unauthorized data sharing' is a concern with entities that handle data, but it does not specifically relate to the risks posed by suppliers in the supply chain.

In this scenario the best option for next steps is to organize the vulnerabilities by criticality. Some may be very important and represent significant risk, while others may be false positive or very minor issues. Most scanning solutions will have this information readily available. There is no way to identify false positives without going through each and every one, and halting all code changes would likely cause major disruptions to the business. The logical next step is to begin planning and focus on the worst issues first.

Pretexting involves the creation of a fabricated scenario designed to persuade a victim to release information or perform some action. In this case, the attacker is pretending to be a familiar and legitimate entity—such as an IT department representative—to gain the trust of the employee and obtain sensitive information. This is a common tactic where attackers carefully craft a believable story that seems legitimate to the victim.

Process hollowing is indeed a memory injection technique where an attacker creates a new process in a suspended state and replaces its image with malicious code, effectively 'hollowing out' the legitimate process. This can be used to evade detection from security software that is monitoring for the launch of malicious processes.

This setup is best known as an air gap. In network an air gap means two or more networks are physically separated from each other to ensure no data can traverse from one to the other. Generally if a network is so critical it requires an air gap it will be a completely stand alone network with no access to other networks and especially the internet. A true air gap is not common in most businesses, but some known examples are government or military networks, highly critical infrastructure networks like nuclear power plant controls and financial systems like stock exchanges.

A tabletop exercise is a type of test where participants verbally walk through the steps of various emergency scenarios and disaster recovery procedures. It is designed to test the theoretical response to a disaster, ensuring that all individuals know their roles and responsibilities, without actually performing any recovery operations or disrupting the current operations. Other options, such as simulation and failover, involve more active engagement with systems or demonstration of the disaster recovery process.

A honeypot is a decoy system that mimics a legitimate system to attract and trap potential attackers. It is intentionally made vulnerable to entice malicious actors, allowing cybersecurity professionals to monitor and analyze their behavior, methods, and techniques. This information can then be used to strengthen the security of real systems and develop more effective defenses against future attacks. Honeypots are an essential tool in deception and disruption technology, as they help detect and deflect attacks away from critical systems.