CompTIA Security+ Practice Test (SY0-701)

A Virtual Machine (VM) escape is a security vulnerability that allows an attacker to break out from an isolated virtual machine and interact with the host operating system or other VMs. This type of vulnerability is particularly concerning because it undermines the isolation that is a fundamental security principle of virtualization. The other options are incorrect. Buffer overflow and SQL injection are general vulnerability types but are not specific to breaking out of a virtualized environment. A firmware compromise relates to attacks against the low-level software embedded in hardware, which is a different attack vector.

While biometric authentication provides a convenient and personal security layer, it should not be the sole method of protection. Biometric systems can be bypassed or spoofed using various techniques. Furthermore, a single authentication factor is inherently weaker than a multi-factor approach. Therefore, the best practice is to require biometrics in conjunction with another factor, like a strong PIN or password, as part of a multi-factor authentication (MFA) strategy to provide defense-in-depth.

Directive controls are designed to direct the actions of individuals or systems within an organization. They provide guidance and instructions on how to maintain security and comply with established policies. Examples of directive controls include security policies and guidelines that outline acceptable behaviors, procedures, and best practices. These controls help ensure that employees and systems operate in a manner consistent with the organization's security objectives.

Account lockout policies are specifically designed to prevent brute force attacks by locking an account after a certain number of failed login attempts. This directly mitigates the risk by stopping the attacker from continuously trying different password combinations. Using longer passwords increases the difficulty of success for an attacker but does not block continuous attempts. Frequent password changes can be counterproductive as they might lead to weaker password choices by users. Monitoring for failed logins is a reactive measure which helps in identifying that a brute force attack may be occurring but does not prevent it.

A Security Information and Event Management system collects and correlates events from different sources across the organization's infrastructure to identify aberrant activities that may signify security threats. The incorrect options do not primarily focus on aggregating and analyzing data from multiple resources to identify security incidents; Data Loss Prevention focuses on protecting sensitive data from leaks, Network Management uses SNMP traps mainly for network device management, and Intrusion Detection Systems monitor network traffic to identify potential malicious activity.

Ransomware is a type of malware that encrypts the victim's data and requires payment, often demanded in cryptocurrency, to provide the decryption key. This description matches exactly what ransomware does. A Trojan is a malicious program disguised as legitimate software. A Worm replicates itself to spread to other computers, and a Virus requires user interaction to spread and is not defined by demanding a ransom.

The described scenario suggests that the application is experiencing a Buffer Overflow vulnerability. Buffer overflow happens when a program attempts to write more data to a fixed-length block of memory, or buffer, than it is allocated to hold. Since the application is crashing when processing long strings, it is likely that the allocated memory for the input data is being exceeded, causing the application to terminate unexpectedly. SQL Injection vulnerabilities are exploited by entering malicious SQL statements into input fields, aiming to manipulate the back-end database, which is not related to the length of input causing crashes. Cross-Site Scripting (XSS) vulnerabilities exploit the way browsers parse HTML and JavaScript but would not cause the application to terminate in the described manner. Directory Traversal attacks aim at accessing files and directories that are stored outside the web root folder, and although they are serious, they do not fit the symptoms described.

The Recovery Time Objective (RTO) is the target time set for the recovery of IT and business activities after a disaster has occurred. It defines the maximum tolerable duration of disruption before the business suffers significant losses or unacceptable consequences. RTO is crucial in developing disaster recovery strategies and allocating the appropriate resources to ensure business continuity.

Writing more data to a fixed-length memory buffer than it was allocated to hold is a classic buffer overflow. The excess data overwrites neighboring memory, which can result in crashes or allow the attacker to execute arbitrary code. SQL injection and XSS target web application input handling, while directory traversal manipulates file-system paths; none of these involve overrunning a memory buffer.

A jump server, also known as a jump host or bastion host, is a hardened server that acts as a secure intermediary and single point of entry for administrators to connect to other devices in a separate security zone. This approach centralizes access control and monitoring.

A proxy server primarily acts as an intermediary for user requests to other servers (like web servers), but it is not specifically designed for administrative access sessions. A load balancer distributes incoming traffic across multiple servers to improve availability and performance but does not serve as a secure administrative gateway. A VPN concentrator is used to establish secure, encrypted tunnels for remote access, but it typically provides broader network-level access rather than the specific, audited host-to-host administrative access that a jump server provides.

Role-Based Access Control (RBAC) is being implemented. This model grants or denies access based on the roles or groups assigned to users. In this scenario, the 'Marketing', 'Developers', and 'Executives' groups are the roles that determine access rights.

Discretionary Access Control (DAC) is incorrect because it allows the owner of the resource to grant access at their discretion, rather than relying on predefined group-based permissions.

Mandatory Access Control (MAC) is incorrect because it is a stricter model that uses security labels (like 'Confidential' or 'Secret') assigned to both users and resources, which are enforced by the system. It is not based on user-defined groups or roles.

Attribute-Based Access Control (ABAC) is incorrect because it uses a more dynamic set of rules based on attributes of the user, resource, and environment (like time of day or location), not just a user's role or group membership.

An expedited reaction time is significant because it minimizes the window of opportunity for an attacker to cause damage or exfiltrate data. This directly corresponds to limiting the severity of the incident, preserving organizational resources, and protecting sensitive information. Ensuring a rapid response is fundamental to effective incident management, aligning with the objectives of maintaining operational resiliency.

An expansionary risk appetite indicates a willingness to accept higher levels of risk in pursuit of significant rewards or growth opportunities. This aligns with the organization's strategy to pursue aggressive growth. A conservative risk appetite involves minimizing risk and focusing on stability, which does not fit the scenario. A neutral risk appetite represents a moderate approach to risk, neither seeking high risk nor avoiding it entirely. Risk avoidance is a strategy where all risks are eliminated, which contradicts the organization's acceptance of higher risks.

Typosquatting relies on users making mistakes while typing a URL, leading them to land on a malicious site that mimics a legitimate one. Once the user visits the fake website, the threat actor can execute various malicious activities including malware infection. Incorrect spelling variants in URLs are a hallmark of this technique, therefore, visiting a website with a misspelled URL that resulted in these symptoms indicates a typosquatting attack. Misdirecting and phishing attempts, while also deceptive, typically involve more direct interaction, such as fake emails or links, not the accidental misspelling of a URL. Similarly, domain kiting and domain slamming are related to domain registration practices, not user typos.

An Acceptable Use Policy (AUP) provides a set of rules and guidelines that outline how the organization's assets and network resources should be used. It helps to ensure that employees and other stakeholders are aware of what constitutes appropriate and inappropriate use, thereby protecting the organization from various risks associated with misuse. The other options listed do not directly address the specific need for governing the use of organizational assets and network resources.

Physical access controls are measures designed to restrict entry to physical areas like data centers. The recommended solutions, such as biometric scanners, mantraps, and security guards, are all examples of physical controls. Logical access controls refer to software-based mechanisms like passwords, firewalls, and access control lists (ACLs) that protect data and systems. Administrative controls are policies and procedures, such as security awareness training and personnel background checks. Perimeter controls can refer to the physical perimeter (fences) or network perimeter (firewalls), but 'physical controls' is the specific category for controlling entry into a room.

Including detailed security requirements during procurement ensures that controls are built into the service design and contract, binding the vendor to those obligations and reducing risk from the outset. Retrofitting security after deployment is typically more costly and leaves the organization exposed to avoidable threats while changes are made.

Efficiency/time saving is considered a primary benefit of automation in security operations because repetitive tasks execute much faster and with fewer errors, allowing staff to focus on higher-value investigative work. Complexity is actually an implementation challenge, cost savings are possible but not guaranteed once tooling and maintenance are included, and automation does not inherently distribute risk across the organization.

This scenario illustrates a race condition, where the attacker exploits the timing discrepancy between checking the account balance and processing the withdrawal. By initiating multiple withdrawals in quick succession, the attacker takes advantage of the window where the balance hasn't been updated yet.

Risk acceptance is the risk management strategy where a risk to an asset is accepted and no action is taken. This usually happens when the cost to mitigate the risk is more than the loss that would occur in the event the risk materializes.