CompTIA Security+ Practice Test (SY0-701)

The correct answer is Hacktivist. Hacktivists are often motivated by philosophical or political beliefs, which lead them to target organizations or governments that they perceive as acting against their values or agendas. The nature of these attacks, including website defacements and public message spreads, are typical of hacktivist groups that aim to broadcast a political message or to create awareness about their cause. The other options listed do not align as closely with the details given.

A configuration audit specifically assesses configurations against established security baselines and policies, ensuring that systems are compliant with the required security settings. This would detect deviations in access control policies and configurations from the standard across servers. A performance audit, while it assesses the efficiency and effectiveness of an organization's processes, would not focus solely on security settings and policies. A financial audit is concerned with the financial accounts and transactions of an organization, and while an operational audit evaluates the operational aspects of an organization, it does not concentrate on access control policies and system configurations to the extent necessary for the given task.

The symptoms point to DNS hijacking. By compromising the organization's domain-registrar or authoritative DNS settings, the attackers redirected the company's domain away from its legitimate web servers. Because the web servers are still functioning and no suspicious logins are recorded, the problem lies with the DNS records, not the host itself. Man-in-the-middle, session hijacking, and cross-site scripting would not make the site completely unreachable or allow the attackers to demand a ransom for restoring access to the entire domain.

A Security Information and Event Management (SIEM) solution centrally collects, stores, and analyzes log and event data from many devices, applies correlation rules, and generates alerts, enabling faster, more accurate incident detection. Threat-intelligence platforms focus on aggregating external threat feeds rather than internal event correlation; network protocol analyzers (sniffers) capture raw packets for troubleshooting but do not perform multi-source event analytics; compliance reporting tools generate regulatory reports and lack real-time correlation features.

The correct answer is Attack surface. The attack surface encompasses all possible points where an attacker could attempt to access or extract data from a system. By identifying and minimizing the attack surface, organizations can reduce the risk of security breaches.

• Security perimeter refers to the boundary that separates the protected environment from the outside world.
• Defense in depth is a layered security approach that implements multiple security measures.
• Risk exposure pertains to the potential loss resulting from threats exploiting vulnerabilities, not the vulnerabilities themselves.

The scenario describes a threat to data that is stored on physical media (hard drives), which is known as 'data at rest'. Therefore, implementing data at rest encryption is the appropriate control to ensure the data is unreadable if the drives are stolen. Data in transit encryption protects data as it moves over a network, which does not apply to stolen physical media. Data in use encryption protects data while it is being actively processed in memory (RAM), not while it is stored on a disk. Data masking is a technique used to substitute sensitive data with fictitious data, typically for development or testing, and it does not protect the original source data files from being read if they are stolen.

When an existing security control is found to not mitigate risk down to an acceptable level, a compensating control can be used to bring the risk to the desired level.

When a penetration test is black box testing no prior knowledge is given to the testers. They go into the test with a completely unknown environment.

A collision attack occurs when an attacker finds two distinct inputs that hash to the same output. This undermines the uniqueness property of a hash function, which is critical for tasks like verifying the integrity of data or digital signatures. Downgrade attacks involve forcing a system to abandon a higher security level in favor of a lower, less secure state. Birthday attacks exploit the mathematics behind the birthday problem in probability theory to find collisions in hash functions, but do not necessarily find two distinct inputs that produce the same hash output; they are just more likely to find a collision given a certain number of attempts. Collision attacks directly find the two distinct inputs.

Security awareness training educates personnel about corporate security policies, common threats, and safe practices. By making employees aware of their responsibilities and the consequences of non-compliance, organizations see higher adherence to security policies and procedures. Training does not eliminate the need for technical controls, guarantee perfect security, or shift responsibility to a single department; instead, it complements other controls by improving human behavior and reducing policy violations.

A logic bomb remains dormant until a predefined condition-such as a specific date, time, system state, or user action-is met, at which point it executes its malicious payload. It does not replicate like a worm, continuously collect keystrokes like a keylogger, or immediately encrypt files for ransom. Its defining feature is conditional activation.

The correct answer is 'Microservices' because this pattern organizes an application as a suite of small, independently deployable services that communicate through lightweight mechanisms and are each built around a distinct business capability. Monolithic architecture combines all components into one tightly coupled application, Function as a Service focuses on single event-driven functions within a serverless platform, and Service-Oriented Architecture refers to a broader, service-based integration approach that does not necessarily require fine-grained, independently deployable services.

Best practice requires that every change to a production system be routed through the organization's documented change-management process. Even though minor or "standard" changes may follow a streamlined or pre-approved workflow, they must still be logged, evaluated for risk, and retained in change records so that the environment can be audited, problems traced, and rollbacks performed if necessary. Allowing any change-no matter how small-to bypass documentation undermines accountability and can introduce hidden vulnerabilities.

Phishing involves sending deceptive messages, like instant messages, to trick individuals into revealing sensitive information such as login credentials. In this scenario, the attacker impersonates a senior executive to gain trust and elicit the employee's credentials, which is characteristic of a phishing attack. Vishing refers to phishing conducted via voice calls, Denial-of-Service attacks aim to disrupt service availability, and Man-in-the-Middle attacks involve intercepting communications between two parties without their knowledge.

The correct statement is that the company must comply with a complex mix of sector-specific and region-specific regulations. For instance, its healthcare operations in the U.S. would be subject to the Health Insurance Portability and Accountability Act (HIPAA), while its financial services would need to comply with the Gramm-Leach-Bliley Act (GLBA). Retail operations handling payment cards must adhere to the Payment Card Industry Data Security Standard (PCI DSS). Furthermore, because the company deals with data from European citizens, it must comply with the General Data Protection Regulation (GDPR), which has extraterritorial scope. Regulations are not uniform; they are tailored to specific industries and geographical locations. Adhering only to the strictest regulation or the laws of the headquarters' country is insufficient, and ISO 27001 is a framework, not a replacement for legal statutes.

Encrypting data in transit is the most effective measure because it prevents unauthorized parties from intercepting and reading health information as it travels over the network. Data masking mainly protects data in storage or non-production environments, geographic restrictions primarily address legal or compliance boundaries, and multi-factor authentication verifies user identity but does not protect the content of data packets during transmission.

Implementing network segmentation and limiting the legacy system's connectivity to essential services is the correct answer. This approach reduces the risk of attacks from both internal and external threat vectors, as it would prevent the potentially compromised system from affecting unrelated parts of the network. While increasing security monitoring is a useful tactic, it does not directly mitigate the exposure of the legacy system to threats. Conducting regular security audits on the system is a good practice, but it does not provide real-time protection against threats. Encouraging the use of strong passwords is important but does not address the specific risks associated with an unsupported operating system.

The term 'Workforce multiplier' refers to methods and tools that extend the effectiveness and efficiency of a security team, enabling them to handle more work with fewer resources. This is crucial for modern security operations where the volume of threats and alerts can be overwhelming for small teams. By using automation, orchestration, and other advanced tools, even a limited staff can effectively manage and secure a large set of resources.

Traffic-flow metadata-such as timestamps, source and destination IP addresses, and port numbers-directly aligns network conversations with IDS alert times, making it the most effective data set for correlation. Logs of user account changes, device configuration files, and application error messages provide context but do not map cleanly to specific network sessions, so they are less helpful for time-based traffic correlation.

A logic bomb is a type of malware that is designed to execute a malicious action when certain conditions are met, such as a specific time or event. The recurring nature of the incident every Friday suggests that it is triggered by a time-based event, characteristic of a logic bomb. Other types of malware like Trojans, worms, or spyware do not have this inherent behavior tied to a specific condition and typically execute or propagate without a specific trigger event.