CompTIA Security+ Practice Test (SY0-701)

Security Information and Event Management (SIEM) systems are used to centralize logging and alerting from various types of network devices. Common functionalities include data aggregation, alerting, forensic analysis and data retention/compliance. They are most commonly found in mid-size to larger networks where there are too many devices to monitor separately.

Resilience is the capacity of a system to maintain its intended function when individual hardware or software components fail. By contrast, backup frequency concerns data protection schedules, encryption focuses on confidentiality during transit, and geographic redundancy is a specific strategy-one of many-that can contribute to resilience but does not define the overarching concept.

The goal is to meet or exceed every region's regulatory requirements with one consistent control set. Adopting the strictest applicable encryption standard ensures global compliance and establishes the highest security baseline enterprise-wide. Creating an entirely new internal standard that only meets minimum requirements, following headquarters-only rules, or choosing the least-restrictive regional standard would leave some locations out of compliance and increase legal and operational risk.

By adding unique data to each password before hashing, the engineer ensures that identical passwords produce different hash values. This method, known as salting, enhances security by preventing attackers from recognizing duplicate passwords through identical hashes. Using different hashing algorithms for each user is impractical and doesn't scale well. Implementing asymmetric encryption is not standard practice for password storage and doesn't solve the problem of identical hashes from identical passwords. Storing passwords in plain text is inherently insecure and should be avoided.

Regularly reviewing and updating policies and controls is the correct answer because it allows an organization to address new threats and changes in the operational environment. It ensures that the policies and controls continue to be relevant and effective. While employee training, installing antivirus software, and limiting user privileges are important security practices, they do not directly ensure that policies and controls are kept up-to-date with the current threat landscape.

Federation is the practice of linking a user's electronic identity and attributes, stored across multiple distinct identity management systems. Implementing a federated identity management system would be ideal in this situation as it enables the company's employees to use their existing corporate credentials to access the third-party service provider's resources securely. This negates the need for multiple credentials and simplifies the authentication process for users, which directly aligns with the scenario's requirements of minimizing complexity and offering a streamlined process.

Creating additional user credentials for each employee within the partner's system and relying on a central access policy that governs the usage of applications across both entities, are less efficient solutions that increase complexity and management overhead, which does not fulfill the specified criteria of streamlined access. The web authentication standard accentuates a specific method of authentication that can be utilized in federated environments but does not represent the overarching federated identity management system needed here.

A firewall is a technical control designed to monitor and control incoming and outgoing network traffic based on predetermined security rules, acting as a barrier between a trusted internal network and an untrusted external network. Security awareness training is a managerial control, fencing is a physical control, and an incident response plan is an operational and corrective control.

The most effective control in this scenario is multifactor authentication (MFA). MFA requires more than just a password to authenticate, so even if an attacker steals a user's password, they cannot access the account without the second factor (e.g., a token, biometric scan, or push notification). A strong password policy is a good practice, but it is defeated once the password is stolen. Applying the latest security patches is crucial for preventing vulnerability exploitation but does not stop an attacker from using valid, stolen credentials. A host-based firewall controls network access but does not prevent a legitimate-looking authentication attempt with a stolen password from a permitted location.

Static code analysis is most beneficial because it allows developers to find vulnerabilities and issues in code before the application is run or compiled. This 'shift-left' approach to security is proactive and can save time and resources by catching flaws early. While static code analysis tools can enforce coding standards and improve code quality, their primary security benefit is identifying vulnerabilities that could lead to exploits.

Federated identity management allows a user's identity, authenticated in one security domain, to be accepted in other security domains. It often employs protocols like SAML and OpenID, enabling Single Sign-On (SSO) capabilities across different organizations or services. Discretionary Access Control (DAC) gives the owner of the resource the control to decide who has access. Mandatory Access Control (MAC) is a model where access is granted based on information clearance and classifications, and is not about passing user information across security domains. Role-Based Access Control (RBAC) assigns permissions to roles instead of individual users, which isn't specifically designed for sharing authentication and authorization data across different domains.

The conductive enclosure is a Faraday cage. By blocking electromagnetic emissions, it prevents sensitive signals from being intercepted (TEMPEST/eavesdropping) and shields the equipment from external electromagnetic interference. This makes it a preventive physical control aimed at protecting the confidentiality and integrity of information-not a mechanism for detecting intrusions, regulating environmental conditions, or physically deterring forced entry.

The correct answer requires a physical object that the user must possess in order to authenticate, known as 'something you have'. Unlike knowledge-based factors ('something you know') like passwords, or inherence factors ('something you are') like biometrics, possession factors provide a tangible means of user authentication. This kind of factor can be easily demonstrated by presenting the object and, therefore, serves as a strong layer of security when used as part of multifactor authentication.

A detailed and current asset inventory is a foundational component of an effective disaster recovery plan. Without it, an organization cannot accurately prioritize which systems to restore first, understand dependencies between assets, or ensure that all necessary components are recovered. This leads to inefficient and delayed recovery efforts, potentially preventing the organization from meeting its Recovery Time Objectives (RTOs). The inventory is essential for knowing what needs to be restored to bring critical business functions back online.

Storing information with a 'Restricted' classification in a secure, access-controlled environment ensures that only authorized personnel with the necessary clearance or permissions have access to that data. Keep in mind the question is regarding physical access to the data. While encryption, logging, and secure disposal are important for the overall security posture, they do not inherently restrict access to the data to the appropriate individuals.

Nation-state actors are government-sponsored entities with substantial resources, funding, and high levels of sophistication. They are capable of developing zero-day exploits and custom malware to carry out prolonged cyber-espionage campaigns against critical infrastructure. Their motivations often include espionage, data exfiltration, and gaining strategic advantages over other nations. Other threat actors like organized crime groups or hacktivists typically lack the necessary resources or motivations to conduct such complex and targeted attacks on this scale.

Scoping involves defining the objectives, boundaries, and rules of engagement for the penetration test. This is crucial because it sets clear expectations and limitations, ensuring that the team's efforts are aligned with the organization's goals and legal requirements, thus avoiding unnecessary disruptions or legal implications.

A watering hole is a targeted cyberattack where an attacker compromises a legitimate website that members of a specific organization or industry are known to visit. By infecting the site with malware, the attackers can then infect the systems of their intended targets when they browse the site. This method leverages the trust users have in a familiar website to deliver the malicious payload.

A Security Information and Event Management (SIEM) solution centrally collects, stores, and analyzes log and event data from many devices, applies correlation rules, and generates alerts, enabling faster, more accurate incident detection. Threat-intelligence platforms focus on aggregating external threat feeds rather than internal event correlation; network protocol analyzers (sniffers) capture raw packets for troubleshooting but do not perform multi-source event analytics; compliance reporting tools generate regulatory reports and lack real-time correlation features.

These safeguards are Physical Controls because they are tangible measures-locks, guards, badge readers, surveillance systems-that protect buildings, equipment, and personnel from physical threats. Technical controls secure information through technology (e.g., firewalls, IDS), managerial controls provide policies and governance, and operational controls address routine procedures like incident response and change management. As the scenario focuses on protecting the physical premises and hardware, Physical Controls are the correct classification.

Zero Trust follows a never-trust, always-verify philosophy: it assumes that no user, device, or network traffic is trustworthy by default, even when requests originate from inside the corporate network. Least-privilege access and multi-factor authentication are important security practices often used within Zero Trust environments, but they are not the principle itself.