CompTIA Security+ Practice Test (SY0-701)

Regular self-assessments allow an organization to measure and analyze the effectiveness, efficiency, and compliance of its security governance against internal standards and regulatory requirements. This proactive approach serves to identify gaps or weaknesses before they can be exploited, providing an opportunity for improvements and risk mitigation strategies to be implemented. Assessments focused only on technology do not capture the full scope of security governance, and limiting assessments to after an incident occurs would not provide the proactive benefits of regular, preemptive analysis and adjustments.

As you are scanning the live/production system a non-intrusive scan is best. Non-intrusive means security issues will be identified but not exploited as to not negatively impact the system. The issue with this is some vulnerabilities cannot be found without trying an exploit (e.g. a SQL injection to delete data can't be tested without actually deleting data). Due to this the scenario described in the question is not ideal and it's possible vulnerabilities that exist will not be found.

A Hardware Security Module (HSM) is a dedicated hardware device designed to securely generate, store, and manage cryptographic keys and perform cryptographic operations. By offloading these tasks from servers, HSMs improve both security and performance in enterprise environments.

A TPM is a hardware chip embedded on a computer's motherboard, primarily used to store cryptographic keys and ensure platform integrity, but it's not designed to offload cryptographic processing from servers.

A Secure Enclave is a secure area within a processor for executing sensitive code, commonly found in mobile devices; it does not function as a separate hardware device for server cryptographic operations.

A Key Management System typically refers to software solutions for managing cryptographic keys' lifecycle but does not provide hardware-based processing capabilities.

The correct answer 'Password length of 16 mixed characters with no dictionary words' embodies multiple best practices for password security, including a long length and the avoidance of dictionary words which can be susceptible to dictionary attacks. Using common keyboard paths (like 'qwerty') provides patterns that can be easily exploited, and relying solely on length without considering the use of mixed character types or avoiding common words can still lead to vulnerabilities. While having a password expiration policy can be a beneficial security practice, without further context of password complexity requirements, it does not inherently guarantee a high level of security.

Signature updates in an IDS/IPS are vital to maintain the system's effectiveness against new threats. As attack methodologies evolve, the system must be updated with information about these new threats to accurately detect and potentially prevent them. Novel software updates would pertain to general software enhancements rather than threat intelligence. Configuration changes may improve system performance but do not directly relate to new threat intelligence. Rule adjustments generally involve customizing how the system responds to detected threats, not updating its threat detection capabilities.

This scenario describes a race condition, specifically a Time-of-check to Time-of-use (TOCTOU) vulnerability. The application checks a condition (the account balance) at one point in time but uses the result of that check at a later point. An attacker can exploit the delay between the check and the use to change the state (in this case, by initiating another withdrawal), leading to unexpected and insecure behavior like withdrawing more money than is available in the account.

Infrared is the only option that uses light as a communication medium. 802.11 (the standard for WLAN), Near Field Communication (NFC) & Bluetooth all use Radio Frequencies. Infrared is best for the type of device in the question as it requires line of sight to operate. When LOS is broken the device will register a person in the entrance.

For devices that are often off the company's network, a client-based solution, which involves installing an agent on each device, is most effective. This agent can perform vulnerability assessments independently of the device's network connection. Agentless solutions, on the other hand, require that devices be connected to the network for assessments to occur, which is not practical for a mobile workforce.

Regulated data is subject to statutes or industry frameworks that prescribe how it must be secured (for example, HIPAA, FERPA, GDPR, or PCI-DSS). Because non-compliance can trigger fines and legal liability, organizations must implement controls such as encryption, strict access control, and auditing. Other data types like trade secrets or intellectual property may be highly valuable but are not dictated by external regulations in the same way.

The correct action is to perform a follow-up vulnerability scan. Rescanning is an essential step to verify that the applied patches have successfully remediated the identified vulnerabilities and to ensure that no new vulnerabilities were introduced in the process. Reviewing event logs, rebooting the server, and documenting the changes are all plausible activities, but they do not directly validate that the security flaw has been eliminated. Documentation is a procedural step, and rebooting is part of the patching process itself, not the validation phase.

The attackers are driven by their ideological differences with the corporation's environmental practices. This is a case of philosophical or political beliefs motivating cyber attacks. They are not seeking financial gain, engaging in blackmail, or attempting to steal data.

Password spraying is a technique used by attackers where they try common passwords against many different accounts to find a match. They do this without triggering the account's lockout policy as they do not make too many attempts on a single account. It differs from brute force attacks which generally try many password combinations on one account, potentially triggering lockout mechanisms.

Auditing gathers evidence after the fact by reviewing log and permission data to uncover unauthorized access or policy violations. Because it identifies issues that have already occurred, its chief purpose is detection, not prevention, correction, or deterrence. Therefore, it is categorized as a detective control.

Containerization provides a lightweight alternative to full virtualization by encapsulating an application in a container with its own operating environment. This isolation ensures that applications do not interfere with each other and can be managed independently, enhancing security by containing potential breaches within the isolated environment of the container.

A jump server, also known as a jump host or bastion host, is a hardened server that acts as a secure intermediary and single point of entry for administrators to connect to other devices in a separate security zone. This approach centralizes access control and monitoring.

A proxy server primarily acts as an intermediary for user requests to other servers (like web servers), but it is not specifically designed for administrative access sessions. A load balancer distributes incoming traffic across multiple servers to improve availability and performance but does not serve as a secure administrative gateway. A VPN concentrator is used to establish secure, encrypted tunnels for remote access, but it typically provides broader network-level access rather than the specific, audited host-to-host administrative access that a jump server provides.

This type of security flaw is categorized as a vulnerability that allows unauthorized code execution remotely, typically without the need for user interaction, which is a hallmark characteristic of vulnerabilities that allow execution of arbitrary code on a victim's system. 'Injection' is incorrect since it generally refers to inserting untrusted input into a program, such as SQL injection, which may lead to data leaks rather than code execution. 'Denial of Service' focuses on making resources unavailable to legitimate users, and while it can be a serious issue, it does not involve unauthorized code execution. 'Man-in-the-Middle' is not a vulnerability classification but a type of attack that involves intercepting and possibly altering communications between two parties without their knowledge.

Implementing an air-gapped network means these critical systems are physically disconnected from any other networks and the internet, providing the highest level of isolation. This prevents remote access and network-based attacks. While using VLANs, firewalls, or NAT can enhance security through logical segmentation and filtering, they do not offer the same level of isolation because the systems remain connected to other networks, potentially exposing them to threats.

When an existing security control is found to not mitigate risk down to an acceptable level, a compensating control can be used to bring the risk to the desired level.

While architectural blueprints are useful for an initial predictive survey, they do not provide information about potential radio frequency (RF) interference, the signal attenuation properties of various building materials, or other environmental factors. A physical site survey is essential to identify sources of interference (like neighboring networks, microwave ovens, or industrial equipment), discover unexpected physical obstructions, and measure actual signal propagation. This allows for the strategic placement of access points to ensure comprehensive coverage, strong signal strength, and a secure and reliable network, which cannot be guaranteed by blueprints alone.

The correct rule to block unencrypted web traffic (HTTP) is deny tcp any host 10.10.5.25 eq 80. This rule correctly identifies the 'deny' action, the 'tcp' protocol used by HTTP, any source address ('any'), the specific destination server ('host 10.10.5.25'), and the correct destination port for HTTP ('eq 80'). The other options are incorrect because they either block the wrong port (443 for HTTPS), use the wrong protocol (UDP), or perform the wrong action (allow).