CompTIA Security+ Practice Test (SY0-701)

Managerial controls are designed to establish security policies, procedures, and guidelines within an organization. They help in the strategic alignment of security practices with business operations and in ensuring that organizational security objectives are met. They are essential for the governance of security within the company.

Technical controls, on the other hand, involve the use of technology to enforce security measures, such as firewalls and encryption. Operational controls are more about implementing and maintaining day-to-day security tasks. Physical controls include tangible measures like locks, biometrics, and surveillance systems.

Including a recognized severity scoring system such as the Common Vulnerability Scoring System provides an objective measure of how serious each vulnerability is, allowing management to compare issues consistently and focus remediation on the highest-risk items first. Categorizing by network segment or operating system helps with organization but does not directly quantify risk. Concentrating only on vulnerabilities already exploited in the wild highlights immediate threats but may overlook new, highly critical issues that lack published exploits. Therefore, a standardized severity rating is the most effective tool for overall risk prioritization.

This security measure is insufficient because client-side restrictions, such as using a drop-down menu, can be bypassed. An attacker can use a tool like a web proxy to intercept the HTTP request after it is sent from the browser and modify the value for the 'country' parameter to a malicious SQL string before it reaches the server. Therefore, all input must be validated and sanitized on the server-side, and parameterized queries should be used to prevent SQL injection.

A self-signed certificate is the most appropriate choice for this scenario. Since the server is for internal testing only, public trust from a third-party CA is not required. A self-signed certificate provides the necessary encryption for HTTPS traffic within this closed environment without incurring costs or requiring an external validation process. Wildcard, Extended Validation (EV), and Domain Validation (DV) certificates are all types issued by a trusted third-party CA and are intended for use on public-facing servers where establishing trust for external users is essential.

Risk threshold sets the measurable boundary between acceptable and unacceptable risk. When exposure rises above this threshold, the organization must treat, transfer, avoid, or otherwise address the risk.

• Risk appetite is the broad, overall level of risk an organization is willing to pursue or retain.
• Risk tolerance defines the amount of variation from objectives that can be absorbed for individual risks.
• A key risk indicator (KRI) is a metric that signals increasing or decreasing risk but does not set the boundary itself.

A next-generation firewall (NGFW) combines traditional stateful packet inspection with application awareness and an embedded intrusion prevention system (IPS). This allows the device to identify, block, and log malicious traffic in real time. WAFs specialize in HTTP/S protection, Layer 7 firewalls add deep packet inspection but may lack a full IPS, and basic Layer 4 firewalls are limited to port- and protocol-based filtering.

Role based access control (RBAC) is an access control scheme that controls access and permissions by assigning them based on roles. Individuals are assigned roles which grants them the permissions and access assigned to that role(s).

Knowing the likelihood of a threat exploiting a vulnerability directly informs the probability of a security incident. It provides a measure of how often a threat could succeed, given the opportunity, which is essential for risk assessment in order to prioritize actions and resource allocation. Historical data and trend analysis could also support this assessment by looking at past occurrences, but they are secondary to understanding the current likelihood. Vendor-provided statistics and geographic location data might have some impact on probability; however, without the specific context of likelihood, they provide less direct information for assessing the probability of an incident.

'Impossible travel' refers to a situation where a user account is accessed from geographically distant locations within a timeframe that is too short for normal travel to occur, suggesting the use of compromised credentials. This is an important red flag for security analysts as it may indicate an account takeover by an unauthorized user. In contrast, 'Concurrent session usage' may raise concern but does not imply physical impossibility, 'Account lockout' is a response to suspicious activities and itself is not an indicator, and 'Time-of-check (TOC)' relates to a specific vulnerability type concerning the timing of security checks.

Logic bombs are covert code segments inserted into legitimate software that remain dormant until a predefined condition-such as a particular date, system event, or absence of a file-is met. When the trigger occurs, the bomb executes its destructive payload, like deleting records. Ransomware demands payment, Trojan horses disguise themselves to gain access, and spyware surreptitiously collects information; none rely solely on a conditional time-based trigger.

Legacy hardware frequently runs unsupported operating systems or firmware that no longer receive security patches. Because known vulnerabilities remain uncorrected and modern security controls (such as endpoint detection, strong authentication, or encryption) are often absent, attackers can exploit these weaknesses with minimal effort. In many organizations these older systems still process critical data, so a successful compromise can yield high value to the attacker. Therefore, the lure for cybercriminals is the combination of easier exploitation and potentially lucrative data or disruption.

The practice described is known as Infrastructure as Code, where infrastructure management tasks are automated through human-readable definition files. A crucial security practice to incorporate in this method is the use of source control management to maintain the integrity and versioning of the infrastructure code. This includes implementing commit policies, review processes, and potentially automated security testing to prevent unauthorized or malicious alterations that could lead to security breaches.

Likelihood refers to the probability that a potential vulnerability could be exploited by a threat actor within a given time frame. Calculating likelihood involves evaluating how exposed the vulnerability is, the presence and capabilities of threat actors, the effectiveness of current controls, and the historical data of security incidents similar to the one being assessed. While options such as evaluating the impact of the threat and considering the cost of potential security controls are also parts of risk assessment, they do not directly relate to the determination of likelihood.

The network administrator's preference is indicative of the Discretionary Access Control (DAC) model, where resource owners have the freedom to provide or restrict access to other users at their discretion. While Role-Based Access Control (RBAC) autonomously assigns permissions based on the user's role and does not cater to individual resource owner preferences, it is not the best fit for the scenario described. Similarly, Rule-Based Access Control typically works alongside other mechanisms, applying rules (like time-of-day restrictions) that do not relate to individual owner discretion. The Mandatory Access Control (MAC) model enforces access decisions made by a central authority based on security labels, not by individual resource owners, and is thus also not suitable for this situation.

Regular self-assessments allow an organization to measure and analyze the effectiveness, efficiency, and compliance of its security governance against internal standards and regulatory requirements. This proactive approach serves to identify gaps or weaknesses before they can be exploited, providing an opportunity for improvements and risk mitigation strategies to be implemented. Assessments focused only on technology do not capture the full scope of security governance, and limiting assessments to after an incident occurs would not provide the proactive benefits of regular, preemptive analysis and adjustments.

When a penetration test is black box testing no prior knowledge is given to the testers. They go into the test with a completely unknown environment.

The bulk data that flows after a secure session has been established is encrypted with symmetric algorithms (for example, AES or ChaCha20). Asymmetric algorithms (such as RSA or ECDHE) are used only during the handshake to authenticate the parties and to agree on a shared secret. Hashing algorithms provide integrity, and key-stretching algorithms strengthen stored secrets but do not directly encrypt transit traffic.

The correct choice is a Next-Generation Firewall (NGFW). NGFWs are advanced firewalls that operate up to Layer 7 (the application layer) of the OSI model. Unlike traditional firewalls that are limited to inspecting traffic based on ports and IP addresses (Layers 3 and 4), NGFWs can perform deep packet inspection (DPI) to identify the specific applications in use and enforce security policies on them. They also integrate other security features like an intrusion prevention system (IPS) to block application-layer attacks. Stateless and stateful firewalls are older technologies that lack this deep application awareness. A circuit-level gateway operates at the session layer (Layer 5) and does not inspect application content.

The correct answer is 'Regulations'. Regulations are specific, enforceable requirements laid down by governmental authorities, and organizations must adhere to them to ensure compliance within various domains, including data protection and privacy. 'Guidelines' offer advice or suggestions but are not legally enforceable. 'Frameworks' provide a structured approach to addressing complex issues but also lack the force of law. While 'Mandates' require action, the term is broad and may not necessarily pertain to legally enforceable directives from a government body in the way 'regulations' do.

The correct answer is 'Internal'. 'Internal' data is information intended for circulation only within an organization and is not meant for public release. 'Public' data can be shared with anyone without restriction. 'Confidential' data is sensitive information that is typically restricted to specific teams or authorized individuals. 'Restricted' data is the most sensitive category, requiring strict access controls, as its unauthorized disclosure could cause significant harm to the organization.