CompTIA Security+ Practice Test (SY0-701)

The primary role of a generator in the security architecture of a data center is to provide backup power in the event that the main power supply fails. This ensures that critical systems remain operational during power outages, thus maintaining high availability and preventing potential security breaches that could occur due to system downtime.

OAuth enables a user to grant a third-party application scoped access by issuing an access token through the platform's authorization server. Because the token, not the user's password, is presented in subsequent API calls, the user's credentials remain undisclosed. Methods that embed or transmit passwords-whether stored locally, hard-coded, or sent with basic authentication-violate least-privilege and credential-handling best practices and are therefore less secure.

A Virtual Local Area Network (VLAN) provides a logical or virtual way to separate areas of a network. This means devices can physically share the same network infrastructure (e.g. using a common switch) but remain separated from each other on the network.

A honeypot is an intentionally vulnerable, stand-alone system or service that appears legitimate to threat actors. Any interaction with it is automatically suspicious, allowing defenders to record, analyze, and learn from attacker activity without exposing production assets. A honeynet is a larger collection of multiple honeypots that emulates an entire network. A honeyfile is a single decoy document placed to detect unauthorized access, and a honeytoken is a small piece of fake data (such as bogus credentials) embedded in real systems for the same purpose. These alternatives are also forms of deception, but none of them is a single decoy system.

A hot site is an exact or near-exact replica of the primary site. It contains all necessary hardware, software, and near-real-time copies of data, allowing the organization to fail over and resume operations almost immediately. A warm site has only some infrastructure and typically requires additional configuration and data restoration before it can take over. A cold site provides only basic power and environmental controls with no pre-installed systems, resulting in the longest recovery time. A mobile site is a temporary facility that also requires additional setup before becoming fully operational.

When a password policy specifies an expiration period, this means that the user is required to change their password after the set period of time has elapsed. This is done to reduce the risk of unauthorized access from compromised passwords over time. It is a precautionary measure to prompt users to regularly update their passwords, potentially preventing continued access by a malicious actor who has obtained an old password. Password expiration is less about the strength of the individual password and more about limiting the window of opportunity for its misuse.

A Distributed Denial-of-Service (DDoS) attack is a cyber-attack in which multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers, causing a drastic spike in resource consumption. This can overwhelm the system, leading to slowdowns or complete denial of service. In contrast, phishing and social engineering attacks primarily focus on deception to gain information, and they do not typically result in excessive resource consumption. Email spam may consume resources, but it is typically not as impactful as a coordinated DDoS attack that targets and exhausts system resources.

Removing or disabling all nonessential services and applications is a fundamental hardening practice for any operating system and is explicitly recommended for RTOS devices. Limiting functionality to only what the device requires eliminates unnecessary listening ports and code paths that attackers could exploit.

• Allowing unrestricted traffic (choice B) widens, rather than reduces, the attack surface.
• Enabling remote debugging (choice C) leaves powerful interfaces exposed to attackers.
• Running every process with administrative privileges (choice D) violates least-privilege principles and increases potential damage from a compromise.

Phishing involves sending deceptive messages, like instant messages, to trick individuals into revealing sensitive information such as login credentials. In this scenario, the attacker impersonates a senior executive to gain trust and elicit the employee's credentials, which is characteristic of a phishing attack. Vishing refers to phishing conducted via voice calls, Denial-of-Service attacks aim to disrupt service availability, and Man-in-the-Middle attacks involve intercepting communications between two parties without their knowledge.

A Unified Threat Management (UTM) appliance is the correct answer because it is an all-in-one security solution that consolidates multiple security functions into a single device. This typically includes a firewall, intrusion prevention system (IPS), antivirus/anti-malware, content filtering, and VPN capabilities. A Next-Generation Firewall (NGFW) has many overlapping features but is generally considered a more enterprise-grade product focused on deep packet inspection and application control. A Web Application Firewall (WAF) is specifically designed to protect web applications from Layer 7 attacks, not to be an all-in-one network security device. A proxy server primarily forwards user requests to the internet and can provide content filtering and caching, but it does not encompass the broad range of security features found in a UTM.

An employee unknowingly installing malware on their workstation after believing they are updating legitimate software best represents an unintentional security risk. Unlike intentional actions that are derived from malicious intent, unintentional risks are often due to lack of awareness or mistakes made without malice. The employee did not intend to harm the company but did so by mistake. The other options involve deliberate actions and do not exemplify an unintentional security risk.

Process hollowing starts a legitimate process (for example, explorer.exe) in a suspended state, removes (unmaps) the original code from its address space, writes the attacker's payload into the now-empty memory region, adjusts the thread context to point to the malicious entry point, and then resumes the thread. Because the process appears to be a normal signed executable, many security tools that only inspect new process creation events can be bypassed. DLL injection (choice B) and IAT hooking (choice C) modify a running process in different ways, while in-memory obfuscation (choice D) changes how code is stored, not where it runs.

Risk transfer is characterized by shifting the financial burden of a risk to another entity. Obtaining a cybersecurity insurance policy effectively transfers the financial risk of a cyber attack to the insurance company. Adjusting security controls to enhance detection would be an example of mitigation, which aims at reducing the risk's probability or impact. Developing a response strategy falls under preparedness and mitigation, as it prepares the organization to handle the impact, but does not transfer the risk. Lastly, training employees is a preventive measure and also falls into risk mitigation; it does not transfer the risk.

A Data Loss Prevention (DLP) system is implemented within an organization to ensure that sensitive information does not exit the corporate network in an unauthorized manner. It monitors, detects, and blocks the flow of data to prevent data breaches. Whereas an Intrusion Prevention System (IPS) is primarily used to identify and prevent known threats from affecting a network, and a Firewall provides a barrier between trusted and untrusted networks. Antivirus software is used to prevent, detect, and remove malware.

When hardware reaches end-of-life, the vendor stops releasing firmware or driver updates, including security patches. Any publicly known or newly discovered vulnerability therefore remains unpatched and can be exploited by threat actors, turning the outdated hardware into an easy entry point for attacks. Organizations must plan to replace or isolate such assets to maintain a secure posture.

In a corporate-owned, personally enabled (COPE) model, the company purchases and owns the devices, but allows employees to use them for both personal and business activities. This contrasts with a Bring Your Own Device (BYOD) model, where employees use their personally-owned devices for work. A Choose Your Own Device (CYOD) model allows an employee to select a device from a company-approved list, which the company then provides to them. POCE is not a standard industry term for a mobile deployment model.

An Intrusion Detection System monitors network or host activity and generates alerts when suspicious behavior is detected. Because it identifies potential incidents rather than blocking or remediating them, it is categorized as a detective control. Preventive controls (e.g., firewalls) attempt to stop incidents, corrective controls focus on recovery, and deterrent controls primarily discourage attackers.

The correct set of permissions adheres to the principle of least privilege. The accounting department's requirement to 'add and edit files' is best met with the 'Write' permission. The auditing and sales departments' requirement to 'review the contents' is met with the 'Read' permission. Using 'Read & execute' would be excessive for the auditing and sales teams as there is no requirement to run programs from the share. Granting 'Modify' or 'Full control' to the accounting department would also violate least privilege, as these permissions include rights (like deletion or changing permissions) that were not specified in the requirements.

The correct answer ensures that only the VPN network (10.200.0.0/16) is allowed access to the internal database servers while all other external IP addresses are blocked. The rule ‘Deny from all, Allow from 10.200.0.0/16’ follows the principle of least privilege by denying access by default and only allowing a specific range. Other answers are incorrect because they either permit more access than the security policy allows or because the IP range specified does not match the VPN network's IP range, thus potentially providing access to unauthorized users or entirely blocking legitimate access.

Placing the IPS directly behind (internal to) the external firewall allows the firewall to drop obviously disallowed traffic first, so the IPS only analyzes traffic that has already met basic policy rules. This reduces the IPS workload, decreases false positives, and still stops threats before they can reach internal routers, switches, and hosts. Positioning the IPS outside the firewall forces it to inspect all Internet noise, while placing it deep inside the LAN or only at a datacenter ingress leaves gaps during initial ingress and can overwhelm the sensor with east-west traffic.