CompTIA Security+ Practice Test (SY0-701)

When a system is configured to be fail-closed, also known as fail-secure, it defaults to a secure state upon failure. In this state, it will deny access or block all traffic to prevent potential security breaches. This contrasts with a fail-open system, which would allow traffic to pass through, prioritizing availability over security.

Supply chain attacks usually start by breaching a trusted third-party vendor or service provider and inserting malicious code or components into software or updates that are then distributed to downstream customers. Because the update appears to originate from a legitimate, trusted source, traditional perimeter and host defenses inside the customer's environment often fail to detect the compromise. Attacks that target only an organization's internally developed code, physical theft of hardware, or direct DDoS assaults do not fit the definition of a supply chain attack.

The most appropriate type of legal contract to enforce confidentiality during preliminary negotiations is a Non-Disclosure Agreement. It legally binds the parties to keep certain shared information confidential, thereby protecting the company's proprietary information, such as trade secrets or strategic plans. While a Letter of Intent can demonstrate commitment to a deal, it does not typically bind parties to confidentiality. An Employment Agreement is used between an employer and employee and is not suitable for negotiations with a potential partner. A Master Services Agreement sets forth terms of a working relationship, typically finalized after trust has been established and does not necessarily ensure confidentiality at the initial stages of discussion.

Containers share the host's operating-system kernel. If an attacker exploits a kernel-level vulnerability or misconfiguration, the code can escape the original container's namespace and interact with the host or other containers. Virtual machines, by contrast, have their own separate kernels, so a compromise stays isolated inside that VM.

Malicious code that waits for a specific condition-such as a particular date, time, or user action-before executing its payload is called a logic bomb. The code remains dormant and unknown to authorized users until the trigger occurs. Cryptomalware and other ransomware variants encrypt data and demand payment, while a worm focuses on self-replication and propagation, not on timed destruction.

RBAC restricts what an authenticated account can see, but if the account credentials are stolen the attacker gains the same database access. Requiring multi-factor authentication (MFA) adds a second, independent factor the attacker is unlikely to possess, making stolen passwords alone insufficient. The other options improve security but do not address the stolen-credential threat as effectively: longer passwords still fail once the password is known, full-disk encryption protects only when the system is powered off, and suppressing SQL errors mainly reduces information disclosure during reconnaissance rather than blocking authenticated access.

Presenting the information that applies a recognized scoring system to assess the severity of the vulnerabilities is correct, as it gives an objective measure of risk. This enables management to make informed decisions on which vulnerabilities to address first based on the potential impact. While identification by category, operating system, or the potential for data loss can provide important context, they do not inherently offer a mechanism for prioritization. Therefore, the key to an effective report is not only identifying the vulnerabilities but also clearly indicating which ones pose the greatest risk based on a standardized severity rating.

Implementing a password manager application allows users to securely store and manage complex and unique passwords for all their accounts. This encourages the use of strong, unique passwords without the burden of memorization. Enforcing strict password policies may lead to password reuse or users writing down passwords. Single sign-on (SSO) reduces the number of passwords but does not promote unique passwords for each service. Implementing biometric authentication enhances security but doesn't address the management of multiple complex passwords.

Network logs are a primary resource for monitoring internal network traffic, which includes tracking unauthorized data flow or lateral movement within the organization's network infrastructure. Application logs are focused on specific software and may not capture network-wide traffic data. Endpoint logs give insight into individual host activity and might not show comprehensive internal traffic patterns. System health reports are typically concerned with the performance and health of systems, and do not usually provide the granular traffic data needed for tracking lateral movements.

A checksum is a sequence of numbers generated by a checksum algorithm (such as check digits and parity bits) used to validate the integrity of data by comparing a calculated checksum to a previously calculated checksum value. Matching values indicate that the data has not been changed.

Hacktivist often commit a form of doxing where they illegally access documents and release them to the public in situations where they believe that transparency is necessary.

The correct answer is the implementation of real-time threat intelligence integrated with security systems for dynamic risk assessment, which exemplifies a continuous risk assessment approach. This approach ensures immediate identification and evaluation of risks as they emerge, allowing for prompt risk management actions. The other options describe more periodic, reactionary, and infrequent methods, which do not reflect the ongoing nature inherent to continuous risk assessment.

The correct answer is 'Nation-state'. Nation-state actors possess high levels of sophistication, resources, and funding, and their motivations often include espionage, political gain, and disrupting the critical infrastructure of other nations. Attacks on power grids and water facilities are characteristic of cyber warfare campaigns intended to cause significant societal and economic harm.

• Organized crime is primarily motivated by financial gain and is more likely to use ransomware or steal data for extortion rather than cause widespread service disruption for its own sake.
• A hacktivist is typically motivated by political or social beliefs and usually conducts less sophisticated attacks like website defacement or DDoS attacks against specific organizations, lacking the resources for a large-scale infrastructure attack.
• An insider threat acts from within an organization, and while potentially disruptive, is less likely to orchestrate a widespread, coordinated attack on national critical infrastructure.

This statement is incorrect. The administrative (native) VLAN on a switch should not be left at the default which is usually VLAN 1. It is a security best practice to change the native VLAN to an unused VLAN ID to mitigate VLAN hopping attacks.

An incident response plan is a living document that must adapt to evolving threats and to lessons learned during drills and audits. Even when the environment appears static, undetected weaknesses or procedural gaps can persist. Regular reviews-through tabletop exercises, simulations, and document updates-surface these weaknesses so they can be corrected before a real incident occurs. Standards such as NIST SP 800-61 recommend at least annual reviews or reviews after any significant change or exercise. Therefore, uncovering hidden weaknesses is the strongest justification. The other options are either secondary considerations, false economies, or contradict best practice.

Performing a vendor risk assessment is crucial as it helps an organization to identify, evaluate, and mitigate the risks associated with a potential vendor. The assessment can reveal security practices and compliance with industry standards, helping the organization understand the level of risk it may assume if entering into an agreement with the vendor. Orders such as 'Right-to-Audit Clause' and 'Due Diligence' are more focused on ongoing monitoring or the preparation for the audit process itself, though they are related to the broader scope of risk management. A 'Business Impact Analysis' is generally used for internal purposes to assess the impact of disruptions on the business and is less about evaluating third-party vendors.

The leader should step back from the procurement activities to avoid any potential bias or influence over the selection process derived from his personal relationship with an individual at one of the competing firms. This action helps in maintaining the integrity and objectivity of the vendor selection process. Merely disclosing the connection does not remove the possibility of bias, and proceeding as if the connection does not exist can undermine the trust in the process and potentially lead to a risk of unfair competitive advantage.

Vishing is a type of social engineering attack where an attacker uses the telephone system, often pretending to be a trusted entity, to extract sensitive information from a target. Phishing is similar but primarily occurs through email or other electronic communication. Impersonation could be part of a vishing attack but is a broader term that doesn't specify the method of communication. Business email compromise is an attack targeted at companies to gain access to company information or assets, typically through deception via email.

Regularly updating an organization's computing resource inventory is essential for identifying and managing vulnerabilities, as well as ensuring the security posture is up-to-date. Failure to maintain an updated inventory increases the risk of incidents because unmanaged, unknown, or unpatched resources can become vectors for security breaches. It is less about physical tracking or license compliance, and more about understanding what needs to be protected and ensuring appropriate security measures are in place.

An independent third-party audit provides an unbiased review of security controls and practices. It is frequently required by regulatory standards in sensitive industries, such as finance, to ensure controls are up to the required effectiveness because internal teams may have inherent biases or conflicts of interest. A self-assessment, while valuable, can be biased due to internal influence. Penetration testing is a proactive security measure but does not constitute an independent review of all operational security processes. Monitoring by an internal audit committee will not fulfill the requirement for an unbiased and independent evaluation as required by many regulatory frameworks.