CompTIA Security+ Practice Test (SY0-701)

Regular vulnerability scanning is the best method for routinely identifying new and unaddressed vulnerabilities on network devices, servers, and workstations. It allows the organization to detect security weaknesses and ensure that they are addressed before they can be exploited. Although penetration testing can identify vulnerabilities, it is not typically conducted on a routine basis due to its complexity and cost. Threat feeds provide information on new threats but do not identify specific vulnerabilities in systems. Firewalls primarily protect against unauthorized access and do not scan for vulnerabilities within the network.

Data that isn’t active and is on a storage media is considered data at rest.

By intercepting and analyzing web requests and responses, a proxy server can block unwanted content and prevent access to malicious sites, which enhances network security by reducing the exposure to web-based threats. Answer "Filtering out malicious web traffic" describes this benefit. Other options are not primarily related to the proxy's role in enhancing security, such as increasing network speed, which is more concerned with performance optimization than security.

The Policy Engine is the decision-making component of a Zero Trust architecture. It receives contextual information about the subject, device, and requested resource, compares that information to enterprise security policies, and returns an allow, deny, or revoke decision. Enforcement of the decision is performed by the Policy Administrator and the Policy Enforcement Point, not by the Policy Engine itself. The distractors describe logging, authentication services, and routing functions that are unrelated to the Policy Engine's role.

Implementing a firewall is the most effective solution in this scenario. A firewall acts as a barrier between the internal network and external sources, controlling incoming and outgoing network traffic based on predefined security rules. It blocks unauthorized access attempts from external entities while allowing legitimate outbound communication required by employees. An intrusion detection system monitors network activities for suspicious behavior and generates alerts but does not prevent access. Encryption secures data but does not control network access. Physical access controls protect the physical hardware and premises but do not safeguard the network from external cyber threats.

An incident response plan is a living document that must adapt to evolving threats and to lessons learned during drills and audits. Even when the environment appears static, undetected weaknesses or procedural gaps can persist. Regular reviews-through tabletop exercises, simulations, and document updates-surface these weaknesses so they can be corrected before a real incident occurs. Standards such as NIST SP 800-61 recommend at least annual reviews or reviews after any significant change or exercise. Therefore, uncovering hidden weaknesses is the strongest justification. The other options are either secondary considerations, false economies, or contradict best practice.

The correct answer is that an unnecessary open port increases the system's attack surface. Even if no legitimate service is running on the port, it can be probed by attackers using techniques like port scanning. This can reveal information about the operating system and attract further attacks, such as brute-force attempts or the exploitation of a vulnerability if a service is ever misconfigured or a malicious one is installed on that port. Unused ports do not inherently consume significant resources, cause data exfiltration, or block legitimate traffic to other services. Best practice is to close all unused ports to minimize the attack surface.

Security cameras are a form of deterrent control designed to discourage unauthorized individuals from attempting to access a secure area. Their presence is often enough to dissuade potential attackers as it increases the likelihood of being caught and recorded, which can lead to identification and potential prosecution. In contrast, badge readers and mantraps, while part of physical security measures, are types of preventive controls that actively prevent unauthorized access. Security awareness posters do not directly discourage trespassers from entering secured premises, as they are more focused on educating authorized personnel on maintaining security practices.

During an incident, the analyst should prioritize containing the threat to prevent further damage or exploitation. Containment strategies may include isolating affected systems, blocking malicious traffic, or taking applications offline. Other steps, such as reporting the incident to stakeholders and recovery processes, occur after the immediate threat has been contained and the impact is controlled.

Guidelines are recommendations and best practices for users to follow. They are not strictly enforced but are designed to provide general advice on how to use IT resources securely. An organization would develop guidelines to offer staff general security advice. Policies, on the other hand, are mandatory rules that must be followed, and standards are specific low-level mandatory controls. Procedures are detailed step-by-step instructions on how to perform specific tasks.

SELinux provides a set of security policies that enforce mandatory access controls, limiting programs and system daemons to the minimum level of access they require to perform their tasks. This additional layer of security helps prevent unauthorized access and potential exploitation of vulnerabilities.

The statement is false because geolocation restrictions typically apply to controlling access to data based on the physical location of the attempting user or system, which is an effective strategy for protecting data at rest, and to a lesser extent, data in use. However, once data is in transit, it is being transferred across a network and other protection mechanisms, such as encryption, become more relevant to safeguard the data from interception or unauthorized access during the transfer process. Geolocation would not be effective in securing the data as it moves across networks, as it does not prevent interception or eavesdropping.

Fail-closed (sometimes called fail-secure) means that when a security control becomes unavailable, it blocks or denies traffic instead of allowing it to pass unchecked. Configuring the IPS to fail-closed therefore prevents uninspected packets from traversing the network during an outage. Fail-open does the opposite-it allows all traffic for the sake of availability. Fail-safe focuses on protecting other components, often by bypassing the device rather than dropping traffic, and failover relies on redundant equipment rather than a traffic-blocking posture.

Nation-state actors are typically well-funded and possess advanced capabilities, enabling them to conduct sophisticated attacks that can bypass even the most robust security measures. They often focus on long-term objectives, such as espionage and data exfiltration over extended periods. Insider threats involve individuals within the organization but may not have the resources or need to use advanced techniques for prolonged undetected access. Hacktivists are motivated by political or social causes but generally lack the resources for highly sophisticated attacks. Unskilled attackers, also known as script kiddies, lack the expertise and resources to perform advanced and prolonged infiltration without detection.

A configuration audit specifically assesses configurations against established security baselines and policies, ensuring that systems are compliant with the required security settings. This would detect deviations in access control policies and configurations from the standard across servers. A performance audit, while it assesses the efficiency and effectiveness of an organization's processes, would not focus solely on security settings and policies. A financial audit is concerned with the financial accounts and transactions of an organization, and while an operational audit evaluates the operational aspects of an organization, it does not concentrate on access control policies and system configurations to the extent necessary for the given task.