CompTIA Security+ Practice Test (SY0-701)

Stipulating that limited personal usage of technological systems is allowable, as long as it is in compliance with existing company guidelines and does not impact job duties, provides a clear yet balanced approach to personal use. Prohibiting personal storage of company information on external devices is purely a security-oriented directive without addressing the use of the systems themselves for personal activities. Authorizing unrestricted personal use disregards security concerns, while a total ban on personal use is overly restrictive and likely to be unenforceable.

A tap passive device monitors network traffic by copying data from the network without being in the direct flow of traffic. This means it does not impact network performance or flow because it is not inline with the traffic; instead, it passively receives a copy of the data. Inline devices, whether active or passive, are placed directly in the path of network traffic and can introduce latency or points of failure. Active devices can take actions such as blocking or modifying traffic, which could impact performance. Therefore, a tap passive device is the most suitable for monitoring without affecting network performance.

A firewall filters or blocks network traffic according to predefined rules, helping to prevent unauthorized access over the network. It does not transform the actual data on the server. If an attacker bypasses the firewall-through stolen credentials, an insider threat, or physical access-the files remain readable unless they are encrypted. Encrypting the disk, volume, or files converts them into ciphertext that is unintelligible without the decryption key, preserving confidentiality even if the storage media is stolen or the system is compromised. Therefore, encryption-not the firewall-provides protection for data at rest.

An Acceptable Use Policy (AUP) provides a set of rules and guidelines that outline how the organization's assets and network resources should be used. It helps to ensure that employees and other stakeholders are aware of what constitutes appropriate and inappropriate use, thereby protecting the organization from various risks associated with misuse. The other options listed do not directly address the specific need for governing the use of organizational assets and network resources.

An incremental backup captures only the data that has changed since the last backup of any type-either full or incremental-so it typically requires the least storage space. A differential backup records all changes since the last full backup, so its size grows each day until another full backup occurs. A snapshot represents a point-in-time copy of a volume rather than a true change-based backup method. A full backup duplicates every selected file and therefore consumes the most storage.

The primary role of a generator in the security architecture of a data center is to provide backup power in the event that the main power supply fails. This ensures that critical systems remain operational during power outages, thus maintaining high availability and preventing potential security breaches that could occur due to system downtime.

An agent-based monitoring tool would be appropriate for this task because it can be installed on each endpoint to monitor its health and security status in real-time. These agents regularly communicate with a central management console to report on the status of the endpoint and alert security personnel if an anomaly is detected. Other answers involve manual processes, provide incomplete solutions, or are less efficient for real-time monitoring in a large enterprise environment.

Mitigation refers to the implementation of measures to reduce the impact of a threat or to reduce the likelihood of its occurrence. Establishing additional access controls to safeguard sensitive information makes it more difficult for unauthorized users to access this information, thus reducing the potential impact of a data breach. On the other hand, transferring the risk involves shifting the responsibility to another entity, such as through insurance. Avoiding the risk would mean completely eliminating the threat, which can be unrealistic for some risks, and accepting the risk would indicate no further actions to decrease its impact.

Placing the IPS directly behind (internal to) the external firewall allows the firewall to drop obviously disallowed traffic first, so the IPS only analyzes traffic that has already met basic policy rules. This reduces the IPS workload, decreases false positives, and still stops threats before they can reach internal routers, switches, and hosts. Positioning the IPS outside the firewall forces it to inspect all Internet noise, while placing it deep inside the LAN or only at a datacenter ingress leaves gaps during initial ingress and can overwhelm the sensor with east-west traffic.

Automated monitoring and alerting systems provide real-time detection of security events, which significantly reduce response times to potential incidents. By setting thresholds and parameters for normal network behavior, these systems can promptly identify and report suspicious activities, enabling quicker remediation. While all other options may contribute to effective security practices, automated alerting will most directly address the current delays and inconsistencies in incident detection and reporting, leading to improved security posture.

A warm site has more equipment in place than a cold site but does not have active data in place like a hot site. It is a compromise between the two other backup sites.

A vulnerability scanner is specifically designed to assess computers, systems, and networks for security weaknesses. These tools can check for misconfigurations, unpatched software, and other vulnerabilities, making it the most appropriate choice for the given task. Network sniffers are primarily used for capturing and analyzing network traffic and will not necessarily identify misconfigurations and unpatched systems. Protocol analyzers are best for diagnosing network communication issues but do not actively scan for vulnerabilities. Antivirus software protects against malware and is not a tool for scanning network infrastructures for vulnerabilities.

Password spraying is a type of brute-force attack where an attacker attempts to access a large number of accounts with a few commonly used passwords. Unlike a traditional brute-force attack that targets a single account with many passwords, spraying targets many accounts with few passwords to prevent triggering account lockout policies. A dictionary attack is different as it typically uses a large list of passwords against a single account. A rainbow table attack is used to crack password hashes that have already been stolen, not for online authentication attempts. 'Plaintext/Unencrypted' refers to the insecure state of a password, not an attack method.

Bollards are designed to prevent vehicle intrusions into secure areas. They are short vertical posts that can be installed outside buildings or around perimeters to create barriers against vehicles. While fencing can also deter vehicles and unauthorized individuals, it is a wider perimeter security measure, not specifically engineered like bollards to withstand vehicle impacts. Security guards provide surveillance and response but are not physical barriers to vehicles. Access badges are a form of identification and access control but do not directly prevent vehicles from entering a secure location.

User provisioning automates the creation of user accounts and the assignment of appropriate access rights, effectively streamlining the onboarding process. While ticket creation can help manage access requests, it does not automate the provisioning itself. Continuous integration and testing are related to software development practices, and security groups organize users but do not automate access provisioning.

Terminal Access Controller Access-Control System Plus (TACACS+) is a protocol that provides centralized Authentication, Authorization, and Accounting (AAA) services. It meets the stated security requirements by encrypting the entire body of the packet during transmission. In contrast, RADIUS is a similar AAA protocol but only encrypts the password field within the authentication packet, leaving the username and other data in cleartext. Kerberos is primarily used for service authentication in a domain environment, and Extensible Authentication Protocol (EAP) is an authentication framework, not a standalone AAA protocol for this specific use case.

A password manager assists users in creating, storing, and managing their passwords for online and local services securely. It protects sensitive information with strong encryption and sometimes offers additional features like syncing across devices and generating unique passwords. Using only a password for encryption or merely saving passwords in a browser does not offer the same level of functionality or security.

A hot site is a fully equipped and operational duplicate of the primary site, often with real-time data synchronization, designed for immediate or near-immediate failover. This meets the requirement for the fastest possible recovery time, typically within minutes to hours. A warm site has hardware and connectivity but requires data to be restored from backups, leading to a recovery time of hours to days. A cold site is a basic facility with space, power, and cooling, but no pre-installed hardware, resulting in a recovery time of weeks or longer. 'Lukewarm site' is not a standard industry term for disaster recovery sites.

This scenario describes dynamic analysis, also known as Dynamic Application Security Testing (DAST). This method involves testing an application while it is running to find vulnerabilities that only appear during operation. It assesses the application from the 'outside-in,' mimicking how an attacker would interact with it. Static analysis reviews the raw code without running it, configuration scanning validates the security of the underlying server, and log review is a reactive process of reviewing past events.

Deterrent controls are designed to discourage potential attackers. Warning signs are a classic example as they inform individuals of the consequences of trespassing, aiming to deter the action. This is not a preventive control, as it does not physically stop an intruder (e.g., a fence or a lock). It is not a corrective control, which is used after an incident to limit damage (e.g., restoring from backups). It is also not a compensating control, which serves as an alternative when a primary control is not feasible.