CompTIA Security+ Practice Test (SY0-701)

A Distributed Denial-of-Service (DDoS) attack is a cyber-attack in which multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers, causing a drastic spike in resource consumption. This can overwhelm the system, leading to slowdowns or complete denial of service. In contrast, phishing and social engineering attacks primarily focus on deception to gain information, and they do not typically result in excessive resource consumption. Email spam may consume resources, but it is typically not as impactful as a coordinated DDoS attack that targets and exhausts system resources.

Nation-state actors are typically well-funded and possess advanced capabilities, enabling them to conduct sophisticated attacks that can bypass even the most robust security measures. They often focus on long-term objectives, such as espionage and data exfiltration over extended periods. Insider threats involve individuals within the organization but may not have the resources or need to use advanced techniques for prolonged undetected access. Hacktivists are motivated by political or social causes but generally lack the resources for highly sophisticated attacks. Unskilled attackers, also known as script kiddies, lack the expertise and resources to perform advanced and prolonged infiltration without detection.

Federation is the practice of linking a user's electronic identity and attributes, stored across multiple distinct identity management systems. Implementing a federated identity management system would be ideal in this situation as it enables the company's employees to use their existing corporate credentials to access the third-party service provider's resources securely. This negates the need for multiple credentials and simplifies the authentication process for users, which directly aligns with the scenario's requirements of minimizing complexity and offering a streamlined process.

Creating additional user credentials for each employee within the partner's system and relying on a central access policy that governs the usage of applications across both entities, are less efficient solutions that increase complexity and management overhead, which does not fulfill the specified criteria of streamlined access. The web authentication standard accentuates a specific method of authentication that can be utilized in federated environments but does not represent the overarching federated identity management system needed here.

RSA (Rivest–Shamir–Adleman) is an asymmetric cryptographic algorithm commonly used for data transmission. It uses public and private key pairs.

Security cameras are a form of deterrent control designed to discourage unauthorized individuals from attempting to access a secure area. Their presence is often enough to dissuade potential attackers as it increases the likelihood of being caught and recorded, which can lead to identification and potential prosecution. In contrast, badge readers and mantraps, while part of physical security measures, are types of preventive controls that actively prevent unauthorized access. Security awareness posters do not directly discourage trespassers from entering secured premises, as they are more focused on educating authorized personnel on maintaining security practices.

A next-generation firewall (NGFW) provides the advanced functionality needed for logical network segmentation, augmenting classic firewall capabilities with features such as application awareness and intrusion prevention. NGFWs ensure that strict security policies can be enforced and managed between segmented zones, which is perfect for an environment handling sensitive health records. This technology provides the required granularity for compliance with healthcare regulations, making it the optimal choice over other options that either lack the sophistication in policy management or are not primarily designed for inter-segment traffic control within the same network.

The correct answer is a threat feed. A threat feed is a real-time or near-real-time stream of data providing information on current and potential cyber threats, including indicators of compromise like malicious IPs, URLs, and malware signatures. A security baseline defines a standard state for a system, a SIEM is used to aggregate and analyze log data from internal sources, and a vulnerability scanner actively probes systems for weaknesses rather than providing a continuous external data stream.

The correct answer is the National Vulnerability Database (NVD) because it is a comprehensive database where CVE details are cataloged and can be searched. The CVE identifier would provide a standardized reference for the vulnerability in question, allowing the security team to access the details they need to begin assessing the impact and planning their response. The CERT Coordination Center deals with coordinating responses to security incidents, not cataloging CVEs. The Open Web Application Security Project (OWASP) focuses on improving software security, specifically for web applications, and does not serve as a database for CVEs. The Internet Engineering Task Force (IETF) develops and promotes voluntary internet standards and protocols, but does not manage a database of vulnerabilities.

The programmer created a backdoor in the application to grant themselves access later on. The backdoor allowed them to bypass the application's usual authentication measures. A backdoor could also be set up by a malicious application, but in this case, it was the work of a lazy programmer who knew he would be fired soon.

Integrated Penetration Testing involves the collaboration of offensive and defensive techniques to comprehensively evaluate an organization's security. This approach allows for a more effective identification of vulnerabilities by leveraging multiple perspectives and methods.

Corrective controls are designed to limit the damage and impact after a security incident has already occurred. They are reactive measures that help organizations recover from an incident and minimize the extent of the damage. Examples of corrective controls include backup systems that allow for data restoration and incident response plans that outline the steps to be taken after an incident is detected. While preventive controls aim to stop incidents from occurring in the first place, and detective controls focus on identifying incidents, corrective controls are specifically designed to mitigate the consequences of an incident after it has happened.

A Secure Access Service Edge (SASE) architecture is the best solution for this scenario. SASE combines networking capabilities, specifically SD-WAN, with a suite of cloud-native security services (like SWG, CASB, ZTNA, and FWaaS) into a single, unified platform. This model moves security enforcement to the cloud edge, allowing remote users to connect directly to cloud resources securely and efficiently without needing to route traffic back through a central data center. A traditional VPN would still backhaul traffic, a CASB alone only addresses cloud application security without the networking component, and simply hardening on-premises firewalls does not solve the inefficient traffic routing issue.

Phishing simulations are a practical method of testing employees' abilities to recognize and respond to social engineering attacks. This type of simulation provides actionable insights by creating realistic scenarios similar to actual phishing attempts, without the associated risk. This helps measure the effectiveness of the training and identifies areas where additional training may be necessary. Answer options like 'Unannounced network scans' and 'Publishing quarterly newsletters' are less direct and less effective methods of assessing the specific understanding of recognizing social engineering attacks. Although helpful in a broader security context, they do not directly test the application of the training content. 'Including a quiz at the end of the training session' can validate immediate retention but does not measure long-term understanding or practical application in an actual work environment.

The Role-Based Access Control (RBAC) model is designed to restrict system access to authorized users. This model is the most aligned with scenarios in which access to resources needs to be assigned based on roles within an organization, making it easier to manage and audit. Attribute-Based Access Control (ABAC) and Discretionary Access Control (DAC) are less suited for this scenario. ABAC can be highly dynamic, which can be complex to audit, while DAC allows owners of the resources to specify access, which does not meet the non-discretionary requirement of the scenario. The Security Support Provider Interface (SSPI) is a Microsoft API used for security-related functions and is not an access control model.

This scenario describes a detective control. Detective controls are designed to find and alert on security incidents after they have already occurred or as they are happening. Intrusion detection systems (IDS) and log analysis tools fit this description perfectly as they monitor for and report on suspicious activity, rather than stopping it outright.

• Preventive controls aim to stop an incident before it happens (e.g., a firewall blocking a malicious IP address).
• Corrective controls are used to limit the damage and restore systems after an incident has been detected (e.g., restoring from a backup after a ransomware attack).
• Deterrent controls are meant to discourage potential attackers (e.g., warning banners).