CompTIA Security+ (SY0-701) Practice Questions with Explanations

Correct answer: B

An internal compliance assessment failure results in audit findings that document non- compliance issues. These findings form the basis for remediation efforts. While external assessments can lead to fines, and failures may eventually impact reputation and result in regulatory sanctions, the immediate direct outcome of a failed internal assessment is documented audit findings that the organization uses to track and address compliance gaps.

Why the other options are wrong:

• A. Fines are typically imposed by external auditors or regulatory bodies, not from internal assessments.
• C. Sanctions are formal regulatory penalties, not the primary outcome of internal assessment failures.
• D. Reputation damage is a potential long-term consequence but not the direct outcome of the assessment.

Correct answer: A

Active reconnaissance involves direct engagement with target systems to gather information, such as performing port scans and service enumeration. These activities generate network traffic and are detectable, distinguishing them from passive reconnaissance which observes without direct interaction.

Why the other options are wrong:

• B. Passive reconnaissance involves gathering information without directly interacting with systems, like reviewing public records.
• C. Defensive reconnaissance is not a standard penetration testing term.
• D. Offensive describes attacks, but the scanning phase is reconnaissance, not the offensive exploitation phase.

Correct answer: A

A thorough analysis of the supply chain directly addresses counterfeit hardware risks by identifying vulnerabilities in procurement processes, verifying authenticity of suppliers, and ensuring products come from legitimate sources. This comprehensive approach is the best way to mitigate counterfeit hardware procurement risks.

Why the other options are wrong:

• B. While a corporate acquisition policy is important, it doesn't specifically address the technical verification needed to identify counterfeits.
• C. A right to audit clause helps verify compliance but is less comprehensive than full supply chain analysis for detecting counterfeit products.
• D. Penetration testing evaluates security controls, not the authenticity or legitimacy of hardware products from suppliers.

Correct answer: B

R&D employees work with proprietary research, trade secrets, and confidential innovations-all forms of intellectual property. This is the core asset they protect through their specialized training, making it the most likely type of data they use daily in their roles.

Why the other options are wrong:

• A. Encryption is a security control/mechanism, not a data type.
• C. Critical data is a classification level, but not specifically tied to R&D work.
• D. Data in transit describes data movement, not a classification type R&D employees specifically handle.

Correct answer: A

Multifactor authentication (MFA) would prevent unauthorized access even if credentials are compromised, since attackers would need a second authentication factor (such as a code from the user's phone) that only the legitimate user possesses. This directly addresses the scenario where passwords were stolen and used from suspicious locations.

Why the other options are wrong:

• B. Permissions assignment controls what authenticated users can do, not who can authenticate.
• C. Access management is too broad and doesn't specifically prevent credential-based attacks.
• D. Password complexity alone doesn't prevent compromised passwords from being used by attackers.

Correct answer: B

The search string 'http://' matches unencrypted web protocol URLs, allowing the filter to deny access to non-encrypted websites. HTTP traffic uses port 80 and lacks encryption, whereas HTTPS uses port 443 with encryption, making this the correct identifier for non- encrypted traffic.

Why the other options are wrong:

• A. The string 'encryption=off' is not a standard component of URLs and would not reliably match non-encrypted websites.
• C. The pattern 'www.*.com' matches domain names but does not distinguish between encrypted (HTTPS) and non-encrypted (HTTP) protocols.
• D. The port ':443' is used by HTTPS, which is encrypted, making it the opposite of what needs to be blocked.

Correct answer: B

Sanitization is the process of securely wiping, erasing, or overwriting data on storage devices before they are decommissioned or recycled. This policy ensures that sensitive data cannot be recovered from hard drives that are sent to recycling, which is exactly what the scenario describes.

Why the other options are wrong:

• A. Enumeration is the process of discovering and listing systems and assets, not related to secure data removal.
• C. Destruction involves physically destroying the media itself, which is more extreme than sanitization and would prevent recycling.
• D. Inventory is the process of tracking and cataloging assets, not related to secure data removal.

Correct answer: D

A changed hash on cmd.exe with no patches applied indicates unauthorized modification of a critical system file. This is a classic indicator of rootkit installation, which modifies system executables to maintain persistence and hide malicious activity. The lack of legitimate patching rules out other explanations.

Why the other options are wrong:

• A. Permission changes don't alter file content or hashes.
• B. Cryptographic collisions are theoretically possible but extremely rare and unrelated to patch history.
• C. File system snapshots don't change the actual hash of the monitored file.

Correct answer: C

Creating a change control request must be the first step before applying any patch to production systems. This ensures proper documentation, risk assessment, approval workflows, and stakeholder notification occur before making changes. Air-gapping or moving systems are responses to security incidents, not standard patch procedures. Applying the patch without change control violates established change management practices and could cause unforeseen issues.

Why the other options are wrong:

• A. Air-gapping is a response to active security threats, not a step for routine patching.
• B. Moving the system is not necessary for patch deployment if change control is followed.
• D. Applying the patch immediately skips required change management approval and documentation.

Correct answer: C

To improve situational and environmental awareness during a specific transition (remote to in-office), modifying recurring training content ensures the message reaches all users regularly with contextually relevant information about their changing work environment. This is more targeted and sustainable than one-time reminders and directly addresses the transition period.

Why the other options are wrong:

• A. Periodic reminders are less formal and structured than training for behavioral change.
• B. New hire documentation doesn't address existing users already in the workforce.
• D. Phishing campaigns test awareness but don't proactively educate users about environmental changes.

Correct answer: C

Organized crime groups have the resources, capability, and profit motive to be hired by foreign governments for sophisticated cyberattacks on critical infrastructure. They operate as professional entities with established business relationships and can be contracted for high-value operations. Hacktivists are ideologically motivated rather than mercenary, whistleblowers leak information rather than attack systems, and unskilled attackers lack the sophistication required for critical infrastructure targeting.

Why the other options are wrong:

• A. Hacktivists are ideologically motivated, not hired for profit by governments.
• B. Whistleblowers disclose information rather than conduct attacks.
• D. Unskilled attackers lack the sophistication to target critical systems effectively.

Correct answer: C

Business Email Compromise (BEC) attacks target employees with authority or access by impersonating executives or trusted contacts to request sensitive actions. Option C describes a classic BEC scenario where someone impersonating an HR director requests cloud administrator credentials from a service desk employee. Option A is gift card phishing, option B is ransomware, and option D is standard phishing to the email portal.

Why the other options are wrong:

• A. Gift card requests represent basic phishing, not the sophisticated impersonation characteristic of BEC.
• B. Email attachments causing ransomware describes malware delivery, not BEC social engineering.
• D. Phishing links to company portals are standard phishing, not the account compromise targeting of BEC.

Correct answer: C

A cold site is the most cost-effective backup data center option, which aligns with the organization's primary requirement of cost-benefit. With RTO and RPO values around two days, the organization can tolerate the extended recovery time required to activate and configure a cold site, making it the optimal choice when cost is the primary driver.

Why the other options are wrong:

• A. Real-time recovery requires active mirroring and is the most expensive option.
• B. Hot sites are fully operational and immediately available, but they are significantly more costly than cold sites.
• D. Warm sites are a middle ground between hot and cold, providing faster recovery than cold but at higher cost than necessary for two-day RTO/RPO requirements.

Correct answer: B

Testing the policy in a non-production environment first would have identified the issue before it impacted production servers. This preventive approach catches unintended consequences before they affect business operations. While documentation and change management are important, they don't prevent the issue from occurring. Including an "allow any" policy would defeat the security purpose of the deny rule. Disabling IPS signatures is a security risk and doesn't address the underlying ACL logic problem.

Why the other options are wrong:

• A. Change management documentation doesn't prevent the policy from causing server unreachability.
• C. Disabling IPS signatures reduces security and does not address the ACL configuration issue.
• D. Adding an "allow any" above "deny any" defeats the security purpose of implementing the deny rule.

Correct answer: C

A geolocation policy directly restricts access based on geographic location, preventing users in high-risk countries from accessing the documents. This is the most effective and straightforward method to enforce location-based access restrictions. Data masking obscures data content but doesn't prevent access, encryption protects data in transit/rest but doesn't restrict who can decrypt it, and data sovereignty regulations are compliance frameworks rather than access control mechanisms.

Why the other options are wrong:

• A. Data masking obscures sensitive content but does not prevent access from restricted locations.
• B. Encryption protects data confidentiality but does not inherently restrict access by geography.
• D. Regulations provide compliance requirements but are not technical controls that enforce access restrictions.

Correct answer: C

A risk register is the formal document used to record identified risks, assign responsible parties, define risk thresholds, and track risk mitigation efforts throughout an organization. It serves as the central repository for risk management information. Risk tolerance defines an organization's willingness to accept risk, risk transfer involves shifting risk to another party, and risk analysis is the process of evaluating risks rather than documenting them in a structured format.

Why the other options are wrong:

• A. Risk tolerance refers to acceptable risk levels, not a document for recording specific risks and parties.
• B. Risk transfer involves shifting risk responsibility, not documenting risks and thresholds.
• D. Risk analysis is a process of evaluating risks, not a document for recording risks and responsible parties.

Correct answer: D

An acceptable use policy is a preventive control because it establishes rules and guidelines designed to prevent employees from misusing company resources or violating security policies before violations occur. It sets expectations and boundaries to deter unwanted behavior. Detective controls identify violations after they occur, corrective controls remediate issues after detection, and compensating controls provide alternative protections when primary controls fail.

Why the other options are wrong:

• A. Detective controls identify violations after they happen, not prevent them beforehand.
• B. Compensating controls provide alternatives when primary controls are inadequate.
• C. Corrective controls fix or remediate issues after they have already occurred.

Correct answer: D

SQL injection enables attackers to manipulate input fields to execute arbitrary SQL commands against databases, allowing them to view, modify, or delete data. The vulnerability occurs when user input is improperly validated before being included in SQL queries. Cross-site scripting injects malicious scripts into web pages, side loading refers to installing applications outside official channels, and buffer overflow exploits memory vulnerabilities rather than database query manipulation.

Why the other options are wrong:

• A. Cross-site scripting injects malicious scripts into web pages viewed by other users.
• B. Side loading involves installing applications from unofficial sources, not executing database commands.
• C. Buffer overflow exploits memory management vulnerabilities, not input fields executing data queries.

Correct answer: D

ACLs are processed top-to-bottom with first match wins. Option D permits DNS traffic only from 10.50.10.25 to any destination on port 53, then denies all other outbound DNS traffic. This correctly restricts DNS to the single authorized device. Options A and C deny the authorized device or permit then deny the same traffic illogically. Option B reverses source/destination incorrectly.

Why the other options are wrong:

• A. This denies the authorized device (10.50.10.25) after permitting all others, opposite of the requirement.
• B. This reverses source and destination in the first line, allowing all devices to send to 10.50.10.25.
• C. This permits all outbound DNS first, making the second deny statement unreachable.

Correct answer: B

A bug bounty program compensates external researchers and security professionals for discovering and reporting vulnerabilities in a company's systems. This crowdsourced approach expands the scope of security testing beyond traditional methods. Open-source intelligence involves gathering public information, red team exercises simulate adversarial attacks in a controlled manner, and penetration testing is typically conducted by hired professionals under contract rather than a public compensation program.

Why the other options are wrong:

• A. Open-source intelligence involves collecting and analyzing publicly available information, not testing systems.
• C. Red team exercises are internal or contracted adversarial simulations, not crowdsourced public programs.
• D. Penetration testing is typically contracted work, not a public compensation-based program for outside researchers.

Correct answer: C

Nation-states possess the largest financial and technical resources, making them most likely to target critical infrastructure in other countries through sophisticated, well-funded cyber operations. They conduct campaigns aligned with geopolitical interests and have capabilities far exceeding other threat actors. Insiders lack external resources, unskilled attackers lack both resources and sophistication, and hacktivists are motivated by ideology rather than having substantial financial backing.

Why the other options are wrong:

• A. Insiders lack access to large financial resources for sustained international attacks.
• B. Unskilled attackers lack both financial resources and technical capability.
• D. Hacktivists are typically motivated by ideology rather than possessing large financial resources.

Correct answer: B

A jump server (bastion host) is a hardened, monitored intermediary system that adds a security layer by requiring administrators to connect through it before accessing internal resources, enabling centralized logging, auditing, and control of administrative access.

Why the other options are wrong:

• A. RDP servers are remote access tools but don't inherently add security layers or prevent unauthorized access to internal resources.
• C. Proxy servers manage application-level traffic but are not specifically designed as access control barriers for internal resource protection.
• D. Hypervisors are virtualization platforms with no direct role in preventing unauthorized access to company resources.

Correct answer: C

Input validation prevents cross-site scripting (XSS) by filtering, sanitizing, or rejecting malicious script input before it's processed by the application. This is the fundamental defense against XSS vulnerabilities in web forms, ensuring user-supplied data cannot execute malicious code.

Why the other options are wrong:

• A. Secure cookies protect session tokens but don't prevent XSS injection in form fields.
• B. Version control manages code changes but doesn't prevent XSS vulnerabilities.
• D. Code signing verifies code authenticity but doesn't validate user input to prevent XSS.

Correct answer: C

Adaptive identity is the most relevant evaluation criterion for Zero Trust in the data plane because it focuses on continuously verifying and reassessing user/device credentials and characteristics in real-time, which is fundamental to Zero Trust's verify-always approach. This enables dynamic access decisions based on current context rather than static permissions.

Why the other options are wrong:

• A. Secured zones represent network segmentation, which is more relevant to the control plane than data plane evaluation.
• B. Subject role is relevant to identity but doesn't capture the continuous, adaptive verification essential to Zero Trust data plane security.
• D. Threat scope reduction is a general risk management concept, not specifically focused on data plane implementation details.

Correct answer: C

Full disk encryption is the appropriate technique to protect data on laptops because it encrypts the entire storage device, protecting data at rest whether the laptop is powered on or off. This ensures that if a laptop is lost or stolen, the data remains protected. Partition is not an encryption technique, asymmetric encryption is not suitable for transparent data protection on entire disks, and database encryption only protects specific databases rather than all data on the device.

Why the other options are wrong:

• A. Partition refers to dividing storage space, not an encryption technique.
• B. Asymmetric encryption is impractical for transparent full-disk protection and uses key pairs rather than single encryption.
• D. Database encryption only protects data within databases, not all data on the laptop.

Correct answer: D

The IT manager is implementing the principle of least privilege by restricting administrator console access to only the IT manager and help desk lead-the minimum number of individuals who require this level of access to perform their job duties. This limits potential damage from unauthorized access or misuse. Hardening involves securing systems through multiple methods, employee monitoring tracks user activities, and configuration enforcement ensures systems maintain desired settings.

Why the other options are wrong:

• A. Hardening is a broader concept involving multiple security measures beyond access restrictions.
• B. Employee monitoring tracks and records user activities rather than restricting access.
• C. Configuration enforcement ensures systems maintain desired security settings, not about limiting who can access tools.

Correct answer: B

Purchasing cyber insurance represents the 'transfer' strategy because the organization is shifting the financial risk of potential breaches to an insurance company rather than mitigating, avoiding, or accepting the risk internally.

Why the other options are wrong:

• A. Accept would mean acknowledging the risk and absorbing potential losses without purchasing insurance.
• C. Mitigate involves implementing security controls to reduce risk, not transferring financial responsibility to insurers.
• D. Avoid means eliminating the activity or asset that creates the risk, not purchasing insurance coverage for it.

Correct answer: D

The Red Team conducts offensive security assessments, including penetration testing and social engineering attacks. Their role is to simulate adversary behavior and identify vulnerabilities from an attacker's perspective, which is exactly what the scenario describes.

Why the other options are wrong:

• A. The White Team typically acts as a neutral referee or judge in security exercises.
• B. The Purple Team is a hybrid approach combining red and blue team activities for collaborative improvement.
• C. The Blue Team is defensive in nature, focusing on protecting systems and responding to attacks rather than conducting offensive assessments.

Correct answer: D

A dashboard is the appropriate tool for presenting quarterly incident metrics to executive leadership. It provides visual, digestible summaries of key performance indicators-exactly what a board of directors needs for strategic decision-making, whereas the other options are technical data sources unsuitable for executive reporting.

Why the other options are wrong:

• A. Packet captures are granular technical data, not executive summaries.
• B. Vulnerability scans show vulnerabilities, not incident counts.
• C. Metadata is raw technical information, not a presentation format for board reporting.

Correct answer: D

Side loading refers to installing software from sources outside the manufacturer's official repository, such as third-party app stores or directly from files. This practice bypasses the manufacturer's security reviews and vetting processes, introducing vulnerabilities and malware risks.

Why the other options are wrong:

• A. Jailbreaking is the process of removing device restrictions, which may enable side loading but is not itself the vulnerability of installing from unapproved sources.
• B. Memory injection involves code being inserted into memory at runtime, not related to software installation sources.
• C. Resource reuse involves reusing computing resources with residual data, not software installation practices.

Correct answer: D

Threat hunting is the best approach when new malicious tactics have not yet triggered SIEM alerts. It involves proactive searching through network and system data to find indicators of compromise and new attack patterns before automated detection rules are configured.

Why the other options are wrong:

• A. Digital forensics is a reactive technique used after incidents are detected, not for proactively identifying new attack behaviors.
• B. E-discovery focuses on locating and retrieving data for legal proceedings, not on identifying new security threats.
• C. Incident response is triggered by detected incidents, but threat hunting precedes that by seeking to find threats before they trigger alerts.

Correct answer: D

This scenario describes a classic phishing attack where an employee received a deceptive email from what appeared to be a payment website, clicked a link, and entered credentials on a fraudulent page. The 'page not found' error is typical when the phishing site has captured the credentials. Brand impersonation is the technique used but phishing is the attack type; pretexting involves creating false scenarios verbally; typosquatting involves domain name mimicry.

Why the other options are wrong:

• A. Brand impersonation is the technique used within the phishing attack, not the attack type itself.
• B. Pretexting typically involves direct communication and building false relationships, not fake websites.
• C. Typosquatting involves slightly misspelled domain names, not exact impersonation in emails.

Correct answer: A

Rules of engagement specifically document the terms, scope, timeline, authorized targets, and limitations of a penetration testing engagement with a third-party tester. This document defines what the tester can and cannot do during the assessment.

Why the other options are wrong:

• B. Supply chain analysis reviews vendor procurement processes, not testing engagement terms.
• C. A right to audit clause grants audit permissions but doesn't detail specific test terms and conditions.
• D. Due diligence is a broader assessment process, not a specific document detailing engagement terms.

Correct answer: C

Patient data in a hospital setting, such as Protected Health Information (PHI), should be classified as Sensitive. Sensitive data classification indicates information that requires strong protections and controlled access, which is the appropriate level for healthcare data subject to regulations like HIPAA.

Why the other options are wrong:

• A. Private is a less stringent classification than Sensitive and does not adequately reflect the regulatory requirements of patient data.
• B. Critical typically refers to systems and operations essential for business continuity, not a primary data classification for patient information.
• D. Public indicates data with no restriction on access or disclosure, which is completely inappropriate for patient data.

Correct answer: A

In IaaS (Infrastructure as a Service), the cloud provider manages infrastructure while the client is responsible for securing applications and data, including databases. The client must implement database security controls, access management, encryption, and patches -making the client responsible for database security.

Why the other options are wrong:

• B. Third-party vendors are not part of the standard shared responsibility model.
• C. The cloud provider handles infrastructure; database security is the client's responsibility in IaaS.
• D. DBAs are staff roles that work for the client organization implementing security controls.

Correct answer: A

A jump server (bastion host) is a hardened, monitored intermediary system that allows administrators to access restricted network segments without direct connectivity. It enforces access control and logging for administrative activities. RADIUS is an authentication protocol, HSM is for key management, and load balancers distribute traffic, none addressing the access restriction requirement.

Why the other options are wrong:

• B. RADIUS is an authentication protocol, not a mechanism for accessing restricted network segments.
• C. HSM (Hardware Security Module) manages cryptographic keys, not administrative access routing.
• D. Load balancers distribute network traffic, not provide restricted access for administrators.

Correct answer: B

Code signing involves digitally signing company-developed software with a cryptographic signature, which proves the code's authenticity and origin. This ensures that the code has not been tampered with and that it genuinely comes from the company, addressing the requirement to ensure code authenticity.

Why the other options are wrong:

• A. Input validation testing focuses on security vulnerabilities, not on verifying code authenticity and origin.
• C. Static code analysis identifies bugs and vulnerabilities but does not establish the authenticity or origin of the code.
• D. Secure cookies protect session data but have no relationship to proving the authenticity of company-developed software.

Correct answer: D

A Statement of Work (SOW) is the appropriate document to outline project scope, deliverables, costs, and completion timeframes. It establishes the specific agreement between the security company and client for a defined engagement, making it the correct choice for this scenario.

Why the other options are wrong:

• A. Master Service Agreement (MSA) covers general terms and conditions for ongoing relationships, not specific project details.
• B. Service Level Agreement (SLA) defines performance metrics and uptime guarantees, not project scope and cost.
• C. Business Partnership Agreement (BPA) establishes long-term partnership terms, not individual project parameters.

Correct answer: A

When expanding to international locations, the hosting provider must first consider local data protection regulations such as GDPR, CCPA, and other regional privacy laws. These legal and compliance requirements directly impact how data can be stored, processed, and transferred, making them the primary consideration before any other factors.

Why the other options are wrong:

• B. While cybersecurity threats are important, they are not the primary first consideration compared to legal compliance requirements.
• C. Contractual obligations are important but follow from understanding the regulatory landscape that governs the new locations.
• D. Time zone differences are operational considerations that come later in the planning process, not a primary first consideration.

Correct answer: A

Single Sign-On (SSO) allows employees to use a single set of credentials (domain credentials) to authenticate to multiple applications, eliminating the need to maintain separate credentials for each SaaS application. LEAP and PEAP are wireless authentication protocols, not identity management solutions; MFA adds authentication factors but doesn't reduce credential management.

Why the other options are wrong:

• B. LEAP is a wireless authentication protocol, not applicable to SaaS credential management.
• C. MFA adds authentication factors but doesn't reduce the number of credential sets required.
• D. PEAP is a wireless authentication protocol, not a SaaS credential management solution.

Correct answer: D

Salting adds random data to input before applying a one-way hash function, increasing complexity and preventing rainbow table attacks. It is specifically designed to add extra complexity before hashing. Key stretching is a related but distinct technique that applies hashing multiple times, data masking obscures sensitive data visibility, and steganography hides information within other media.

Why the other options are wrong:

• A. Key stretching applies the algorithm repeatedly, not adding complexity before transformation.
• B. Data masking obscures data visibility rather than adding cryptographic complexity.
• C. Steganography hides information within media, unrelated to hash algorithms.

Correct answer: B

Option B correctly denies inbound traffic from the malicious source IP (10.1.4.9/32) to any destination (0.0.0.0/0). It uses 'deny' to block the traffic and specifies the attacker's IP as the source, which is the proper direction for blocking inbound attacks.

Why the other options are wrong:

• A. This rule denies traffic from all sources to the specific IP, which is backwards and doesn't block the malicious IP from attacking.
• C. This rule permits (allows) traffic from the malicious IP, the opposite of what is needed to block it.
• D. This rule permits traffic from all sources to the malicious IP, which both allows the attack and has incorrect permit logic.

Correct answer: D

Endpoint logs are the appropriate data source because they contain detailed information about executables running on the laptop, including process names, file hashes, execution paths, and behavior artifacts necessary to identify and analyze malicious executable activity.

Why the other options are wrong:

• A. Application logs record application-specific events but typically don't provide detailed executable process information needed for malware analysis.
• B. IPS/IDS logs capture network-level signatures and anomalies but don't contain information about specific executables running on local systems.
• C. Network logs show traffic patterns but lack visibility into which executables are running and their behavior on the endpoint itself.

Correct answer: D

Root cause analysis identifies the underlying factors that led to the incident, which is essential for preventing similar incidents from occurring in the future. This forward-looking approach addresses systemic issues, security gaps, and process improvements. While IoC gathering, affected systems discovery, and malware eradication are all part of incident response, they address immediate containment and investigation rather than the specific purpose of root cause analysis.

Why the other options are wrong:

• A. Gathering IoCs is part of investigation but not the primary purpose of root cause analysis.
• B. Discovering affected systems is part of scoping but not the purpose of root cause analysis.
• C. Eradicating malware is remediation; root cause analysis explains why the infection occurred.

Correct answer: A

Firmware version is hardware-specific because firmware is the low-level software programmed into hardware devices that controls their operation. Outdated or vulnerable firmware versions represent hardware-level security weaknesses. Buffer overflow, SQL injection, and cross-site scripting are all software-level vulnerabilities that can exist across different platforms and are not specific to hardware.

Why the other options are wrong:

• B. Buffer overflow is a software coding vulnerability, not hardware-specific.
• C. SQL injection is a database/application-level vulnerability, not hardware-specific.
• D. Cross-site scripting is a web application vulnerability, not hardware-specific.

Correct answer: B

A Disaster Recovery Plan (DRP) is required to manage the restore process and recovery procedures following system failures. It defines recovery steps, timelines, and responsibilities. RPO relates to data loss tolerance, IRP to incident response, and SDLC to development, none of which specifically manage restoration processes.

Why the other options are wrong:

• A. IRP (Incident Response Plan) addresses incident handling, not system restoration after failure.
• C. RPO (Recovery Point Objective) defines acceptable data loss but doesn't manage the actual restore process.
• D. SDLC (Software Development Life Cycle) governs software development, not disaster recovery and restoration.

Correct answer: B

A Web Application Firewall (WAF) is specifically designed to protect web applications by analyzing HTTP/HTTPS traffic and detecting/blocking attacks like buffer overflows, SQL injection, and XSS at the application layer. NGFW operates at network layer, TLS provides encryption, and SD-WAN manages network connectivity; none specifically protect against application-level exploits.

Why the other options are wrong:

• A. NGFW protects at the network layer and cannot detect application-level buffer overflow exploits.
• C. TLS provides encryption in transit but cannot prevent buffer overflow exploitation.
• D. SD-WAN manages network routing and connectivity, not application security threats.

Correct answer: D

A change management procedure should be adhered to when setting up new firewall rules to ensure changes are documented, reviewed, approved, tested, and implemented in a controlled manner that minimizes disruption and security risks. This process prevents unauthorized or untested changes from affecting network security. A disaster recovery plan addresses recovery after incidents, incident response procedures handle active security events, and business continuity plans ensure operations continue during disruptions.

Why the other options are wrong:

• A. A disaster recovery plan addresses recovery procedures after major incidents occur.
• B. Incident response procedures address how to handle active security incidents, not routine configuration changes.
• C. A business continuity plan ensures operations continue during disruptions, not specific to firewall rule implementation.

Correct answer: B

An application allow list (also called application whitelisting) is a security control that explicitly defines which programs are permitted to execute on a system. Any program not on the allow list is blocked from running, which directly prevents unknown and potentially malicious programs from executing.

Why the other options are wrong:

• A. Access control lists regulate file and resource permissions but do not control which programs can execute.
• C. A host-based firewall controls network traffic to and from a system but does not block unknown program execution.
• D. DLP (Data Loss Prevention) solutions monitor and protect data but do not prevent unknown programs from executing.

Correct answer: A

A bastion host (jump server) is the most secure method for providing administrative access while minimizing traffic through the security boundary because it acts as a hardened, monitored gateway that enforces strict access controls and centralized logging of all administrative activities.

Why the other options are wrong:

• B. A perimeter network provides segmentation but doesn't specifically minimize administrative traffic or provide the centralized access control of a bastion host.
• C. A WAF protects web applications but is not designed for securing administrative access to internal resources.
• D. Single sign-on addresses authentication convenience but does not minimize traffic through security boundaries or provide the access control mechanisms of a bastion host.