Free Security+ Practice Test 2026 (Set 2) (SY0-701 & SY0-801)

Question 1Security Operations

A company wants each employee to authenticate to the corporate Wi-Fi with individual credentials so access can be revoked per user and logged centrally. Which configuration BEST meets this requirement?

Correct answer: A. WPA3-Enterprise with a RADIUS server
WPA3-Enterprise uses 802.1X with a RADIUS server, so each user signs in with personal credentials that can be disabled individually. WPA3-Personal uses one shared passphrase, so revoking a single user means changing the key for everyone.

Question 2Threats, Vulnerabilities & Attacks

A school's website is knocked offline by a rented DDoS-for-hire service. The person responsible bragged about it on a forum and used no custom tools or advanced techniques. Which threat actor BEST fits?

Correct answer: C. Unskilled attacker
An unskilled attacker relies on ready-made tools or paid services and often seeks attention. Organized crime groups are typically after money and rarely advertise attacks on low-value targets just for bragging rights.

Question 3Security Architecture

A company is breaking a monolithic application into dozens of microservices that communicate through APIs. Which security implication should the architect expect?

Correct answer: D. Service-to-service authentication becomes harder to manage at scale
Microservices add many internal API connections, which expands the attack surface and requires strong authentication and authorization between services. A benefit of the model is that a flaw or failure in one service is usually contained rather than taking down everything.

Question 4General Security Concepts

After ransomware encrypts several file servers, the IT team rebuilds them and restores the data from last night's offline backups. Which control type does the restoration process represent?

Correct answer: D. Corrective
Corrective controls fix or reduce damage after an incident has occurred, and restoring from backups returns systems to a working state. Detective controls identify that an incident happened, but they do not repair the harm.

Question 5Program Management & Oversight

A company's data center is valued at $500,000. A fire is expected to damage 40% of it, and such a fire is estimated to occur once every ten years. What is the single loss expectancy (SLE)?

Correct answer: B. $200,000
SLE = asset value x exposure factor = $500,000 x 0.40 = $200,000. $20,000 is the ALE, which multiplies the SLE by the ARO of 0.1, and that is not what the question asks.

Question 6Security Operations

A company lets employees use personal phones for work email. If a phone is lost or the employee leaves, the company must remove corporate data without touching personal photos and apps. Which solution BEST meets this need?

Correct answer: B. Selective wipe of an MDM container
MDM containerization keeps corporate apps and data separate from personal content, so the company can wipe only the work container. A full-device wipe would remove the corporate data, but it would also erase the employee's personal content, which the requirement rules out.

Question 7Threats, Vulnerabilities & Attacks

A group runs ransomware with an affiliate payout program, a victim support portal and a leak site that publishes stolen data from victims who refuse to pay. Which actor and motivation BEST match?

Correct answer: D. Organized crime, financial gain
Affiliate programs, support portals and extortion leak sites are business features of organized crime chasing profit. Hacktivists leak data to make a political point, not to pressure victims into paying.

Question 8Security Architecture

A security architect is comparing containers with virtual machines for hosting workloads from different business units on the same physical server. Which security consideration applies MOST to containers?

Correct answer: C. Containers share the host's kernel, so a kernel flaw can expose all of them
Containers isolate processes but share the host operating system kernel, so a kernel vulnerability or container escape can affect every container on that host. Virtual machines each run their own kernel on a hypervisor, which gives stronger isolation between tenants.

Question 9General Security Concepts

A network team configures its RADIUS server to record each VPN user's login time, logout time, and amount of data transferred during the session. Which AAA function does this provide?

Correct answer: B. Accounting
Accounting tracks what users do and how long they are connected, creating records for auditing and billing. Authorization decides what a user is allowed to access, but it does not log session activity.

Question 10Security Operations

A developer adds JavaScript checks to a web form so users cannot enter SQL characters in the search box. A tester still performs SQL injection by sending crafted requests directly to the server. What should the developer implement?

Correct answer: C. Server-side input validation
Input validation must be enforced on the server, because attackers can bypass browser-side checks by sending requests through a proxy or script. Stronger client-side filtering has the same weakness as the original fix, since the client is under the attacker's control.

Question 11Threats, Vulnerabilities & Attacks

New IP cameras are added to a botnet within hours of being connected to the internet. Logs show the attacker logged in with the vendor's factory admin account. Which action would have MOST directly prevented this?

Correct answer: A. Replacing vendor default passwords
The attacker used the factory admin login, so changing default credentials before deployment closes that exact door. Longer log retention helps investigations later but does nothing to stop the login.

Question 12Program Management & Oversight

A company's SLE for a phishing-driven account compromise is $12,000, and it expects three incidents per year. A training program costing $20,000 per year would reduce the ARO to one. What is the program's net annual benefit?

Correct answer: B. $4,000
ALE drops from $12,000 x 3 = $36,000 to $12,000 x 1 = $12,000, a $24,000 reduction. Subtracting the $20,000 program cost leaves a net benefit of $4,000. $24,000 forgets to subtract the cost of the control.

Question 13Security Operations

An audit finds dozens of networked IP cameras still using the manufacturer's default admin username and password. Which hardening step should be performed FIRST?

Correct answer: A. Change the default credentials
Default credentials are publicly documented, so changing them is the first and most effective hardening step for IoT and embedded devices. Antivirus agents usually cannot be installed on embedded devices like cameras, and they would not fix the weak login anyway.

Question 14Security Architecture

A company is deploying a public web server that must be reachable from the internet but should not give attackers a direct path into the internal network if it is compromised. Where should the server be placed?

Correct answer: C. In a screened subnet between the external and internal firewalls
A screened subnet, formerly called a DMZ, is a separate security zone for internet-facing services, so traffic from a compromised server is still filtered before it reaches internal systems. Placing the server on the internal LAN would hand an attacker who breaches it a direct path to sensitive assets.

Question 15Threats, Vulnerabilities & Attacks

A lab instrument is controlled by a PC running an operating system that no longer receives security patches, and the vendor will not certify a newer OS. Which control BEST reduces the risk?

Correct answer: D. Place it on an isolated segment with tight ACLs
When an unsupported system cannot be replaced, isolating it on a segmented network limits who can reach it and contains any compromise. Automatic updates will not help because no new security patches are being released.

Question 16General Security Concepts

A software vendor publishes a SHA-256 hash beside each download so customers can check that the file they received was not altered. Which security goal does this primarily support?

Correct answer: D. Integrity
Comparing a downloaded file's hash with the published value shows whether the file changed, which supports integrity. A hash alone does not prove who created the file, so it does not provide non-repudiation the way a digital signature does.

Question 17Security Operations

Visitors have been plugging laptops into unused network jacks in conference rooms and getting network access. Which switch hardening measure BEST prevents this?

Correct answer: A. Disable unused switch ports
Disabling ports that are not in use removes the easy entry point a visitor or attacker would use. Spanning tree prevents switching loops and does nothing to stop an unauthorized device from connecting.

Question 18Program Management & Oversight

A business impact analysis concludes that the order-processing system must be running again within four hours of any outage, or the company starts losing major customers. Which metric has the business just defined?

Correct answer: B. Recovery time objective
RTO is the maximum acceptable time to restore a system after an outage, and the BIA sets it from business impact. RPO is about how much data loss is acceptable, not how long the system can be down.

Question 19Threats, Vulnerabilities & Attacks

Several USB drives labeled 'Q4 Salary Review' are found in the parking lot, and one employee has already plugged one in. Which control would BEST stop this vector from compromising endpoints?

Correct answer: D. Block unapproved USB storage on endpoints
Endpoint policy that blocks unapproved USB storage stops malicious drives from mounting or running anything, which directly addresses the removable media vector. MFA for VPN protects remote logins but does nothing about a device plugged into an office PC.

Question 20Security Architecture

A manufacturer runs embedded controllers with a real-time operating system on its production line. The vendor no longer releases firmware updates, and the devices cannot run endpoint security agents. What is the BEST way to reduce risk?

Correct answer: C. Place the controllers on an isolated network segment
When devices cannot be patched or run security software, network segmentation is the main compensating control because it limits who can reach them. A host-based firewall is itself software that these constrained devices cannot run.

Question 21Security Operations

A regulation requires a company to keep customer transaction records for seven years and then dispose of them. Which policy should define these timeframes?

Correct answer: A. Data retention policy
A data retention policy states how long each type of data must be kept and when it must be disposed of, often based on legal requirements. A data classification policy labels data by sensitivity, but it does not set how long records are stored.

Question 22General Security Concepts

Which zero trust component operates in the data plane and directly allows, monitors, and terminates connections between a subject and an enterprise resource?

Correct answer: C. Policy enforcement point
The policy enforcement point sits in the data plane and acts as the gatekeeper that opens, monitors, and closes connections. The policy administrator is in the control plane and only sends commands to the enforcement point; it does not handle the traffic itself.

Question 23Threats, Vulnerabilities & Attacks

Staff who mistype the company's HR portal address land on a lookalike login page hosted on a domain that differs from the real one by two swapped letters. Which attack BEST describes this?

Correct answer: A. Typosquatting
Typosquatting registers domains that match common typing mistakes so users reach a fake site by accident. A watering hole compromises a legitimate site the victims already visit, not a lookalike domain.

Question 24Security Architecture

A company adopts software-defined networking, moving forwarding decisions to a centralized controller that programs switches through APIs. Which security consideration becomes MOST important?

Correct answer: B. Protecting the controller, since compromising it affects the whole network
SDN separates the control plane from the data plane and centralizes control in the controller, which makes the controller a high-value target. An attacker who controls it can reroute or disrupt traffic across the entire network.

Question 25Security Operations

During an audit, several cloud virtual machines are found running outdated software, and no team can say who is responsible for maintaining them. Which asset management practice was MOST likely missed?

Correct answer: A. Assigning ownership
Every asset should have an assigned owner who is accountable for its maintenance, patching, and eventual disposal. Procurement approval controls how assets are acquired, but an approved asset can still go unmanaged if no owner is recorded.

Question 26Program Management & Oversight

A risk manager adds a metric to the risk register that tracks the number of internet-facing servers missing critical patches, so leadership is warned when exposure starts rising. What is this metric called?

Correct answer: C. Key risk indicator
A key risk indicator is a measurable value that signals when a risk is increasing, giving early warning before it becomes a problem. A risk threshold is the level at which action is required, not the metric being tracked.

Question 27Threats, Vulnerabilities & Attacks

A caller claims to be from the IT help desk, says the user's mailbox is being migrated tonight, and asks for the MFA code just sent to the user's phone to confirm the account. Which term BEST describes the invented story used to justify the request?

Correct answer: B. Pretexting
Pretexting is creating a believable cover story, such as a mailbox migration, to get a victim to hand over information. Smishing uses text messages as the delivery channel, while here the lure is a phone call built around a made-up scenario.

Question 28Security Operations

A scan finds a CVSS 9.1 flaw on an isolated lab server with no network path to production, and a CVSS 7.5 flaw on an internet-facing web server with a public exploit being used in the wild. Which should be fixed FIRST?

Correct answer: D. The web server flaw, because it is exposed and being exploited
Prioritization should weigh exposure and active threat activity, not just the CVSS base score, so an internet-facing flaw with a working exploit carries more real risk. The lab server's higher score matters less because an attacker has no network path to reach it.

Question 29General Security Concepts

A data center wants to stop tailgating by making sure only one person at a time can pass through its entrance after badging in. Which physical control BEST meets this need?

Correct answer: A. Access vestibule
An access vestibule uses two doors that cannot both be open at the same time, so people must pass through one at a time. Video surveillance can record tailgating, but it detects the problem rather than physically stopping it.

Question 30Security Architecture

A web application runs on four servers behind a load balancer. One server crashes, yet users notice no outage. Which load balancer feature made this possible?

Correct answer: B. Health checks that stop sending traffic to servers that fail
Load balancers run health checks and pull unresponsive servers out of the pool, so traffic goes only to healthy nodes. Round-robin scheduling by itself would keep sending a share of requests to the failed server.

Question 31Threats, Vulnerabilities & Attacks

Hundreds of newly created social media accounts post the same false claim that a company's product is being recalled for safety issues, and the company's stock price drops. Which threat vector BEST describes this?

Correct answer: A. Disinformation campaign
A disinformation campaign deliberately spreads false information to damage reputation or move markets. Brand impersonation would involve accounts pretending to be the company itself, while these accounts posed as ordinary people repeating a false claim.

Question 32Program Management & Oversight

An online bank determines that its peer-to-peer payment feature carries fraud risk far greater than the revenue it brings in, so it permanently removes the feature. Which risk strategy is this?

Correct answer: D. Avoidance
Avoidance eliminates a risk by ending the activity that creates it, which is what removing the feature does. Mitigation would keep the feature and add controls, such as fraud monitoring, to reduce the risk.

Question 33Security Operations

A vulnerability scan of Windows servers produces many inaccurate findings because the scanner could only guess at installed software versions from network banners. Which change would MOST improve accuracy?

Correct answer: A. Run credentialed scans
A credentialed scan logs in to the host and reads installed software and patch levels directly, which greatly reduces false positives. Scanning more often would repeat the same guesswork and produce the same inaccurate results.

Question 34Security Architecture

A company wants all employee web traffic to pass through a central device that enforces URL filtering, caches content, and logs which sites users visit. Which solution BEST fits?

Correct answer: C. A forward proxy that handles outbound requests from internal users
A forward proxy sits between internal users and the internet, so it can filter, cache, and log outbound web requests. A reverse proxy does the opposite job, accepting inbound requests on behalf of internal servers.

Question 35Threats, Vulnerabilities & Attacks

During an investigation, an analyst sees that a domain controller recorded no security events between 01:10 and 03:40, while every other server logged normally. An admin account was used during that window. Which indicator does this represent?

Correct answer: A. Missing logs
A gap in one system's logs during suspicious activity suggests an attacker stopped or cleared logging to hide their actions. Out-of-cycle logging is the opposite case, where log entries appear at unusual times rather than disappearing.

Question 36General Security Concepts

A museum wants an alarm to trigger the moment a valuable artifact is lifted off its display pedestal, even while the gallery is open and full of visitors. Which sensor type BEST fits?

Correct answer: D. Pressure
A pressure sensor detects a change in weight, so removing the object from the pedestal triggers it. Infrared, microwave, and ultrasonic sensors detect motion or heat in an area and would alarm constantly as visitors walk through the open gallery.

Question 37Security Operations

A software company wants independent security researchers to find and responsibly report vulnerabilities in its public web services in exchange for monetary rewards. Which program should it establish?

Correct answer: B. A bug bounty program
A bug bounty program invites outside researchers to report vulnerabilities and pays rewards for valid findings. A red team engagement uses a contracted team with a defined scope and timeline, not an open invitation to independent researchers.

Question 38Program Management & Oversight

A company already has a master service agreement with a security consulting firm. It now needs a document that defines the deliverables, timeline, and cost for one specific penetration test. Which document should be used?

Correct answer: C. Statement of work
A statement of work (or work order) defines the tasks, deliverables, schedule, and pricing for a single project under an existing MSA. An MOU only records shared intent and does not define project deliverables or cost.

Question 39Threats, Vulnerabilities & Attacks

A web server's CPU has run near 100% for three days with no rise in traffic, and it keeps connecting out to an unknown group of hosts on an unusual port. Which indicator BEST describes the primary symptom?

Correct answer: B. Resource consumption
Sustained high CPU with no matching workload is a resource consumption indicator, often caused by cryptomining malware. Out-of-cycle logging refers to logs written at unexpected times, which the scenario does not describe.

Question 40Security Operations

A critical patch would break a legacy billing application, so the business will not patch until the application is replaced next quarter. The CISO signs a document accepting the risk with an expiration date. What does this represent?

Correct answer: D. A documented exception
An exception formally records that a known vulnerability will remain unremediated for a set period, with leadership accepting the risk until it expires. A compensating control would add another safeguard to reduce the risk, and the scenario describes no such safeguard.

Question 41Security Architecture

A security team must block one specific file-sharing application while still allowing all other HTTPS traffic on port 443. Which firewall capability is required?

Correct answer: B. Application awareness that identifies traffic beyond its port number
A next-generation or layer 7 firewall identifies applications by inspecting traffic content and behavior, so it can block one app that shares port 443 with allowed traffic. Stateful layer 4 filtering sees only addresses, ports, and session state, which cannot tell two HTTPS applications apart.

Question 42General Security Concepts

A security team builds an isolated network of decoy servers, workstations, and services so it can watch how attackers move from one system to another. What is this called?

Correct answer: C. Honeynet
A honeynet is a group of connected decoy systems that lets defenders study attacker behavior, including lateral movement. A single honeypot is one decoy system, so it cannot show movement across a network the same way.

Question 43Threats, Vulnerabilities & Attacks

During a desk audit, a technician finds a small adapter plugged between a finance clerk's keyboard cable and the PC's USB port. IT did not issue it. Which threat is MOST likely?

Correct answer: A. Hardware keylogger
A device placed inline between keyboard and computer captures every keystroke, which is a hardware keylogger. A firmware rootkit lives inside the system's own firmware and would not appear as a separate adapter on the cable.

Question 44Security Operations

A company wants to automatically block employees from emailing files that contain customer credit card numbers or uploading them to personal cloud storage. Which solution BEST meets this need?

Correct answer: D. Data loss prevention
DLP inspects content for sensitive patterns, such as credit card numbers, and can block or alert when that data leaves through email or web uploads. Full-disk encryption protects data on a lost device but does nothing to stop a logged-in user from sending data out.

Question 45Security Architecture

Two branch offices need a site-to-site VPN over the internet that encrypts the entire original IP packet, including its original headers. Which IPsec configuration meets this requirement?

Correct answer: A. ESP in tunnel mode
ESP provides encryption, and tunnel mode wraps the whole original packet, headers included, inside a new IP packet, which is the usual choice for site-to-site VPNs. AH provides integrity and authentication only, so it never encrypts anything in either mode.

Question 46Program Management & Oversight

A company plans to buy network switches from a new vendor and wants to find out whether the vendor's components come from manufacturers with a history of counterfeit or tampered parts. Which assessment BEST meets this goal?

Correct answer: C. Supply chain analysis
Supply chain analysis examines where a vendor's components and services come from and the risks tied to those sources, such as counterfeit hardware. A penetration test looks for exploitable weaknesses in systems, not the origin of parts.

Question 47Security Operations

A SIEM generates hundreds of port scan alerts every week, and nearly all of them come from the company's authorized vulnerability scanner. What is the BEST action?

Correct answer: D. Tune the rule to exclude the scanner
Alert tuning removes known benign activity, such as an authorized scanner, so analysts can focus on real threats while the rule still catches scans from other sources. Disabling the rule entirely would also hide port scans by actual attackers.

Question 48Threats, Vulnerabilities & Attacks

A user downloads a free PDF converter from a forum. It converts files as promised, but EDR later shows it opened a persistent remote connection that lets an outsider control the PC. Which malware type BEST describes it?

Correct answer: D. Trojan
A trojan pretends to be useful software while secretly installing malicious functions, such as a remote access tool. A worm spreads by itself across the network, while this program needed the user to download and run it.

Question 49General Security Concepts

Before approving a request to change the company's VPN authentication method, the change advisory board asks the team to identify which users, systems, and business processes could be affected and how. What is the board requesting?

Correct answer: B. Impact analysis
An impact analysis identifies what a change could affect and the risks it introduces before it is approved. A backout plan explains how to undo the change, but it does not assess who or what will be affected.

Question 50Security Architecture

A company with a mostly remote workforce wants to retire its on-premises VPN concentrator and branch security appliances. It needs cloud-delivered secure web gateway, CASB, and zero trust network access combined with WAN networking. Which approach BEST fits?

Correct answer: C. Secure access service edge (SASE)
SASE combines SD-WAN with cloud-delivered security services such as SWG, CASB, firewall as a service, and ZTNA, applying policy close to users wherever they work. SD-WAN alone improves branch connectivity but does not deliver those security services.

Question 51Security Operations

A security team needs process-level telemetry and the ability to isolate laptops even when employees work from home without connecting to the VPN. Which approach BEST meets this requirement?

Correct answer: D. Agent-based endpoint monitoring
An installed agent runs on the laptop itself, so it can collect detailed process data and respond to threats wherever the device is. Agentless scanning depends on reaching the device over the network, which fails when laptops are off the corporate network.

Question 52Threats, Vulnerabilities & Attacks

After compromising one workstation, an attacker extracts a cached NTLM password hash and uses it directly to authenticate to a file server without ever cracking it. Which attack is this?

Correct answer: C. Credential replay
Reusing a captured hash or token to log in without knowing the plaintext password is credential replay, often called pass-the-hash. Brute force tries to guess the password itself, which the attacker never needed to do here.

Question 53Program Management & Oversight

Before an external penetration test begins, both parties sign a document that lists in-scope IP ranges, allowed testing hours, prohibited techniques, and emergency contacts. What is this document called?

Correct answer: B. Rules of engagement
Rules of engagement define the scope, timing, methods, and communication plan for a test so the tester stays within authorized limits. A non-disclosure agreement protects confidential information but does not set testing boundaries.

Question 54General Security Concepts

A developer wants stored password hashes to be much slower for attackers to crack offline, so the hashing function is run through thousands of iterations for each password. Which technique is this?

Correct answer: C. Key stretching
Key stretching, used by algorithms such as PBKDF2 and bcrypt, repeats the hashing process many times so each guess costs the attacker more time. Salting makes each hash unique, but on its own it does not slow down individual guesses.

Question 55Security Operations

A user wants to let a third-party scheduling app read their corporate calendar without giving the app their password. Which standard is designed for this kind of delegated authorization?

Correct answer: A. OAuth
OAuth issues access tokens that let an application act on a user's behalf with limited permissions, without ever seeing the user's password. SAML is mainly used for web SSO between an identity provider and a service provider, not for granting an app delegated access to a resource.

Question 56Threats, Vulnerabilities & Attacks

An employee on hotel Wi-Fi gets repeated certificate warnings. Investigation shows the default gateway's IP address in the laptop's ARP table maps to the MAC address of another guest's device. Which attack is MOST likely occurring?

Correct answer: B. On-path attack
Spoofed ARP entries route the victim's traffic through the attacker's machine, which is an on-path attack, and the certificate warnings come from attempts to intercept TLS. A replay attack resends captured traffic later and does not require redirecting the victim's gateway.

Question 57Security Architecture

A retailer with 200 stores wants branch traffic to move dynamically across broadband, LTE, and MPLS links based on application performance, with all policies managed from one central console. Which technology BEST fits?

Correct answer: A. Software-defined WAN with centrally managed path selection
SD-WAN centrally manages branch connectivity and steers traffic across several transport types based on policy and live link performance. Static routes and manual tunnels cannot adapt to link conditions and are hard to manage across hundreds of sites.

Question 58Security Operations

A company wants to prevent contractor accounts from logging in outside 7:00 a.m. to 7:00 p.m. on weekdays, even when the credentials are valid. Which control BEST meets this need?

Correct answer: C. Time-of-day restrictions
Time-of-day restrictions are a rule-based control that allows logins only during approved hours, regardless of whether the password is correct. An account lockout policy reacts to repeated failed logins and would not block a valid login at midnight.

Question 59Program Management & Oversight

A customer in the European Union asks an online retailer to permanently erase all personal data it holds about her because she no longer uses the service. Which privacy concept is she exercising?

Correct answer: D. Right to be forgotten
The right to be forgotten, also called the right to erasure, lets a data subject ask an organization to delete their personal data. A data subject access request asks for a copy of the data held, not its deletion.

Question 60Threats, Vulnerabilities & Attacks

A fuzz test sends a 5,000-character string to a login field on a service written in C. The service crashes, and the crash dump shows part of the test string in the instruction pointer. Which vulnerability is indicated?

Correct answer: D. Buffer overflow
Input that overruns a fixed-size buffer and overwrites the instruction pointer is a classic buffer overflow, which can let an attacker redirect execution. A memory leak slowly wastes memory over time and would not place user input into the instruction pointer.

Question 61Security Architecture

An audit finds that payroll spreadsheets on a shared drive can be opened by every employee in the company. The payroll team must keep working on the files without new software. Which data protection method BEST fixes this?

Correct answer: A. Restrict the folder permissions to the payroll group only
The problem is too-broad access, so permission restrictions that follow least privilege fix it directly with no change to how the payroll team works. Hashing only detects changes, and TLS protects data in transit, not who can open the files.

Question 62General Security Concepts

A company needs one TLS certificate to secure www.example.com, mail.example.net, and shop.example.org. Which certificate type BEST meets this need?

Correct answer: B. SAN certificate
A Subject Alternative Name (SAN) certificate can list multiple specific names, even across different domains, in one certificate. A wildcard certificate covers subdomains of only one domain, such as *.example.com, so it cannot cover these three domains.

Question 63Security Operations

A company is replacing passwords with passkeys on its customer portal. Why are passkeys considered resistant to phishing?

Correct answer: D. They work only for the site they were created for
Passkeys use public key cryptography bound to the site's domain, so a fake site cannot use a passkey created for the real one, and the private key never leaves the device. SMS one-time codes can still be phished, because a user can be tricked into typing the code into a fake login page.

Question 64Threats, Vulnerabilities & Attacks

Customers install a digitally signed update from a trusted software vendor. Weeks later it is found to contain a backdoor because attackers had compromised the vendor's build server. Which vulnerability BEST describes this?

Correct answer: C. Malicious update
A malicious update delivers harmful code through a legitimate, signed update channel, so the signature gives a false sense of safety. A zero-day exploit targets an unknown flaw in software, while here the vendor's own update was the carrier.

Question 65Program Management & Oversight

A SaaS provider hires an outside accounting firm to evaluate its security controls and issue a formal report that customers can rely on during vendor reviews. Which type of assessment is this?

Correct answer: B. Independent third-party audit
An independent third-party audit is performed by an outside firm with no stake in the results, so customers can trust the report. A regulatory examination is carried out by a government regulator to enforce rules, not hired by the company for its customers.

Question 66Security Operations

A CI/CD pipeline uses a long-lived cloud API key stored in a configuration file to deploy builds. Which change BEST reduces the risk if the key is exposed?

Correct answer: C. Use ephemeral credentials issued per job
Ephemeral credentials are short-lived and expire automatically, so a leaked credential becomes useless within minutes. Encrypting the config file still leaves a long-lived key in place, and the static encryption key becomes one more secret to protect.

Question 67Security Architecture

A security team wants to prove later that archived log files have not been modified since collection, without making the logs unreadable to analysts. Which method BEST meets this goal?

Correct answer: A. Hashing
A hash is a fixed-length fingerprint of the data, so recomputing it later and comparing values shows whether anything changed, while the logs stay readable. Encryption protects confidentiality and would make the logs unreadable without a key, and by itself it does not prove the content is unchanged.

Question 68Threats, Vulnerabilities & Attacks

A server compromised through its baseboard management controller is wiped and the OS reinstalled, but the same malicious beaconing starts again within hours. Why did reimaging MOST likely fail?

Correct answer: B. The implant resides in firmware, not the OS disk
Malware in firmware such as a BMC sits below the operating system, so wiping the disk leaves it in place. A race condition in the installer would need a fresh exploit each time and does not explain persistence through a clean reinstall.

Question 69General Security Concepts

A call center application shows agents only the last four digits of a customer's card number and displays the remaining digits as asterisks. Which data protection technique is this?

Correct answer: A. Data masking
Data masking hides part of the data from view while still letting the user work with it, such as confirming the last four digits. Tokenization replaces the whole value with a random substitute for storage rather than partially hiding it on screen.

Question 70Security Operations

Every quarter, department managers must review a list of their employees' application permissions and confirm that each one is still needed. What is this process called?

Correct answer: C. Access attestation
Attestation, also called access recertification, is the periodic review in which managers confirm that users' access is still appropriate. Provisioning is the initial creation of accounts and granting of access, not the later check that the access is still needed.

Question 71Security Architecture

A company's primary and backup data centers are 15 miles apart in the same coastal region. A risk assessment warns that a single hurricane could disable both sites. Which resilience strategy addresses this finding?

Correct answer: B. Geographic dispersion
Geographic dispersion places sites far enough apart that one regional event, such as a hurricane, flood, or grid failure, cannot affect both. Replicating data between the two existing sites does not help if the same storm takes both offline.

Question 72Threats, Vulnerabilities & Attacks

An employee enables installs from unknown sources on a corporate Android phone and installs a game downloaded from a third-party website. Which risk BEST describes this action?

Correct answer: D. Sideloading
Sideloading installs apps from outside the official store, skipping its vetting and malware checks. Rooting or jailbreaking removes the operating system's built-in restrictions, which is a separate step from simply allowing unknown-source installs.

Question 73Program Management & Oversight

A SOC analyst handling a suspected ransomware infection opens a document with predefined, step-by-step actions for containment, evidence collection, and escalation. What is this document?

Correct answer: A. Playbook
A playbook is a procedure that gives detailed, step-by-step actions for responding to a specific type of incident. A standard sets mandatory requirements, such as minimum encryption strength, but does not walk an analyst through a response.

Question 74Security Operations

A company must meet a multifactor authentication requirement for remote access. Which combination of credentials satisfies it?

Correct answer: B. A smart card and a PIN
A smart card is something you have and a PIN is something you know, so together they provide two different factors. A fingerprint and a face scan may feel stronger, but both are something you are, which makes them a single factor type.

Question 75General Security Concepts

Two servers need to agree on a shared symmetric session key over an untrusted network without ever sending the key itself across that network. Which method BEST accomplishes this?

Correct answer: D. Diffie-Hellman key exchange
Diffie-Hellman lets two parties each compute the same shared secret from exchanged public values, so the key itself never crosses the network. Out-of-band distribution still sends the key, just over a separate channel, which adds logistics and exposure.

Question 76Threats, Vulnerabilities & Attacks

Threat intel warns that attackers are exploiting a flaw in a popular VPN appliance that the vendor has not yet acknowledged, and no patch or signature exists. Which control is MOST likely to detect exploitation?

Correct answer: D. Behavior-based anomaly detection
Behavior-based detection flags unusual activity, such as unexpected processes or traffic, without needing a known signature. Vulnerability scans and signatures both depend on the flaw already being known, which is not the case with a zero-day.

Question 77Security Architecture

A security architect is concerned that a single zero-day vulnerability in one operating system could take down every web server the company runs, since all of them use the same OS build. Which strategy MOST directly reduces this risk?

Correct answer: A. Platform diversity
Platform diversity uses different operating systems, vendors, or technologies so one flaw cannot hit every system at once. Server clustering adds redundancy, but identical cluster nodes share the same vulnerability and can all fail together.

Question 78Security Operations

A forensic investigator hands a seized hard drive to a second analyst for imaging. What should be updated to show who has handled the evidence and when?

Correct answer: C. The chain of custody form
The chain of custody form records every person who handled the evidence, when, and why, which supports its admissibility in court. A legal hold notice tells staff to preserve data, but it does not track the physical handling of evidence.

Question 79Program Management & Oversight

A database administrator performs nightly backups, applies access permissions, and maintains encryption on a customer database, following rules set by the sales director who is accountable for that data. What role does the administrator hold?

Correct answer: A. Data custodian
A data custodian, or steward, handles the day-to-day protection of data, such as backups and access controls, under the owner's direction. The sales director is the data owner, who is accountable for the data and decides how it is protected.

Question 80Threats, Vulnerabilities & Attacks

A finance manager receives a video call from someone who looks and sounds exactly like the CEO, urgently requesting a confidential wire transfer to close an acquisition. Which step BEST guards against this deepfake risk?

Correct answer: B. Verify through a callback to a known number
Calling back on a number already on file uses a separate channel the attacker does not control, which defeats convincing fake audio or video. Caller ID and display names can be spoofed, so they do not prove who is really on the call.

Question 81General Security Concepts

A company wants each laptop's full-disk encryption keys bound to that laptop's hardware so the drive cannot be read if it is removed and placed in another machine. Which component BEST supports this?

Correct answer: B. Trusted Platform Module
A TPM is a chip on the motherboard that stores keys and can seal them to that specific device, which is how full-disk encryption binds a drive to its laptop. An HSM is a separate, often network-attached device for high-volume key operations, not something built into each laptop.

Question 82Security Operations

An incident responder arrives at a running server suspected of compromise. Following the order of volatility, which data should be collected FIRST?

Correct answer: C. Contents of system memory
System memory is highly volatile and is lost when the server powers off, so it should be captured before less volatile sources. A disk image is important, but data on the drive survives shutdown and can be collected afterward.

Question 83Security Architecture

A storage array's vendor states that it averages 50,000 hours between failures, and the operations team averages 4 hours to restore it after each failure. Which metric does the 4-hour figure represent?

Correct answer: B. Mean time to repair
Mean time to repair is the average time needed to restore a failed component, so the 4-hour figure is MTTR, while the 50,000 hours is MTBF. RTO is a target the business sets for maximum acceptable downtime, not a measured average.

Question 84Threats, Vulnerabilities & Attacks

Phishing emails reaching staff now have flawless grammar and mention recent projects pulled from employees' public posts. Which update to security awareness training is MOST appropriate?

Correct answer: D. Stress verifying odd requests over spotting typos
AI tools remove the spelling and grammar mistakes users were trained to look for, so training should focus on unusual requests, urgency and verification steps. Teaching users to hunt for typos would make them more likely to trust a polished AI-written message.

Question 85Security Operations

Without warning the SOC, the security team launches a controlled, realistic phishing and malware scenario against a test group of users to see whether analysts detect and respond to it as they would in a real incident. Which type of incident response test is this?

Correct answer: A. Simulation
A simulation runs a realistic scenario that the team must actually detect and respond to, testing tools and people together. A tabletop exercise only talks through the steps in a meeting without any live activity.

Question 86Program Management & Oversight

A company runs monthly simulated phishing campaigns. Which metric BEST shows that its security awareness program is actually changing employee behavior over time?

Correct answer: C. Rising share of staff who report simulated phishing
A growing reporting rate shows employees are recognizing phishing and taking the right action, which is a real change in behavior. Training completion only proves people went through the material, not that they act differently.

Question 87General Security Concepts

A group of companies wants a shared, distributed record of transactions in which each block contains the hash of the previous block, so any change to past entries is easy to detect. Which technology fits this description?

Correct answer: A. Blockchain
A blockchain is a distributed, open ledger where each block stores the hash of the one before it, so altering an old record breaks the chain. PKI uses certificates to bind identities to public keys, but it is not a chained ledger of transactions.

Question 88Security Architecture

Before applying a risky update to a virtual server, an administrator wants a way to roll the VM back to its exact current state within minutes if the update fails. Which approach BEST meets this need?

Correct answer: D. Take a snapshot of the virtual machine beforehand
A snapshot captures the VM's full state at a point in time and can be reverted quickly, which suits rollback before a change. Replication would copy the failed update to the second host, and a tape restore takes far longer.

Question 89Threats, Vulnerabilities & Attacks

A competitor sends millions of carefully chosen queries to a company's paid prediction API and uses the responses to train a near-identical model of its own. Which AI risk does this describe?

Correct answer: A. Model theft
Model theft, also called model extraction, copies a model's behavior by studying its outputs at scale. Data poisoning would require changing the training data to corrupt the original model, not copying it.

Question 90Security Operations

After detecting an outbound connection to a known malicious server, an analyst must determine exactly which files were transferred during the session. Which data source BEST provides this?

Correct answer: C. Packet captures
A packet capture records full packet contents, so the analyst can reconstruct the session and see exactly what was transferred. NetFlow shows that the connection happened and how much data moved, but not the content itself.