Free CompTIA Security+ Sample Questions

Correct answer: B — Rollback plan

• A. A risk assessment is typically conducted before a change is implemented to evaluate potential impacts and the likelihood of issues. It is a proactive planning step and does not provide a mechanism for service restoration after an application has already crashed.
• B. A rollback plan is a predefined strategy used to revert a system to its previous known-good state if a change or patch fails. Executing this plan is the fastest and most appropriate way to restore service in this scenario.
• C. Version control commits are used to record and track history of code or configuration changes. While essential for tracking modifications over time, they are not the primary change management component used to restore an application in a production emergency.
• D. While an incident response plan (IRP) is used to handle security breaches or significant outages, it is a broad framework for coordination. The specific change management component designed to undo a failed patch and restore functionality is the rollback plan.

Correct answer: A — Directive

• A. Directive controls are management-level policies, standards, and guidelines designed to provide direction and ensure compliance with regulations or security objectives. The compliance board's policy mandates specific actions and timeframes, which is the definition of a directive control function.
• B. Compensating controls are alternative security measures put in place when a primary control is not technically or economically feasible to implement. This scenario describes the establishment of a primary policy requirement rather than an alternative measure.
• C. Detective controls are designed to identify, discover, or alert the organization to security events or policy violations after they have occurred (e.g., audit logs or intrusion detection systems). A written policy document is a proactive administrative measure, not a detection mechanism.
• D. Corrective controls are intended to remediate issues, fix systems, or restore operations to a secure state following a security incident or failure. The issuance of an implementation policy is a proactive step to prevent data exposure, not a reactive fix for an existing incident.

Correct answer: A — Salting

• A. Correct. Salting involves adding a unique, random value to each password before hashing. This ensures that identical passwords result in different hashes, effectively rendering precomputed rainbow tables useless since the tables would need to be recalculated for every possible salt value.
• B. Incorrect. Symmetric encryption uses a single secret key to encrypt and decrypt data. It is generally not used for password storage because it is reversible, and if the key is compromised, all passwords could be decrypted. It does not address the specific issue of rainbow table attacks on hashes.
• C. Incorrect. Digital signatures provide integrity, authentication, and non-repudiation for messages or software using asymmetric cryptography. They do not protect password hashes from offline cracking attacks like rainbow tables.
• D. Incorrect. Key escrow is the practice of storing cryptographic keys with a trusted third party for recovery purposes. This is a key management strategy and does not provide a technical defense against rainbow table attacks on a database.

Correct answer: B — Integrity

• A. Confidentiality ensures that sensitive information is not disclosed to unauthorized individuals. In this scenario, the software is intended for public distribution, so the issue is not about data exposure or secrecy, but rather the unauthorized modification of the file.
• B. Integrity ensures that data, software, or communications remain accurate, complete, and unaltered from their original intended state. Because a threat actor intercepted the download and injected malicious code into the executable, the file's integrity was compromised.
• C. Availability ensures that systems and data are accessible to authorized users when needed. While the malicious code might eventually cause a system to crash, the core principle violated during the download process was the trustworthiness of the data, not the inability to access it.
• D. Non-repudiation provides proof of the origin or delivery of data to prevent someone from denying their actions. While digital signatures are a tool used to provide both integrity and non-repudiation, the act of tampering with a file is specifically a violation of the integrity principle.

Correct answer: A — Evil twin

• A. An evil twin is a type of rogue wireless access point specifically configured to mimic the SSID (Service Set Identifier) of a legitimate network. By creating a lookalike name (e.g., 'CoffeeShop_Free' instead of 'CoffeeShop_Wi-Fi'), the attacker tricks victims into connecting to their malicious AP, allowing them to intercept sensitive traffic or session tokens.
• B. A rogue access point is any unauthorized wireless access point connected to a network infrastructure. While an evil twin is a subset of rogue access points, the term 'rogue access point' often refers to an unauthorized AP installed on a corporate network (often by an employee for convenience). The specific tactic of mimicking a legitimate SSID to deceive users is more precisely defined as an evil twin.
• C. Bluesnarfing involves the unauthorized access of information (such as contacts, emails, or messages) from a wireless device through a Bluetooth connection. This scenario describes a Wi-Fi network attack, not a Bluetooth-based exploit.
• D. MAC spoofing involves changing the Media Access Control (MAC) address of a network interface to impersonate another device or bypass network access controls. While it can be used in various network attacks, it is not the primary vector used to deceive a user into connecting to a malicious wireless network name.

Correct answers: A, B, C — Unpatched operating systems; Legacy applications; Third-party APIs

• A. Unpatched operating systems are a primary attack surface because they often contain known vulnerabilities (CVEs) that remain exploitable until security updates are applied. Attackers frequently leverage these flaws to achieve remote code execution or privilege escalation.
• B. Legacy applications represent a significant vulnerability because they typically no longer receive security updates or vendor support. They often rely on outdated, insecure components or protocols, making them easy targets for exploitation.
• C. Third-party APIs expand the attack surface by exposing programmatic interfaces that may be misconfigured, poorly secured, or lack proper input validation. Attackers can exploit flaws in API authentication and authorization to access sensitive data or internal functions.
• D. End-to-end encryption is a security control used to protect data confidentiality during transmission. It is a mitigation technique rather than a vulnerable software attack surface.
• E. Multi-factor authentication (MFA) is a protective control that adds layers of security to verify a user's identity. While it can be bypassed through social engineering, it is not considered a software attack surface.
• F. Role-based access control (RBAC) is a security mechanism designed to restrict system access to authorized users based on their job roles. It is a defense-in-depth measure intended to reduce the attack surface, not expand it.

Correct answer: B — ARP poisoning

• A. MAC flooding targets a network switch's Content Addressable Memory (CAM) table by overwhelming it with a large number of fake MAC addresses. This can cause the switch to enter a fail-open mode where it broadcasts all traffic to all ports like a hub, but it does not specifically involve mapping IP addresses to MAC addresses via fake ARP messages.
• B. ARP poisoning (also known as ARP spoofing) involves sending forged Address Resolution Protocol messages onto a local area network. The goal is to associate the attacker's MAC address with the IP address of another host (such as the default gateway), allowing the attacker to intercept, modify, or stop traffic intended for that IP.
• C. DNS spoofing targets the name resolution process by providing fraudulent DNS responses that map domain names to incorrect, attacker-controlled IP addresses. While this redirects traffic, it operates at the application layer/name resolution level rather than manipulating the ARP cache on a local network.
• D. DHCP exhaustion is a denial-of-service (DoS) attack where an attacker floods a DHCP server with requests using many spoofed MAC addresses. This consumes the entire pool of available IP addresses, preventing legitimate clients from obtaining network configuration, but it does not involve ARP mapping.

Correct answer: B — VM escape

• A. VM sprawl refers to the uncontrolled proliferation of virtual machines within an organization. While it creates management and security challenges (such as unpatched or forgotten systems), it does not describe the technical act of an attacker breaking out of a VM boundary to the hypervisor.
• B. VM escape is a vulnerability that allows an attacker to break out of the isolated environment of a guest virtual machine and execute code on the underlying hypervisor. Once the hypervisor is compromised, the attacker can potentially access or control all other guest VMs running on that host.
• C. Container breakout is the equivalent of a VM escape but occurs in a containerized environment. It involves escaping a container to reach the host operating system. The scenario specifically mentions virtual machines and a hypervisor, making VM escape the correct term.
• D. Resource exhaustion is a condition where an application or user consumes all available system resources (such as CPU, memory, or disk space), leading to a denial-of-service (DoS). It does not involve gaining unauthorized code execution on the hypervisor or moving laterally between VMs.

Correct answer: A — Insecure API implementation

• A. Correct. Hardcoding an API key into client-side code is a significant security flaw categorized as insecure API implementation. API keys and secrets should never be embedded in client-side code because attackers can reverse engineer or decompile the application to extract the credentials, leading to unauthorized access to backend services.
• B. Incorrect. Cloud storage misconfiguration refers to improper permissions or settings on cloud resources (like S3 buckets or containers) that lead to data exposure. This scenario describes a credential handling issue within the application code, not a misconfigured storage resource.
• C. Incorrect. VM escape is a virtualization vulnerability where an attacker breaks out of a virtual machine to access the host system or other VMs. This is unrelated to the exposure of API keys in a mobile application.
• D. Incorrect. SQL injection involves manipulating database queries through unsanitized user input. Although the attacker accessed a database, the primary vulnerability was the exposure of the API key used for authentication, not an injection flaw in the application's query logic.

Correct answer: C — Unskilled attacker

• A. Nation-state threat actors are typically highly resourced, sophisticated, and well-funded. They often develop their own proprietary tools and advanced persistent threats (APTs) for cyber espionage or warfare, rather than relying on public attack kits.
• B. Organized crime groups possess significant technical resources and expertise. While they may use various tools, they are financially motivated and capable of developing or purchasing sophisticated malware to conduct high-stakes criminal activities.
• C. Unskilled attackers, frequently referred to as 'script kiddies,' typically lack the technical expertise to discover vulnerabilities or write their own code. They rely almost exclusively on existing scripts, tools, and exploit kits found on the internet to launch attacks.
• D. An insider threat is defined by their authorized access to an organization's systems and data. While their skill level can vary from unskilled to highly proficient, their defining characteristic is their internal position, not a specific reliance on pre-packaged internet tools.

Correct answer: B — Application sandboxing

• A. Network segmentation involves dividing a network into smaller, isolated subnetworks to improve security and limit lateral movement. While it contains threats across a network, it does not provide host-level isolation for an individual application relative to its operating system.
• B. Application sandboxing confines an application within a restricted execution environment (a sandbox), preventing it from accessing unauthorized system resources, files, or other processes. This ensures that if the application is compromised or contains vulnerabilities, the damage is contained and cannot affect the host operating system.
• C. Configuration enforcement uses tools and policies to ensure that systems follow approved settings and security baselines. While this helps maintain consistency and reduces misconfigurations, it does not provide a runtime isolation barrier like sandboxing.
• D. System hardening is the broad process of reducing a system's attack surface by disabling unnecessary services, closing unused ports, and applying security patches. While sandboxing is a specific mechanism that can be used as part of a hardening strategy, system hardening itself is a general practice rather than a specific isolation technique.

Correct answer: B — Data sovereignty

• A. Data minimization refers to the practice of limiting the collection and retention of personal information to what is directly relevant and necessary to accomplish a specified purpose. The concern in this scenario is not the volume of data, but the physical location and legal jurisdiction under which it falls.
• B. Data sovereignty is the principle that digital information is subject to the laws and governance of the country in which it is physically located or processed. Because the migration involves moving data from Europe to the United States, the legal team is concerned about compliance with GDPR rules regarding cross-border data transfers and jurisdictional oversight.
• C. Data retention refers to the policies and practices regarding how long data is kept and the conditions for its deletion according to regulatory or business requirements. This issue is distinct from the geographic location of storage and processing.
• D. Data masking is a technique used to obscure or hide original data with modified content to protect sensitive information from unauthorized access. While it helps protect privacy, it does not address the legal requirements of data residency or where data is physically stored.

Correct answer: A — Microsegmentation

• A. Microsegmentation is a network security technique that enables security architects to logically divide the data center into distinct security segments down to the individual workload level. By creating granular zones and controlling east-west traffic between systems, it effectively prevents lateral movement even when devices are located on the same subnet.
• B. Geofencing is a location-based service that creates a virtual boundary around a specific geographic area. It is used to trigger actions based on physical location (like mobile device management or asset tracking) and is not designed to prevent internal lateral movement within a network subnet.
• C. Port security is a Layer 2 switch feature that limits which MAC addresses can use a physical switch port, primarily preventing unauthorized devices from connecting to the network. It does not provide the workload-level isolation required to stop lateral movement between already-authorized servers on the same segment.
• D. MAC filtering allows or denies network access based on hardware addresses. It is a weak security mechanism and is intended for admission control rather than internal traffic segmentation; it would not effectively prevent a compromised server from communicating with another server on the same subnet.

Correct answer: A — Edge computing

• A. Correct. Edge computing involves placing processing power and storage closer to the source of data generation rather than relying solely on a centralized cloud. This reduces network latency and bandwidth usage by aggregating and filtering raw data locally before transmitting only the relevant information.
• B. Incorrect. Infrastructure as Code (IaC) is a methodology for managing and provisioning computing infrastructure through machine-readable definition files and automation. It addresses deployment consistency and management efficiency, not the physical location of data processing.
• C. Incorrect. Virtual Desktop Infrastructure (VDI) is a technology that hosts desktop environments on a centralized server, allowing users to access them remotely. It is unrelated to IoT sensor data processing or bandwidth optimization in the field.
• D. Incorrect. A monolithic architecture refers to a software design where all functional components are tightly coupled and built as a single, unified unit. It does not describe a distributed processing model used to optimize data flow from remote devices.

Correct answer: B — Uninterruptible Power Supply (UPS)

• A. Diesel generators are intended to provide long-term backup power during extended outages. Because they typically require several seconds or minutes to start up and stabilize, they are not suitable for providing immediate short-term power without a bridging device.
• B. An Uninterruptible Power Supply (UPS) uses batteries to provide instantaneous, short-term power when the main source fails. This allows critical systems to shut down gracefully to prevent data loss or serves as a bridge until a long-term source, such as a generator, can take over.
• C. A Managed Power Distribution Unit (PDU) is designed to distribute, monitor, and control power to multiple devices (often in server racks). While it helps manage power delivery, it does not store energy or provide emergency backup power.
• D. Dual power supplies provide hardware redundancy within a single server or device. While they protect against the failure of an individual power supply unit, they do not provide stored emergency power if the external utility power to the building is lost.

Correct answer: B — Immutable backups

• A. Differential backups store data that has changed since the last full backup. While they improve backup efficiency, they do not provide inherent protection against modification or encryption; if the backup server is compromised, these files can be encrypted or deleted just like any other data.
• B. Immutable backups are specifically designed to prevent data from being altered, encrypted, or deleted for a set retention period. By using Write-Once-Read-Many (WORM) technology or object locking, the data remains protected even if an administrator account is compromised, making it a critical defense against ransomware.
• C. Tape rotation involves managing physical media for backups, often providing an 'air gap' if tapes are kept offline. However, tape rotation itself is a management strategy rather than a technical guarantee of immutability for a specific period, and tapes can still be overwritten if the rotation cycle or physical write-protect tabs are not strictly managed.
• D. Cloud synchronization mirrors data from a local source to a cloud provider. This is often problematic during a ransomware attack because the synchronization process typically propagates changes (including encryption) to the cloud version immediately, resulting in the loss of both copies.

Correct answer: B — Chain of custody

• A. A legal hold is a process or notification used to preserve all forms of relevant information when litigation is reasonably anticipated, preventing the deletion or alteration of data. It does not provide the step-by-step chronological history of evidence handling.
• B. Chain of custody is a chronological paper trail that documents the seizure, custody, control, transfer, and analysis of physical or electronic evidence. This documentation is critical for maintaining evidentiary integrity and ensuring that the evidence remains admissible in a court of law.
• C. An incident playbook is a set of predefined procedures and guidelines for responding to specific types of security incidents. While it guides the response actions, it is not used to record the specific custody history of digital evidence.
• D. A root cause analysis report is used to identify the underlying factors that caused an incident to occur. It focuses on remediation and lessons learned rather than tracking the handling and transfer of evidence during an investigation.

Correct answer: B — Endpoint Detection and Response (EDR)

• A. A Network Intrusion Detection System (NIDS) monitors network traffic for malicious patterns and anomalies. While it can detect suspicious network activity, it lacks host-level visibility into endpoint memory, process injections, or internal API calls, which are necessary to detect fileless malware.
• B. Endpoint Detection and Response (EDR) tools provide deep telemetry from host endpoints, including process creation, memory allocations, DLL loading, and API calls. Because fileless malware operates primarily in memory to avoid detection by traditional signature-based antivirus, EDR is the best tool for providing the granular visibility required to detect process injection and other in-memory behaviors.
• C. A NetFlow analyzer collects and analyzes network flow metadata such as source/destination IP addresses and ports. While it is useful for identifying unusual communication patterns, it cannot inspect host memory or observe the application-level API behavior occurring on the workstation.
• D. A Web Application Firewall (WAF) is used to monitor and filter HTTP/HTTPS traffic directed at web applications. It is a perimeter defense for servers and does not provide visibility into internal workstation processes, memory allocations, or local API calls.

Correct answer: B — Common Vulnerabilities and Exposures (CVE)

• A. STIX (Structured Threat Information eXpression) is a language and serialization format used to exchange cyber threat intelligence, while TAXII (Trusted Automated eXchange of Intelligence Information) is the protocol for communicating that information. They are used for sharing indicators of compromise (IOCs) rather than cataloging software vulnerabilities.
• B. Common Vulnerabilities and Exposures (CVE) is the industry-standard dictionary of publicly known security vulnerabilities. Each entry provides a unique identifier (CVE ID) that vulnerability scanners use to cross-reference and identify specific flaws in systems and software.
• C. MITRE ATT&CK is a comprehensive knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. It is used for threat modeling and mapping defense coverage, not as a dictionary for specific software vulnerabilities.
• D. The OWASP Top 10 is a list and awareness document describing the most critical security risks to web applications. While it categorizes common flaws (like Injection or Broken Access Control), it is not a standardized dictionary of unique software vulnerabilities used for scanner identification.

Correct answer: B — During the CI/CD pipeline

• A. A SIEM (Security Information and Event Management) platform is designed for aggregating, correlating, and analyzing log data for security monitoring and incident response. It is not designed to scan source code commits for vulnerabilities or secrets during the development lifecycle.
• B. The CI/CD (Continuous Integration/Continuous Deployment) pipeline is the best place to integrate automated security scanning. This supports 'shift-left' security by ensuring that code is validated for hardcoded secrets and known vulnerabilities automatically every time a developer attempts to commit or merge code, catching issues early in the development process.
• C. A SOAR (Security Orchestration, Automation, and Response) playbook is used to automate incident response tasks and orchestrate actions across security tools after an event is detected. It is not used for performing pre-merge code analysis.
• D. A Web Application Firewall (WAF) is a runtime security control used to filter and monitor HTTP traffic to a production web application. It protects against attacks like SQL injection and cross-site scripting in a live environment but does not inspect source code commits or prevent hardcoded secrets from being merged.

Correct answer: A — Implement a 'human-in-the-loop' approval step for high-impact automated actions.

• A. A 'human-in-the-loop' (HITL) approval step adds a critical control point for high-impact changes. This ensures that while the execution is automated, a human operator reviews and validates the logic before it is deployed at scale. This preserves the efficiency of automation while significantly reducing the blast radius of potential scripting errors or logic bugs.
• B. Replacing all automation with manual CLI configuration would eliminate the speed, consistency, and scalability benefits that automation provides. The objective is to secure the automation process, not to revert to slower, error-prone manual methods.
• C. Switching scripting languages (e.g., Python to Bash) does not address the underlying issue of logic errors or lack of validation. Vulnerabilities and bugs can exist in any language, so this change provides no safeguard against future outages.
• D. Granting excessive permissions such as Domain Admin privileges violates the principle of least privilege. This does not prevent outages and actually increases the risk of damage, as a buggy script with high privileges could cause even more severe damage to the enterprise infrastructure.

Correct answer: A — SCIM

• A. Correct. SCIM (System for Cross-domain Identity Management) is an open standard specifically designed to automate the exchange of user identity information between identity domains. It uses a standardized REST API and JSON to handle the full identity lifecycle, including provisioning (creation), updating, and deprovisioning (deletion) of user accounts across cloud and SaaS applications.
• B. Incorrect. SAML (Security Assertion Markup Language) is an XML-based framework used for federated authentication and Single Sign-On (SSO). While it allows users to log in across services, it does not provide the mechanism for automated account provisioning or lifecycle management.
• C. Incorrect. Shibboleth is an open-source federated identity solution that implements SAML standards. Like SAML, it focuses on authentication and SSO rather than automating account creation and deletion via REST APIs.
• D. Incorrect. LDAP (Lightweight Directory Access Protocol) is an older protocol used to access and maintain directory services, primarily in on-premises environments. It is not a REST API and is not the modern standard for automating user provisioning across third-party SaaS applications.

Correct answer: C — Mover provisioning

• A. Offboarding refers to the process of disabling and removing access for employees who are leaving the organization entirely. Since these employees remained within the company but simply changed departments, offboarding is not the correct term for this lifecycle event.
• B. Federation involves linking a user's identity across multiple independent systems or organizations (often via protocols like SAML or OIDC). It does not govern the internal logic of revoking specific database access during a departmental transfer.
• C. Mover provisioning (part of the Joiner-Mover-Leaver framework) is the process of adjusting and updating access rights when an employee changes roles, departments, or responsibilities. The failure to revoke Sales CRM access when the users moved to Marketing represents a failure in the 'Mover' phase of the identity lifecycle.
• D. Identity proofing is the initial process of verifying that an individual is who they claim to be, typically performed during onboarding or before credentials are first issued. It is not related to the ongoing management of access rights for existing employees.

Correct answer: B — Performing a cryptographic erase

• A. Degaussing uses a powerful magnetic field to sanitize magnetic media like hard disk drives (HDDs) and tapes. Because SSDs store data in flash memory (integrated circuits) rather than magnetic platters, degaussing is ineffective and does not ensure data sanitization.
• B. A cryptographic erase (CE) works by destroying or overwriting the encryption keys used to encrypt the data on the drive. Once the key is gone, the data is rendered unrecoverable (ciphertext). This is the most efficient and effective method for sanitizing SSDs while keeping the hardware functional for repurposing.
• C. A standard quick format only removes the file system pointers and metadata, leaving the actual data blocks intact on the drive. Forensic recovery tools can easily retrieve sensitive information from a drive that has only undergone a quick format.
• D. Pulverizing is a method of physical destruction that reduces the drive to small pieces. While this is a secure way to prevent data recovery, it renders the hardware unusable, which contradicts the organization's requirement to repurpose the drives.

Correct answers: A, B — Geofencing; Remote wipe

• A. Geofencing defines virtual boundaries using GPS, cellular data, or Wi-Fi. It allows administrators to enforce specific security policies—such as restricting access to corporate applications—only when the device is within a defined geographic area, such as city limits.
• B. Remote wipe is a critical MDM feature that allows security teams to remotely erase all data and configurations from a device. This ensures that if a tablet is lost or stolen, sensitive corporate data is destroyed and the device is rendered inaccessible to unauthorized users.
• C. Biometric authentication (such as fingerprint or facial recognition) enhances identity verification and device unlocking security, but it does not address location-based access requirements or the ability to remotely disable a lost device.
• D. Sideloading is the practice of installing applications from unofficial sources outside of a managed app store. This is generally considered a security risk and does not provide location-based control or remote management capabilities.
• E. Screen locks provide a basic layer of local security by requiring a PIN, pattern, or password to access the device UI. However, they cannot enforce geographic restrictions or provide a way to wipe a device once it is no longer in the driver's possession.

Correct answer: B — Packet captures (PCAP)

• A. NetFlow logs provide network traffic metadata, such as source/destination IP addresses, ports, and protocol timing. However, NetFlow does not capture the actual payload of the packets, meaning it cannot reveal the contents of an FTP session like a username or password.
• B. Packet captures (PCAP) record the full data payload transmitted over the network. Because legacy FTP is an unencrypted protocol that transmits credentials in cleartext, an analyst can inspect the PCAP data to see the exact username and password used during the authentication phase.
• C. DNS query logs track domain name resolution requests (mapping hostnames to IP addresses). They do not provide visibility into the application-layer traffic or authentication sequences occurring between a client and a server.
• D. SNMP traps are asynchronous alerts sent by network devices to a management station regarding status changes or system events. They are used for health and performance monitoring and do not capture the session payloads necessary to extract login credentials.

Correct answer: B — Dump files

• A. Syslog is a standard for message logging used to collect and store event messages from various devices and applications. While syslog can help identify error messages leading up to a crash, it does not provide the in-memory state of an application.
• B. Dump files (also known as memory dumps or crash dumps) capture a snapshot of an application's memory at the moment of a crash or abnormal termination. They are critical for forensic analysis and debugging, as they allow analysts to inspect process states, variables, and call stacks.
• C. Authentication logs record information about user login attempts and access events. While essential for tracking user activity and detecting unauthorized access, they do not provide technical data regarding an application's memory contents.
• D. Automated dashboards provide a visual representation of metrics and alerts, often in real-time. While they help monitor system health and trends, they are not a primary source for investigating the granular state of memory at the time of a failure.

Correct answer: B — Software metering

• A. Application allowlisting is a security practice that specifies which software applications are authorized to run on a system. While it helps prevent unauthorized software, it does not provide the functionality to monitor or manage the number of concurrent users or enforce licensing limits.
• B. Software metering is the process of tracking and managing the usage of software licenses across an organization. It monitors active instances and concurrent usage, ensuring the firm remains compliant with its 50-license limit even when managing a larger pool of employees working staggered shifts.
• C. File integrity monitoring (FIM) is used to detect unauthorized changes to system files, configuration files, or application binaries. It is a critical security control for ensuring integrity but is not designed for license management or tracking software usage patterns.
• D. Endpoint detection and response (EDR) focuses on identifying, investigating, and responding to cyber threats and malicious activities on endpoints. It does not offer license usage tracking or management tools for concurrent software agreements.

Correct answer: C — Data Loss Prevention (DLP)

• A. Endpoint Detection and Response (EDR) is primarily focused on detecting and responding to advanced threats, malware, and suspicious activity on endpoints. It does not specifically inspect application-level email content or attachments to prevent the accidental transmission of sensitive data.
• B. Network Access Control (NAC) is used to manage device access to a network based on security posture and credentials. It does not analyze outgoing email traffic or the content of attachments for sensitive information like credit card numbers.
• C. Data Loss Prevention (DLP) is specifically designed to identify, monitor, and protect sensitive information (such as PII or PCI data). It can inspect emails and spreadsheets in transit to prevent users from accidentally sending confidential information to unauthorized external domains.
• D. An Intrusion Prevention System (IPS) monitors network traffic for malicious signatures and protocol anomalies to prevent exploits. It is not designed to enforce organizational data-handling policies or scan for sensitive strings like credit card numbers in outgoing business communications.

Correct answer: B — The average time to remediate critical vulnerabilities

• A. The total number of firewall rules created is an operational metric related to network administration and access control. It does not measure the success or efficiency of identifying and fixing security vulnerabilities across the organization.
• B. The average time to remediate (MTTR) critical vulnerabilities is a high-level, outcome-focused metric that demonstrates how quickly the organization reduces risk exposure. It is a key performance indicator (KPI) that reflects program maturity and effectiveness, making it ideal for communication with a risk-focused Board of Directors.
• C. The number of false positives generated by the SIEM (Security Information and Event Management) system measures the accuracy and tuning of security monitoring and alerting, not the effectiveness of a vulnerability management program.
• D. Specific CVE (Common Vulnerabilities and Exposures) identifiers are too technical and granular for a board-level presentation. While they show specific activity, they do not provide the strategic context or overall trend data that the Board needs to evaluate the program's success.

Correct answer: B — Qualitative risk assessment

• A. Quantitative risk assessment relies on numerical data, specific metrics, and often assigns monetary values to likelihood and impact (e.g., SLE, ALE). The scenario explicitly mentions the team is avoiding strict financial values and using expert judgment instead.
• B. Qualitative risk assessment uses subjective analysis, such as expert judgment, to categorize risks based on likelihood and impact. Visual tools like heat maps with color coding (e.g., green to red) to indicate risk levels are characteristic outputs of this approach.
• C. Business impact analysis (BIA) is a process used to identify mission-critical functions and the potential consequences of their disruption, typically to establish recovery objectives. While it informs risk management, it is not the process of ranking threats via a heat map.
• D. Threat hunting is a proactive, operational security task where analysts search for indicators of compromise or hidden adversaries within an environment. It is not a methodology for evaluating and categorizing general business or project risks.

Correct answer: B — Implement targeted, role-based security awareness training for the accounting team.

• A. Isolating the accounting department's network is an extreme and disruptive technical measure that does not address the root cause of the high click rate. While network segmentation is a valid security control, it is a disproportionate response to a training and awareness gap and could severely hinder business operations.
• B. This is the best next step because targeted, role-based security awareness training addresses the specific vulnerabilities of the accounting team. Since accounting departments often handle invoices, wire transfers, and payroll—common targets for Business Email Compromise (BEC)—tailoring training to their specific job functions is the most effective way to improve their ability to recognize sophisticated phishing attempts.
• C. Revoking internet access is a punitive measure that prevents employees from performing their jobs and does not provide any educational value. Effective security awareness programs focus on reinforcement and behavior change rather than punishment, which can create a negative security culture.
• D. Increasing the complexity of simulations globally does not address the specific discrepancy identified in the accounting department. Before making simulations harder for the entire company, the security manager should focus on remediation for the high-risk group that is already failing at the current level of difficulty.

Correct answer: B — Source code escrow

• A. A right to audit clause allows the customer to inspect the vendor's security controls, internal processes, or compliance posture. While it provides visibility into the vendor's operations, it does not provide a mechanism to maintain or patch the software if the vendor ceases operations.
• B. Source code escrow involves a trusted third party holding the software's source code. The code is released to the customer only under specific conditions, such as the vendor going out of business or failing to meet support obligations. This allows the customer to maintain, patch, and support the software independently.
• C. A data processing agreement (DPA) defines how personal or sensitive data is handled and protected according to privacy laws and regulations. It does not address software availability, maintenance, or vendor insolvency risks.
• D. Continuous monitoring is a practice used to track a vendor's security posture or operational health over time. While it helps identify risks early, it does not provide the technical resources (the source code) needed to support a proprietary application if the vendor disappears.

Correct answer: A — A bug bounty program

• A. A bug bounty program is a crowdsourced security initiative where organizations invite independent security researchers (ethical hackers) to discover and report vulnerabilities in their systems in exchange for financial compensation or recognition. This allows for continuous, diverse assessment from a global talent pool.
• B. An internal audit is performed by an organization's own employees or internal audit department to evaluate the effectiveness of internal controls, compliance, and governance. It does not involve paying external researchers for discovered vulnerabilities.
• C. A tabletop exercise is a discussion-based simulation where key personnel meet in a classroom-style setting to walk through their roles and responses to a hypothetical disaster or security incident. It is not an active testing method for finding zero-day vulnerabilities.
• D. A double-blind penetration test (also known as a 'black box' or 'zero-knowledge' test) is a formal assessment where neither the security staff of the target organization is informed of the test, nor are the testers given internal knowledge of the infrastructure. While it is a type of active testing, it is typically conducted by a specific firm or team rather than being an open program for independent global researchers.

Correct answers: A, C — SOC 2 Type II report; Penetration testing executive summary

• A. A SOC 2 Type II report is specifically designed to evaluate the design and operating effectiveness of a service organization's controls over a defined period, typically six months to one year. It provides high-level assurance to customers and stakeholders without disclosing granular internal technical configurations.
• B. Internal vulnerability scan results contain highly sensitive technical information, including specific IP addresses, hostnames, and software version vulnerabilities. Sharing these would violate the requirement to avoid revealing sensitive internal configurations.
• C. A penetration testing executive summary provides a high-level overview of security findings, risks, and remediation efforts. It is intended for external stakeholders to demonstrate due diligence and security posture without exposing the technical exploit details or internal configurations that would be found in the full report.
• D. A source code review report contains proprietary implementation details and intellectual property. It is too technically detailed and sensitive to provide to prospective clients for general assurance purposes.
• E. A SOC 2 Type I report only assesses the design of controls at a single point in time. It does not provide evidence that the controls operated effectively over a duration, such as the six-month period requested.
• F. Raw firewall configuration logs are extremely sensitive and would reveal internal network architecture, IP schemes, and specific access control lists (ACLs). This would expose the sensitive technical configurations the CSP is trying to protect.