Question 461 · 607 in bank
An administrator is creating a secure method for a contractor to access a test environment. Which of the following would provide the contractor with the best access to the test environment?
Show answer
Answer: B
CompTIA Security+607 questions across 61 pages are complete and free, with no account or card.
607 questions in this bank
Free access · progress saved on this device
An administrator is creating a secure method for a contractor to access a test environment. Which of the following would provide the contractor with the best access to the test environment?
Answer: B
A security analyst notices unusual behavior on the network. The IDS on the network was not able to detect the activities. Which of the following should the security analyst use to help the IDS detect such attacks in the future?
Answer: A
To which of the following security categories does an EDR solution belong?
Answer: D
A systems administrator works for a local hospital and needs to ensure patient data is protected and secure. Which of the following data classifications should be used to secure patient data?
Answer: C
C. Sensitive Sensitive - Intellectual property, PII, PHI • Confidential - Very sensitive, must be approved to view • Public / Unclassified - No restrictions on viewing the data • Private / Classified / Restricted – Restricted access, may require an NDA • Critical - Data should always be available
Source: Adapted from community discussion — Osechabelo
A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most difficult to remediate due to the company’s reliance on open-source libraries?
Answer: D
The correct answer is D. Zero-day. A zero-day vulnerability refers to a security flaw that is unknown to the software's creators or the public and has no available patch. Since the company relies on open-source software libraries, a zero-day in one of those libraries would be especially difficult to remediate because the company may need to wait for the open-source community or maintainers to discover and fix the vulnerability.
Source: Adapted from community discussion — 1eccfc0
An organization has a new regulatory requirement to implement corrective controls on a financial system. Which of the following is the most likely reason for the new requirement?
Answer: B
B. To ensure that errors are not passed to other systems Explanation: ✔ Corrective controls are designed to identify and fix issues after they occur, ensuring that errors do not propagate to other systems. ✔ In a financial system, errors can lead to incorrect transactions, misstatements, or compliance violations. ✔ Regulatory requirements often mandate corrective controls to detect, log, and rectify mistakes before they cause widespread issues. Why not the other options? A. To defend against insider threats altering banking details – This relates more to preventive and detective controls rather than corrective controls. C. To allow for business insurance to be purchased – Compliance may influence insurance policies, but corrective controls are primarily implemented for operational and regulatory integrity. D. To prevent unauthorized changes to financial data – Preventing changes is a preventive control, whereas corrective controls focus on identifying and fixing errors post-occurrence.
Source: Adapted from community discussion — test_arrow
Which of the following is the stage in an investigating when forensic images are obtained?
Answer: A
The correct answer is: A. Acquisition Explanation: Acquisition is the stage in a forensic investigation where forensic images of digital evidence (e.g., hard drives, memory, or other storage devices) are obtained. This process involves creating a bit-by-bit copy of the data to ensure its integrity and to allow for analysis without altering the original evidence. Preservation (B) involves ensuring that the evidence is protected from tampering or alteration, often occurring before or during acquisition. Reporting (C) is the final stage where findings are documented and presented. E-discovery (D) refers to the process of identifying, collecting, and producing electronically stored information (ESI) in response to legal requests, which is not specific to the creation of forensic images. Thus, Acquisition is the stage where forensic images are obtained.
Source: Adapted from community discussion — Anyio
Which of the following describes the difference between encryption and hashing?
Answer: B
. Encryption replaces cleartext with ciphertext, while hashing calculates a checksum. Explanation: ✔ Encryption converts plaintext into ciphertext using an algorithm and a key, allowing data to be decrypted when needed. ✔ Hashing generates a fixed-length checksum (hash) from input data, ensuring data integrity but not reversibility (i.e., hashes cannot be decrypted). Why not the other options? A. Encryption protects data in transit, while hashing protects data at rest. ❌ Incorrect – Encryption protects both data in transit and at rest, while hashing is used for data integrity verification, not storage security. C. Encryption ensures data integrity, while hashing ensures data confidentiality. ❌ Incorrect – Encryption ensures confidentiality, and hashing ensures integrity, not the other way around. D. Encryption uses a public-key exchange, while hashing uses a private key. ❌ Incorrect – Hashing does not use any keys. Public-key exchange applies only to asymmetric encryption, not encryption as a whole.
Source: Adapted from community discussion — test_arrow
A security report shows that during a two-week test period, 80% of employees unwittingly disclosed their SSO credentials when accessing an external website. The organization purposely created the website to simulate a cost-free password complexity test. Which of the following would best help reduce the number of visits to similar websites in the future?
Answer: B
A Chief Information Security Officer (CISO) has developed information security policies that relate to the software development methodology. Which of the following would the CISO most likely include in the organization’s documentation?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-701 practice, question 461. 607 questions available.
Version 1.0.0. How we source questions