CompTIA Security+607 questions across 61 pages are complete and free, with no account or card.
607 questions in this bank
Free access · progress saved on this device
A Chief Information Security Officer (CISO) wants to: • Prevent employees from downloading malicious content. • Establish controls based on departments and users. • Map internet access for business applications to specific service accounts. • Restrict content based on categorization. Which of the following should the CSO implement?
Answer: D
A company is aware of a given security risk related to a specific market segment. The business chooses not to accept responsibility and target their services to a different market segment. Which of the following describes this risk management strategy?
Answer: C
C. Avoid Explanation: ✔ Risk avoidance involves modifying business operations to eliminate the risk rather than mitigating or transferring it. ✔ In this scenario, the company chooses not to accept responsibility and shifts its focus to a different market segment, effectively avoiding the risk altogether. Why not the other options? A. Exemption – Not a recognized risk management strategy in this context. B. Exception – Typically refers to granting temporary permission to bypass a security policy, not changing business strategy. D. Transfer – Would involve shifting the risk to a third party (e.g., buying insurance or outsourcing), which is not what’s happening here.
Source: Adapted from community discussion — test_arrow
A security analyst needs to improve the company’s authentication policy following a password audit. Which of the following should be included in the policy? (Choose two.)
Answer: A
Which of the following is an example of a treatment strategy for a continuous risk?
Answer: A
CompTIA Security+ Explanation In risk management, a treatment strategy refers to how an organization mitigates, transfers, accepts, or avoids risk. Continuous risks are threats that persist over time and require ongoing security measures. Phishing attacks are a continuous risk because cybercriminals frequently attempt to deceive users via email. An email gateway is a technical control that continuously scans, filters, and blocks malicious emails to reduce phishing attempts. Since phishing is an ongoing (continuous) threat, deploying an email gateway is a proactive treatment strategy to mitigate it. GPT
Source: Adapted from community discussion — Kamalt
An organization wants to deploy software in a container environment to increase security. Which of the following would limit the organization's ability to achieve this goal?
Answer: D
D. Monolithic code Explanation: A monolithic codebase refers to a traditional software architecture where all components are tightly integrated into a single application. This structure can limit containerization because: Containers work best with microservices architectures, where applications are broken down into smaller, independent services that can be deployed and scaled individually. A monolithic application makes it difficult to containerize specific components, reducing the benefits of security, scalability, and flexibility in a container environment.
Source: Adapted from community discussion — test_arrow
Prior to implementing a design change, the change must go through multiple steps to ensure that it does not cause any security issues. Which of the following is most likely to be one of those steps?
Answer: C
A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering. Which of the following teams will conduct this assessment activity?
Answer: D
Offensive Penetration Testing ■ Known as “red teaming” ■ Actively seeks vulnerabilities and attempts to exploit them, like a real cyber attack ■ Helps uncover and report vulnerabilities to improve security ■ Can simulate real-world attacks and gain support for cybersecurity investments
Source: Adapted from community discussion — Abcd123321
The internal audit team determines a software application is no longer in scope for external reporting requirements. Which of the following will confirm that the application is no longer applicable?
Answer: D
Acknowledgement and attestation is the most appropriate method to formally confirm that a software application is no longer applicable for external reporting requirements. This ensures that there is a documented and verifiable statement from the relevant parties affirming the change in status
Source: Adapted from community discussion — PjoterK
Which of the following are the first steps an analyst should perform when developing a heat map? (Choose two.)
Answer: AC
A heat map is a visual representation of Wi-Fi signal strength across a physical space. The first steps in developing a heat map involve: Mapping the environment (C): A floor plan or office layout is essential to understand where access points (APs) are located, where walls or obstacles exist, and how the space is structured. Measuring signal strength (A): Walking around with a Wi-Fi analysis tool (e.g., NetSpot, Ekahau, or AirMagnet) helps capture signal strength at different locations, allowing the analyst to visualize weak and strong coverage areas.
Source: Adapted from community discussion — test_arrow
Which of the following is used to improve security and overall functionality without losing critical application data?
Answer: C
C. Patching Explanation: Patching is the process of applying updates to software, firmware, or operating systems to fix security vulnerabilities, improve functionality, and maintain stability—all while preserving critical application data. Regular patching ensures that security flaws are addressed without disrupting the application or losing important data. Breakdown of the other options: A. Reformatting: Involves wiping and reinstalling the system, which results in data loss unless backed up. B. Decommissioning: Refers to retiring an application or system, often leading to data archiving or removal. D. Encryption: Protects data by making it unreadable without a decryption key but does not directly improve functionality or fix security flaws.
Source: Adapted from community discussion — test_arrow
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-701 practice, question 491. 607 questions available.
Version 1.0.0. How we source questions