CompTIA Security+ — All Questions

Companies in the same industry exchange threat data through a trusted community so a breach at one helps the others defend proactively. Such an industry group is called a(n):

• a.Information sharing and analysis center (ISAC)✓
• b.A certificate authority
• c.A cloud access security broker
• d.A managed security service provider that operates and monitors security tools for clients

An Information Sharing and Analysis Center (ISAC) lets organizations in a sector share threat intelligence so each benefits from others' experiences. Collective defense turns one victim's detection into everyone's protection. Trusted industry threat sharing is the ISAC's purpose.

During an investigation, analysts realize a critical server was never forwarding its logs, leaving a gap in the timeline. The lesson for operations is to ensure:

• a.That every server in the environment is rebuilt from scratch after each investigation
• b.Comprehensive log source coverage✓
• c.That logs are deleted quickly
• d.That only the perimeter firewall forwards logs

Comprehensive log source coverage ensures every relevant system feeds the central platform, so investigations have no blind spots. A single non-reporting server can hide critical steps of an attack. Verifying that all important sources actually log is the lesson.

Analysts are overwhelmed manually copying data between the SIEM, ticketing system, and threat intel portal for every alert. Which improvement most directly addresses this repetitive toil?

• a.Hiring twice as many analysts to perform exactly the same manual copying
• b.Extending the analysts' workday
• c.Turning off the SIEM alerts entirely
• d.Integrating the tools with automated playbooks✓

Integrating tools with automated playbooks eliminates repetitive manual data movement, freeing analysts for judgment-intensive work. Adding staff or hours scales the toil rather than removing it. Automating the hand-offs between tools is the direct fix.

After each incident and quarterly review, a SOC updates its playbooks, tuning, and training based on measured outcomes and lessons learned. This ongoing refinement reflects a principle of:

• a.A one-time hardening effort completed only when the systems are first deployed
• b.Continuous improvement✓
• c.Implicit trust
• d.Obscurity alone

Continuous improvement uses feedback from incidents and reviews to steadily refine detection, response, and training over time. Security operations mature by learning and adjusting, not by standing still. Iterating on measured outcomes is the principle at work.