CompTIA Security+ — All Questions

Rather than scanning once a year, a mature program continuously discovers assets, scans them, prioritizes findings, remediates, and verifies in an ongoing cycle. This is best described as:

• a.A one-time penetration test
• b.An annual tabletop exercise
• c.Continuous vulnerability management✓
• d.A single baseline configuration applied only at deployment

Continuous vulnerability management is an ongoing cycle of discovery, assessment, prioritization, remediation, and verification rather than a periodic event. It keeps pace with new assets and new vulnerabilities. Treating it as a continuous loop is what makes the program mature.

An organization once deployed a patch that crashed a critical application fleet-wide. To prevent recurrence, patches should first be:

• a.Installed only on the systems that are already failing and are going to be rebuilt anyway
• b.Applied directly to every production system simultaneously in order to save time and effort
• c.Tested in a non-production environment before broad deployment✓
• d.Skipped entirely so that no future update can ever again disrupt the critical application

Testing patches in a non-production environment first catches breaking changes before they hit critical systems fleet-wide. Skipping patches leaves known vulnerabilities open, which is worse. Validating stability before broad rollout balances security and availability.

An analyst writes a script that queries the firewall's API to automatically add malicious IPs from a threat feed to a blocklist every hour. The primary benefit of this automation is:

• a.Faster, consistent blocking without manual effort✓
• b.It guarantees the organization can never again be targeted by a network attack
• c.It removes the need to keep logs
• d.It eliminates tuning the threat feed

Automating blocklist updates via the firewall API applies protection faster and more consistently than manual entry, reducing the window of exposure. It still requires logging and periodic tuning of the feed. Speed and consistency without manual toil is the real benefit.

Before issuing laptops, IT applies a standard secure image with encryption enabled, unneeded software removed, and logging turned on. Applying this consistent secure starting point is called establishing a:

• a.A recovery time objective
• b.Security baseline✓
• c.A memorandum of understanding
• d.A honeypot decoy

A security baseline is a standard secure configuration applied consistently so every system starts from a known hardened state. It prevents ad hoc, insecure builds and simplifies auditing. A repeatable secure starting point is what a baseline provides.

In endpoint logs, an analyst sees a standard user account suddenly added to the local administrators group minutes after a suspicious download. This sequence most likely represents:

• a.A misconfigured clock causing the log entries to appear in the wrong chronological order
• b.A routine software update that legitimately required elevated rights during its installation
• c.Privilege escalation following an initial compromise✓
• d.A scheduled backup service that authenticates using its own dedicated service account only

A normal user being elevated to local admin right after a suspicious download is a classic sign of privilege escalation after initial compromise. Attackers seek higher rights to expand control. Correlating the download with the elevation reveals the escalation.

Hunting through network logs, an analyst finds a host making small, regular connections to an unfamiliar external server at precise intervals around the clock. This pattern most likely indicates:

• a.A monthly update check
• b.Command-and-control beaconing✓
• c.Ordinary web browsing
• d.A backup job to approved offsite storage

Regular, small, precisely timed connections to an unknown server are characteristic of malware beaconing to a command-and-control host. The machine-like periodicity distinguishes it from human browsing. Spotting this rhythm is a staple of threat hunting.

After one workstation was compromised, logs show that account then authenticating to dozens of other machines it never normally touches. This activity is characteristic of:

• a.Lateral movement✓
• b.Single sign-on
• c.A credentialed vulnerability scan
• d.A load balancer

Lateral movement is an attacker using a compromised account to reach additional systems it normally would not touch, expanding their foothold. A sudden spread of authentications from one account is the tell. Detecting this early limits how far an intrusion spreads.

An analyst notices unusually large volumes of DNS queries to a single domain, with data encoded in the subdomain names. This technique for sneaking data out is called:

• a.Recursive resolution
• b.DNS tunneling exfiltration✓
• c.A cache-poisoning attack
• d.A distributed denial-of-service attack

DNS tunneling hides data inside DNS queries, often encoded in subdomain labels, to smuggle information past controls that permit DNS. High query volume to one domain with odd subdomains is the signature. Recognizing DNS as an exfiltration channel is the key insight.

After capturing a forensic image, the examiner stores it on protected media, restricts access, and records every handoff. The main reason for these precautions is to:

• a.Avoid computing hashes of the image
• b.Reduce the storage the evidence image consumes
• c.Let many analysts modify the image at once
• d.Preserve evidence integrity and admissibility✓

Restricting access and documenting handoffs preserve the evidence's integrity and its admissibility in legal proceedings. Any unlogged access or change could let opposing counsel challenge it. Protecting integrity and the chain of custody is the reason for these controls.

To detect a specific attack pattern reliably, an engineer writes logic in the SIEM that fires only when a defined sequence of events occurs together. This configured detection logic is a:

• a.A correlation rule✓
• b.A disaster recovery runbook
• c.A firewall access control list
• d.A backup schedule

A correlation rule defines conditions across multiple events that together indicate a threat, so the SIEM alerts only on the meaningful pattern. Well-crafted rules reduce noise and catch multi-step attacks. Encoding detection logic across events is what a correlation rule does.

When EDR detects ransomware behavior on a host, it automatically isolates that machine from the network within seconds without waiting for an analyst. This automated action is called:

• a.A quarterly vulnerability scan
• b.Automated host isolation (quarantine)✓
• c.A tabletop exercise
• d.A manual escalation to an on-call analyst

Automated host isolation quarantines a compromised machine from the network in seconds, stopping ransomware from spreading before a human can react. Speed is critical because encryption and lateral movement happen fast. Machine-speed containment is the value of this automation.

A security report highlights the average number of days an attacker remained undetected in the environment before discovery. Reducing this figure limits damage. This metric is:

• a.The RPO
• b.The annualized rate of occurrence
• c.Dwell time✓
• d.The false rejection rate

Dwell time is how long an attacker goes undetected in the environment, and shorter dwell time means less opportunity for damage and exfiltration. It reflects detection effectiveness. Minimizing time-to-detection is a central goal of security operations.

Many incidents began with users enabling macros in malicious Office documents. Which hardening policy most directly reduces this initial access vector?

• a.Requiring longer and more complex passwords on every single user account across the domain
• b.Disabling macros by default and blocking them from untrusted sources✓
• c.Encrypting the full disk on every endpoint so stored files are protected when powered off
• d.Deploying a load balancer in front of the mail servers to spread the inbound message load

Disabling macros by default and blocking them from untrusted sources removes a common malware delivery mechanism at its source. Password and disk controls do not address the macro vector. Targeting the specific initial access path is what makes this effective.

A team wants recurring scans but worries aggressive scanning could disrupt fragile production systems during business hours. The best practice is to:

• a.Scan continuously at maximum intensity regardless of the impact on production services
• b.Rely only on the vendor's assurance that the systems contain no vulnerabilities at all
• c.Schedule scans during maintenance windows and tune scan intensity✓
• d.Never scan the production systems at all so there is no possibility of any disruption

Scheduling scans during maintenance windows and tuning their intensity gets vulnerability visibility while minimizing operational disruption. Never scanning leaves blind spots; unrestrained scanning risks outages. Balancing coverage with safety is the practical approach.

Security operations periodically sends fake phishing emails to employees and tracks who clicks, using results to target additional training. This program is a:

• a.A tabletop exercise
• b.A business impact analysis
• c.Phishing simulation campaign✓
• d.A penetration test in which ethical hackers exploit technical vulnerabilities

A phishing simulation sends benign fake phishing to measure susceptibility and drive targeted awareness training. It turns human risk into a measurable, improvable metric. Testing and coaching users against real-looking lures is the program's aim.

So responders apply the right resources, an organization rates each incident by scope and impact, from a minor single-host event up to an enterprise-wide breach. This step is called:

• a.Recovery
• b.Chain of custody, documenting each person who handled a piece of evidence
• c.Incident classification and severity rating✓
• d.Eradication

Incident classification and severity rating gauges scope and impact so the response is proportionate and the right people and resources are engaged. A minor event and a major breach demand very different responses. Sizing the incident early guides everything that follows.

Companies in the same industry exchange threat data through a trusted community so a breach at one helps the others defend proactively. Such an industry group is called a(n):

• a.Information sharing and analysis center (ISAC)✓
• b.A certificate authority
• c.A cloud access security broker
• d.A managed security service provider that operates and monitors security tools for clients

An Information Sharing and Analysis Center (ISAC) lets organizations in a sector share threat intelligence so each benefits from others' experiences. Collective defense turns one victim's detection into everyone's protection. Trusted industry threat sharing is the ISAC's purpose.

During an investigation, analysts realize a critical server was never forwarding its logs, leaving a gap in the timeline. The lesson for operations is to ensure:

• a.That every server in the environment is rebuilt from scratch after each investigation
• b.Comprehensive log source coverage✓
• c.That logs are deleted quickly
• d.That only the perimeter firewall forwards logs

Comprehensive log source coverage ensures every relevant system feeds the central platform, so investigations have no blind spots. A single non-reporting server can hide critical steps of an attack. Verifying that all important sources actually log is the lesson.

Analysts are overwhelmed manually copying data between the SIEM, ticketing system, and threat intel portal for every alert. Which improvement most directly addresses this repetitive toil?

• a.Hiring twice as many analysts to perform exactly the same manual copying
• b.Extending the analysts' workday
• c.Turning off the SIEM alerts entirely
• d.Integrating the tools with automated playbooks✓

Integrating tools with automated playbooks eliminates repetitive manual data movement, freeing analysts for judgment-intensive work. Adding staff or hours scales the toil rather than removing it. Automating the hand-offs between tools is the direct fix.

After each incident and quarterly review, a SOC updates its playbooks, tuning, and training based on measured outcomes and lessons learned. This ongoing refinement reflects a principle of:

• a.A one-time hardening effort completed only when the systems are first deployed
• b.Continuous improvement✓
• c.Implicit trust
• d.Obscurity alone

Continuous improvement uses feedback from incidents and reviews to steadily refine detection, response, and training over time. Security operations mature by learning and adjusting, not by standing still. Iterating on measured outcomes is the principle at work.