CompTIA Security+ — All Questions

Which security model assumes no user or device is trusted by default, even inside the network perimeter?

• a.Zero trust✓
• b.Perimeter security
• c.Implicit trust
• d.Defense in depth

Zero trust removes automatic trust based on network location and continuously verifies every request. Access is granted per session based on identity, device posture, and context. It reduces lateral movement after a breach.

Layering multiple independent security controls so that one failure does not cause a breach is called:

• a.Air gapping
• b.Single sign-on
• c.Defense in depth✓
• d.Least privilege

Defense in depth stacks overlapping controls across people, process, and technology so no single failure is catastrophic. If one layer is bypassed, others still protect the asset. It reflects the assumption that any one control can fail.

Dividing a network into isolated zones to limit the spread of an attack is known as:

• a.Tunneling
• b.Segmentation✓
• c.Load balancing
• d.Port forwarding

Network segmentation separates systems into zones so a compromise in one cannot freely reach others. It limits lateral movement and contains breaches. VLANs, firewalls, and microsegmentation implement this principle.

Which network area sits between the internet and the internal network to host public-facing services?

• a.Screened subnet (DMZ)✓
• b.VPN concentrator
• c.Air gap
• d.Intranet

A screened subnet, historically called a DMZ, isolates public-facing servers from the internal network. If a public host is compromised, the internal network remains protected by an additional boundary. Firewalls control traffic on both sides.

Which cloud model gives the customer the most control over the operating system and applications while the provider manages the physical hardware?

• a.Software as a Service
• b.Platform as a Service
• c.Function as a Service
• d.Infrastructure as a Service✓

Infrastructure as a Service (IaaS) provides virtualized compute, storage, and networking while the customer manages the OS and applications. This maximizes customer control and responsibility. SaaS, by contrast, hands nearly everything to the provider.

In cloud computing, which concept defines who is responsible for securing which layers of the stack?

• a.Multitenancy
• b.Serverless
• c.Elasticity
• d.Shared responsibility model✓

The shared responsibility model divides security duties between the cloud provider and the customer. The provider secures the underlying infrastructure while the customer secures data, identities, and configurations. Misunderstanding the split is a common source of cloud breaches.

Which technology allows multiple isolated operating systems to run on a single physical host?

• a.Containerization
• b.Clustering
• c.Virtualization✓
• d.Load balancing

Virtualization uses a hypervisor to run multiple guest operating systems on one physical machine, each isolated in a virtual machine. It improves resource use and isolation. Hardening the hypervisor is critical because it is a high-value target.

Which approach packages an application with its dependencies to run consistently across environments while sharing the host OS kernel?

• a.Bare-metal deployment
• b.Full virtualization
• c.Containerization✓
• d.Air gapping

Containerization bundles an application and its dependencies into a lightweight, portable unit that shares the host kernel. Containers start quickly and use fewer resources than full VMs. Isolation is weaker than VMs, so kernel and image security matter.

Which principle grants users only the minimum access needed to perform their job?

• a.Least privilege✓
• b.Implicit deny
• c.Separation of duties
• d.Defense in depth

Least privilege limits each user or process to only the permissions required for its role. This shrinks the attack surface and limits damage from compromised accounts. Regular access reviews keep privileges aligned with need.

A firewall rule set ends with a rule that blocks anything not explicitly permitted. This is called:

• a.Explicit allow
• b.Implicit deny✓
• c.Stateful inspection
• d.Failover

Implicit deny blocks all traffic that no earlier rule explicitly allows. It ensures only intended traffic passes and unknowns are rejected by default. This deny-by-default posture is a core secure design principle.

Which design ensures a system has no single point of failure by duplicating critical components?

• a.Segmentation
• b.Redundancy✓
• c.Least functionality
• d.Tokenization

Redundancy duplicates critical components, such as power supplies or servers, so failure of one does not cause an outage. It supports high availability and resilience. Combined with failover, it keeps services running through faults.

Which term describes an isolated environment where suspicious code can be executed and analyzed safely?

• a.Sandbox✓
• b.Honeypot
• c.Bastion host
• d.Air gap

A sandbox is a contained, isolated environment for running untrusted code without risking the host or network. It is used to analyze malware behavior or test software safely. Escapes from the sandbox are a key security concern.

Which decoy system is deployed to attract attackers and study their techniques?

• a.Proxy server
• b.Load balancer
• c.Honeypot✓
• d.Jump server

A honeypot is a deliberately vulnerable-looking decoy that lures attackers away from real assets and gathers intelligence on their methods. Any interaction with it is suspicious by design. Honeynets extend the concept to entire fake networks.

Which hardened intermediary host is used to securely administer devices in a sensitive network segment?

• a.Web proxy
• b.Honeypot
• c.Jump server (bastion host)✓
• d.DNS resolver

A jump server, or bastion host, is a tightly controlled system that administrators connect through to reach protected segments. It centralizes and monitors administrative access. Hardening and logging on this host are essential because it is a gateway to sensitive systems.

Which control physically separates a highly sensitive network from all other networks and the internet?

• a.Air gap✓
• b.Screened subnet
• c.NAT
• d.VPN

An air gap isolates a system or network so it has no physical or logical connection to untrusted networks. It is used for critical systems like industrial controls. Data transfer requires manual, controlled processes, which reduces remote attack surface.

Which concept keeps availability high by automatically shifting workloads to a standby system when the primary fails?

• a.Segmentation
• b.Failover✓
• c.Load balancing
• d.Snapshotting

Failover automatically transfers operations to a redundant standby when the active component fails, minimizing downtime. It is a cornerstone of high-availability design. Regular testing ensures the standby will actually take over when needed.

Embedded systems in industrial equipment that monitor and control physical processes are collectively known as:

• a.IoT hubs
• b.ICS/SCADA✓
• c.Edge routers
• d.Thin clients

Industrial control systems (ICS), including SCADA, manage physical processes in utilities and manufacturing. They often run legacy software and prioritize availability over patching. Segmentation and strict access control are key because downtime and safety are critical.

Which design principle removes unnecessary services, ports, and software to reduce a system's attack surface?

• a.Least functionality✓
• b.Elasticity
• c.Multitenancy
• d.Redundancy

Least functionality configures a system to run only the services and features required for its purpose. Disabling unneeded components shrinks the attack surface. It complements least privilege by hardening the system itself, not just user access.

In a zero trust architecture, which component makes the access decision by evaluating policy against a request's context?

• a.The workload's data plane, which simply forwards packets after a decision is made
• b.A perimeter firewall that permits everything already inside the corporate network
• c.The policy engine in the control plane✓
• d.The end user's device, which self-certifies that it should be trusted by default

In zero trust, the control plane's policy engine evaluates identity, device posture, and context to decide whether to grant access. The data plane then enforces that decision on traffic. Separating decision from enforcement is central to the model.

Which zero trust component actually allows or blocks the connection once the policy decision is made?

• a.The policy administrator, which only relays decisions and helps configure the session
• b.The policy engine, which evaluates rules but does not itself sit in the traffic path
• c.The certificate authority, which issues identity certificates but enforces no traffic rules
• d.The policy enforcement point✓

The policy enforcement point (PEP) sits in the data path and enforces the allow-or-deny decision produced by the policy engine and administrator. It is where access is physically granted or blocked. This division keeps decision logic separate from enforcement.

A zero trust design continuously re-evaluates trust and narrows what each authenticated session can reach. Which paired concepts describe this?

• a.Implicit trust zones combined with a single one-time login valid for the whole day
• b.Adaptive identity and threat scope reduction✓
• c.Perimeter-only defense combined with unrestricted lateral movement once already inside
• d.Flat network design combined with permanent, static access rights for all of the users

Adaptive identity adjusts trust based on real-time context, while threat scope reduction limits the blast radius of any single session. Together they minimize what a compromised session can do. Both are core zero trust concepts.

A customer assumes the cloud provider will encrypt their stored data, but a breach reveals the customer was responsible for that setting. Which document clarifies these boundaries?

• a.A service level agreement that only specifies uptime percentages and support response times
• b.The cloud responsibility matrix✓
• c.A memorandum of understanding expressing non-binding intent between two partner organizations
• d.A business impact analysis that ranks the criticality of the organization's business processes

The responsibility matrix documents which security duties belong to the provider versus the customer across the stack. Misreading it is a frequent cause of cloud breaches. Reviewing it prevents assumptions about who secures what.

A DevOps team defines its entire cloud network and firewall configuration in version-controlled template files that can be redeployed identically. What is this practice?

• a.Shadow IT, in which staff deploy unsanctioned services without the security team's knowledge
• b.Infrastructure as code✓
• c.Data sovereignty, which governs the jurisdiction whose laws apply to the stored data
• d.A honeynet, which is a decoy network built specifically to attract and study attackers

Infrastructure as code (IaC) provisions and manages infrastructure through machine-readable definition files rather than manual configuration. It brings consistency, versioning, and repeatability, reducing configuration drift. Reviewing the code catches misconfigurations before deployment.

An architecture decomposes an application into many small, independently deployed services communicating over the network. Which security consideration grows most with this microservices approach?

• a.The removal of all logging requirements because each service is small and simple to run
• b.The complete elimination of any need for authentication between the internal services
• c.A larger attack surface from many exposed service interfaces requiring protection✓
• d.A guarantee that a compromise of one service can never affect any other service at all

Microservices multiply the number of network-exposed interfaces, enlarging the attack surface and the need for service-to-service authentication and monitoring. Each API must be secured. Consistent access control and observability across services are essential.

Over time, an organization accumulates hundreds of forgotten, unpatched virtual machines that no one actively manages. Which risk does this describe?

• a.Data sovereignty, concerning which country's laws govern where the data is being stored
• b.VM sprawl✓
• c.VM escape, where code breaks out of a guest to run on the underlying hypervisor host
• d.A screened subnet, which isolates public-facing servers from the internal network zone

VM sprawl is the uncontrolled growth of virtual machines beyond what can be tracked and maintained. Forgotten, unpatched VMs become vulnerable entry points. Lifecycle management and inventory controls keep sprawl in check.

Where should an organization place its public-facing web server so a compromise does not directly expose the internal network?

• a.In a screened subnet between the internet and the internal network✓
• b.Outside all firewalls with a public address and no filtering of inbound connections
• c.On the same segment as the domain controllers to simplify authentication traffic flow
• d.Directly on the internal LAN alongside employee workstations for easier management

A screened subnet isolates internet-facing servers so that compromising one does not grant direct access to the internal network. Firewalls control traffic on both sides of the zone. Proper device placement limits the blast radius of a public host breach.

Administrators must reach servers in a sensitive segment only through one hardened, heavily logged host. What is this host called?

• a.A load balancer distributing inbound requests across multiple identical backend servers
• b.A honeypot deliberately left vulnerable to attract and observe attacker behavior over time
• c.A reverse proxy caching content and terminating client TLS connections at the network edge
• d.A jump server✓

A jump server (bastion host) is a hardened intermediary through which administrators access protected segments. Centralizing and logging admin access there reduces exposure and aids monitoring. It must itself be tightly secured as a gateway.

A security appliance is configured so that if it stops functioning, all traffic is blocked rather than allowed through. This design choice is called:

• a.Port mirroring, which copies traffic to a monitoring interface for passive inspection
• b.Fail-open, which prioritizes continued availability over security during a device failure
• c.Fail-closed✓
• d.Load balancing, which spreads traffic across multiple redundant appliances for scaling

A fail-closed (fail-secure) design denies traffic when the control fails, favoring security over availability. Fail-open does the opposite, allowing traffic to preserve availability. The choice depends on whether security or uptime is the priority.

A network sensor is deployed to receive a copy of traffic through a mirror port so it can observe without sitting in the traffic path. This deployment is:

• a.A fail-closed configuration that denies all traffic whenever the sensor stops functioning
• b.An inline mode that can actively block malicious packets as they pass through the device
• c.A passive tap or monitor mode✓
• d.A proxy configuration that terminates and re-originates every single client connection

A tap or monitor (passive) deployment receives copied traffic and can observe or alert but cannot block, since it is not in the forwarding path. Inline devices, by contrast, can drop traffic. Passive placement avoids becoming a point of failure.

To protect a web application from SQL injection and cross-site scripting, which control inspects HTTP requests at the application layer?

• a.A web application firewall✓
• b.A load balancer that distributes client requests across several backend web servers
• c.A traditional packet-filtering firewall that only evaluates ports and IP addresses
• d.A network tap that passively copies traffic to an intrusion detection sensor

A web application firewall (WAF) inspects HTTP and HTTPS traffic at the application layer to block attacks like injection and cross-site scripting. It understands web request structure that a basic firewall does not. It complements, rather than replaces, network firewalls.

Which device combines stateful firewalling with integrated intrusion prevention, deep packet inspection, and application awareness in one platform?

• a.A passive network tap used only to copy traffic to an out-of-band analyzer for review
• b.A next-generation firewall✓
• c.A simple layer 2 switch that forwards frames based only on its MAC address tables
• d.A basic stateless access control list applied on a router interface for simple filtering

A next-generation firewall (NGFW) integrates traditional firewalling with deep packet inspection, application awareness, and intrusion prevention. This consolidated visibility enables policy based on applications and content, not just ports. It is a common perimeter and segmentation control.

A site-to-site VPN must authenticate and encrypt IP traffic between two office networks at the network layer. Which protocol suite is designed for this?

• a.SNMPv1, which monitors network devices but sends its community strings in plaintext
• b.HTTP, which serves web content in cleartext unless layered over a secure protocol
• c.SMTP, which transports email between mail servers without providing encryption itself
• d.IPSec✓

IPSec secures IP communications by authenticating and encrypting packets at the network layer, making it well suited to site-to-site VPNs. It provides confidentiality, integrity, and authentication. It commonly uses IKE to negotiate keys and security associations.

An organization wants to converge networking and security, delivering firewall, secure web gateway, and zero trust access from the cloud to remote sites and users. Which model fits?

• a.Secure access service edge✓
• b.A single on-premises perimeter firewall that backhauls all remote traffic to headquarters
• c.A screened subnet hosting only the organization's public-facing web and email servers
• d.An air-gapped network with no connectivity to any external or cloud-based service at all

Secure access service edge (SASE) converges networking and security functions into a cloud-delivered service close to users and sites. It combines capabilities like SD-WAN, secure web gateway, and zero trust access. This suits distributed workforces better than backhauling traffic.

Sensitive records are encrypted on disk but are decrypted into memory while an application processes them. Which data state is hardest to protect in this moment?

• a.Data at rest, because encrypted storage already fully protects it from any exposure
• b.Data in use✓
• c.Data in transit, because TLS has already secured it end to end during the transfer
• d.Archived data, because it has been moved to offline cold storage and is inaccessible

Data in use is the most challenging state to protect because the information must be decrypted in memory to be processed. Techniques like confidential computing and strict memory protections address it. At rest and in transit are more readily secured with encryption.

A support tool must display only the last four digits of a customer's card number while hiding the rest with asterisks. Which technique is this?

• a.Data masking✓
• b.Hashing, which produces an irreversible fixed-length digest of the whole underlying value
• c.Steganography, which conceals the data invisibly within another unrelated carrier file
• d.Full-disk encryption that protects the entire drive but reveals nothing selectively to staff

Data masking obscures parts of a value, showing only what is needed, such as the last four digits, while hiding the rest. It reduces exposure in interfaces and reports. Unlike tokenization, the original is not replaced with a separate stored token.

An organization labels information as public, internal, confidential, or restricted to drive how each is handled and protected. What is this practice called?

• a.Data remanence, which is residual data that persists on media after it is deleted
• b.Tokenization, which substitutes sensitive values with non-sensitive placeholder tokens
• c.Data classification✓
• d.Data sovereignty, which determines which nation's laws apply to the stored information

Data classification assigns sensitivity levels so that handling, access, and protection can be applied proportionally. Higher classifications warrant stronger controls. Clear labels make policy enforcement and compliance consistent.

A multinational must ensure certain citizens' personal data is stored only on servers physically located within their home country. Which concept governs this requirement?

• a.Data sovereignty✓
• b.High availability, which keeps services running through redundancy and automatic failover
• c.Load balancing, which spreads requests across multiple servers to improve performance
• d.Data masking, which hides portions of a field while displaying only what is truly needed

Data sovereignty means data is subject to the laws of the country where it is stored, which can mandate keeping it within specific borders. Geographic storage decisions must satisfy these legal requirements. Provider region controls help enforce it.

Two database servers are configured so that if the active one fails, the standby immediately takes over with the same data. Which resilience concept is this?

• a.High-availability clustering with failover✓
• b.Data classification, which labels information by sensitivity to guide its proper handling
• c.Load balancing, whose main purpose is distributing traffic for performance, not failover
• d.Network segmentation, which isolates zones to contain the spread of an active attack

High-availability clustering pairs systems so a standby assumes operation if the active node fails, minimizing downtime. Failover is the automatic transfer of service. This differs from load balancing, whose primary aim is distributing load.

A recovery facility has hardware and network connectivity in place but needs current data restored and some configuration before it can run operations. Which site type is this?

• a.A hot site
• b.A cold site
• c.A warm site✓
• d.A mobile site delivered on a trailer and positioned wherever it is temporarily needed

A warm site has equipment and connectivity but requires restoring data and some setup before taking over, balancing cost and recovery speed. A hot site is faster but pricier, and a cold site is cheaper but slower. The choice reflects the RTO.

To survive a regional disaster such as a hurricane, an organization replicates its data and systems to a facility hundreds of miles away. Which principle is applied?

• a.Geographic dispersion✓
• b.Least privilege applied to limit each user's permissions to only the minimum required
• c.Network segmentation used to contain lateral movement within a single data center
• d.Tokenization used to replace sensitive values with non-sensitive substitute tokens

Geographic dispersion places recovery capabilities far enough away that a single regional event cannot affect both sites. This protects against disasters that would take out a local backup. Distance must balance latency against risk isolation.

A company keeps encrypted backup copies at a separate location so a fire at the primary site cannot destroy every copy. Which two backup considerations are being applied?

• a.Load balancing and clustering to keep the production systems continuously available
• b.Snapshot frequency and journaling to capture every individual database transaction
• c.Onsite storage and plaintext retention for the fastest possible restore performance
• d.Offsite storage and encryption of the backups✓

Storing backups offsite protects against site-wide disasters, and encrypting them protects confidentiality if the media is lost or stolen. Both are key backup considerations. The 3-2-1 approach also emphasizes multiple copies and media types.

To validate disaster recovery without disrupting production, a team brings up the recovery systems and processes real transactions on them alongside the live systems. Which test is this?

• a.A full-interruption test that shuts down production entirely to force a real live failover
• b.A tabletop exercise that only discusses the plan verbally without touching live systems
• c.A vulnerability scan that enumerates known weaknesses without exploiting any of them
• d.A parallel processing test✓

A parallel test runs recovery systems alongside production to confirm they work without taking production offline. It provides strong assurance with limited risk. A full-interruption test is more realistic but disruptive.

During a brief power flicker, which device provides immediate battery power to keep servers running until a longer-term source engages?

• a.A surge protector, which absorbs voltage spikes but supplies no power during an outage
• b.A standby generator, which needs time to start and reach a stable output first
• c.A power distribution unit, which only allocates existing power among the connected devices
• d.An uninterruptible power supply✓

An uninterruptible power supply (UPS) delivers instantaneous battery power during outages or fluctuations, bridging the gap until a generator starts. It also conditions power against spikes and sags. UPS plus generator gives both immediate and sustained backup.

Before deploying new laptops, an organization applies a documented standard configuration that disables unneeded services and enforces security settings. What is this standard called?

• a.A secure baseline✓
• b.A screened subnet separating public-facing servers from the internal network segment
• c.A honeypot, which is a decoy system designed to lure and study attacker behavior over time
• d.A recovery point objective defining the maximum tolerable amount of data loss allowed

A secure baseline is a documented, standard secure configuration applied consistently to systems before deployment. It reduces attack surface and drift by starting every device from a known-good state. Benchmarks like CIS guide baseline creation.

Which environment typically prioritizes availability and safety over frequent patching, requiring careful segmentation because downtime can halt physical processes?

• a.A public cloud web application that scales elastically behind a managed load balancer
• b.A standard corporate email server that can be patched and rebooted on a weekly cycle
• c.A developer's laptop used for writing and testing application source code locally each day
• d.Industrial control systems and SCADA networks✓

ICS and SCADA systems control physical processes where downtime affects safety and operations, so patching windows are constrained. Strong network segmentation and strict access control compensate. Their legacy nature makes isolation essential.

A medical infusion pump runs a real-time operating system with limited memory and cannot easily accept traditional antivirus software. Which category and challenge does this represent?

• a.A virtual machine that can be snapshotted and rolled back at any convenient time needed
• b.A cloud-native container that can be redeployed instantly from an immutable base image
• c.A general-purpose server that can run any standard endpoint protection agent very easily
• d.An embedded system whose constraints limit traditional security controls✓

Embedded systems and their real-time operating systems have limited resources and long lifecycles, making conventional controls like antivirus impractical. Compensating controls such as segmentation and strict network filtering protect them. Vendor patching is often slow or unavailable.

A traditional network trusts any device once it is inside the corporate perimeter. Which weakness does zero trust specifically aim to remove?

• a.The presence of redundant components that keep services available during a failure
• b.The use of encryption for data transmitted across the untrusted public internet backbone
• c.The requirement that users authenticate at least once before accessing any resource
• d.Implicit trust granted based solely on network location✓

Zero trust eliminates implicit trust based on network location, since an attacker inside the perimeter would otherwise move freely. Instead it verifies every request by identity and context. This limits lateral movement after an initial breach.

In a public cloud, multiple customers share the same underlying physical hardware. Which security property must the provider guarantee between them?

• a.That all customers can freely read each other's data to enable easy collaboration together
• b.That every customer manages the provider's physical data center access controls directly
• c.Strong logical isolation between tenants✓
• d.That customers share a single common encryption key for simplicity across all tenants

Multitenancy means customers share infrastructure, so the provider must enforce strong logical isolation so one tenant cannot access another's data or workloads. A failure in isolation, such as VM escape, is a serious risk. Tenant boundaries are a core cloud security concern.

To ensure only authenticated devices can use a wired switch port before gaining network access, which standard should be implemented?

• a.HTTPS, which encrypts web traffic but does not authenticate a device onto a switch port
• b.DHCP, which automatically assigns IP addresses but does not verify any device identity
• c.NAT, which translates private addresses to public ones but performs no authentication
• d.IEEE 802.1X port-based network access control✓

IEEE 802.1X provides port-based network access control, requiring a device to authenticate, often via EAP and a RADIUS server, before the port forwards traffic. This blocks unauthorized devices at the edge. It is a foundational network access control.

A virtualization admin wants to capture a point-in-time state of a VM so it can be instantly rolled back if a patch fails. Which capability provides this?

• a.Network segmentation, which isolates zones to limit the spread of an active intrusion
• b.Snapshots✓
• c.Geographic dispersion, which places recovery capacity far from the primary location
• d.Load balancing, which distributes workload across servers but saves no restore point

A snapshot records a virtual machine's state at a point in time, enabling quick rollback if a change causes problems. It is ideal before risky updates. Snapshots are not a substitute for full backups but complement recovery workflows.

Which method conceals the very existence of a secret message by hiding it inside an ordinary-looking image file?

• a.Hashing, which produces a fixed-length fingerprint used to verify the integrity of data
• b.Symmetric encryption, which scrambles data but makes its presence obvious to observers
• c.Tokenization, which swaps a sensitive value for a non-sensitive reference token instead
• d.Steganography✓

Steganography hides data within another medium, such as an image, so the message's existence is concealed rather than merely scrambled. Encryption protects content but reveals that something is protected. Steganography aims for secrecy of existence itself.

An organization routes all outbound web traffic through a device that filters URLs, inspects content, and enforces acceptable use before requests reach the internet. What is this?

• a.A load balancer whose sole role is distributing incoming connections across many servers
• b.A jump server used exclusively by administrators to reach a protected network segment
• c.A forward proxy or secure web gateway✓
• d.A reverse proxy that sits in front of internal servers to handle inbound client requests

A forward proxy or secure web gateway mediates outbound requests, applying URL filtering, content inspection, and policy enforcement. It centralizes control and visibility over user web access. This differs from a reverse proxy, which fronts inbound server traffic.

In software-defined networking, the intelligence that decides how traffic is forwarded is separated from the devices that move the packets. What are these two layers called?

• a.The presentation layer and the session layer of the traditional OSI networking model
• b.The control plane and the data plane✓
• c.The application layer and the physical cabling layer, with no real separation of logic
• d.The perimeter zone and the internal zone divided only by a single boundary firewall

Software-defined networking separates the control plane, which makes forwarding decisions, from the data plane, which forwards packets. Centralizing control enables programmable, agile network management. Securing the controller is critical since it governs the whole network.

To avoid a single vendor vulnerability taking down everything, an organization deliberately runs critical workloads across two different cloud providers. Which resilience strategy is this?

• a.Implicit trust, which automatically grants access to anything inside the perimeter zone
• b.Data masking, which hides portions of sensitive fields shown within an interface view
• c.Platform diversity through a multi-cloud approach✓
• d.Vertical scaling, which adds more resources to a single existing server instance in place

Platform diversity and multi-cloud avoid a monoculture where one vendor flaw or outage affects all systems. Spreading workloads increases resilience against provider-specific failures. It adds complexity that must be managed carefully.

A security team wants visibility into traffic at key points without blocking it, feeding copies to their monitoring platform. Which device role accomplishes this?

• a.A jump server that administrators must pass through to reach the protected systems
• b.An inline next-generation firewall that actively drops any traffic it deems malicious
• c.A passive sensor collecting traffic through a tap or span port✓
• d.A load balancer that distributes inbound requests across a pool of many web servers

Passive sensors receive copied traffic via a tap or span port, giving visibility without sitting in the forwarding path. They can alert but not block, avoiding becoming a chokepoint. Placement at chokepoints maximizes monitoring coverage.

Access to a sensitive finance folder is limited strictly to members of the finance team, and no one else can open it. Which data protection method is applied?

• a.Geographic dispersion of backups to a facility located in a distant separate region
• b.Full-disk encryption applied uniformly to every laptop regardless of the user's role
• c.Load balancing of requests across multiple servers to improve overall performance
• d.Permission restrictions✓

Permission restrictions limit who can access data based on need, enforcing least privilege at the file or resource level. Only authorized roles can open the sensitive folder. This access control is a fundamental data protection method.

An online retailer analyzes expected holiday traffic to ensure it has enough compute, storage, and bandwidth to stay available under peak load. This process is:

• a.Capacity planning✓
• b.A penetration test that actively attempts to exploit weaknesses in the environment
• c.A business impact analysis that ranks processes by the effect of their disruption over time
• d.A tabletop exercise walking through an incident scenario through group discussion only

Capacity planning forecasts demand for people, technology, and infrastructure so resources can meet peak load without failing. Under-provisioning risks outages, an availability concern. It is a key part of resilience and continuity planning.

A hardened server runs only the single service it was built to provide, with all other software, ports, and accounts removed. Which principle does this reflect?

• a.Reducing the attack surface through least functionality✓
• b.Implementing implicit trust for all devices located inside the network perimeter zone
• c.Applying load balancing to distribute incoming requests across many identical servers
• d.Increasing redundancy by duplicating every component on the same physical host machine

Least functionality reduces the attack surface by removing unneeded services, ports, software, and accounts. A single-purpose hardened host offers attackers fewer footholds. It complements least privilege by hardening the system itself.

A remote-access VPN is configured so that only traffic destined for corporate resources goes through the tunnel while general internet browsing goes out directly. This is:

• a.An air gap, which physically isolates the network from all external connections entirely
• b.A split tunnel✓
• c.A screened subnet, which hosts public-facing servers between two separate firewalls
• d.A full tunnel, which forces absolutely all of the client's traffic through the VPN link

A split tunnel routes only corporate-bound traffic through the VPN while other traffic exits locally, improving performance but reducing inspection of general browsing. A full tunnel sends everything through the VPN for maximum control. The choice trades performance against visibility.

A company embeds a third-party analytics library into its web app, and a flaw in that library exposes user data. Which architectural risk does this highlight?

• a.Fail-open behavior, in which a failed control allows traffic through by default
• b.Data sovereignty, concerning which jurisdiction's laws govern where the data is stored
• c.Third-party dependency risk in the software supply chain✓
• d.Geographic dispersion, concerning how far apart the recovery sites are located

Incorporating third-party code or services inherits their vulnerabilities, a software supply chain risk. A flaw in a dependency becomes a flaw in the application. Vetting components, monitoring advisories, and maintaining an SBOM manage this exposure.

A server uses multiple disks configured so that if one drive fails, no data is lost and the system keeps running. Which technology provides this disk-level redundancy?

• a.Load balancing that distributes requests across several separate front-end web servers
• b.Network segmentation that divides the LAN into isolated separate broadcast domains
• c.A snapshot taken once per week and stored on the same failing disk array as the data
• d.RAID with a fault-tolerant configuration✓

Redundant array of independent disks (RAID) with a fault-tolerant level, such as RAID 1 or 5, tolerates a drive failure without losing data or availability. It provides hardware-level resilience for storage. RAID is not a backup, since it does not protect against deletion or corruption.

A stolen laptop's drive is encrypted, so the thief cannot read any of its files without the key. Which control protected the data?

• a.Data masking that only hid selected characters while leaving the rest fully readable
• b.Full-disk encryption protecting data at rest✓
• c.A firewall rule that blocked inbound connections to the laptop over the network only
• d.TLS, which secures data in transit but does nothing for files that are stored on disk

Full-disk encryption protects data at rest, rendering the drive's contents unreadable without the key even if the device is stolen. It defends confidentiality when physical control is lost. TLS, by contrast, protects data in transit, not at rest.

An audit finds Telnet, FTP, and HTTP still in use for management. Which set of replacements provides encrypted equivalents?

• a.SSH for Telnet, SFTP for FTP, and HTTPS for HTTP✓
• b.Telnet with SNMPv1, FTP with TFTP, and HTTP left unchanged for compatibility reasons
• c.Telnet with rlogin, FTP with plain FTP on another port, and HTTP with HTTP proxying
• d.SSH for HTTP, FTPS for SSH, and Telnet retained for legacy device administration

Insecure plaintext protocols should be replaced with encrypted equivalents: SSH for Telnet, SFTP or FTPS for FTP, and HTTPS for HTTP. These protect credentials and data in transit. Disabling the legacy services entirely completes the hardening.

When primary automated systems fail, staff follow documented manual procedures to keep critical business functions going. What does this reflect?

• a.A penetration test evaluating whether attackers could exploit the manual procedures
• b.Network segmentation designed to contain an intruder's movement between zones
• c.A recovery point objective specifying the maximum acceptable amount of data loss
• d.Continuity of operations planning✓

Continuity of operations planning ensures essential functions continue during disruptions, including manual alternatives when automated systems are unavailable. It keeps the business running while recovery proceeds. Documented procedures and trained staff make it work.

In the zero trust control plane, which component establishes and configures the session between a subject and a resource once access is approved?

• a.The policy administrator✓
• b.The data plane, which forwards packets but plays no part in setting up the session
• c.The policy enforcement point, which physically sits in the traffic path to allow or deny
• d.The certificate revocation list, which lists certificates that are no longer trusted now

The policy administrator executes the policy engine's decision by establishing or tearing down the connection and issuing session credentials. It acts as the bridge between the decision and the enforcement point. Together they form the zero trust control plane.

An organization wants to enforce encryption, remote wipe, and app policies on employee-owned phones that access corporate email. Which technology enables this?

• a.A load balancer distributing inbound email connections across multiple servers
• b.Mobile device management✓
• c.A screened subnet that isolates public web servers from the internal network zone
• d.A honeypot deployed to lure attackers away from the real corporate resources

Mobile device management (MDM) enforces security policies such as encryption, remote wipe, and app control on enrolled devices, including personally owned ones in BYOD models. It extends organizational control to mobile endpoints. Policy separation protects corporate data on personal phones.

Administrators use a separate dedicated management network, isolated from production traffic, to configure critical devices. Why is this preferred?

• a.It increases the attack surface by exposing management interfaces to all normal users
• b.It keeps management access available and protected even if the production network is compromised✓
• c.It automatically encrypts all production application traffic without any configuration
• d.It removes the need to authenticate administrators when they connect to the devices

Out-of-band management uses a separate network for administrative access, so managing devices remains possible even if the production network is compromised or unavailable. It also isolates sensitive management interfaces from general users. This reduces both risk and dependency.

An investment firm cannot tolerate more than a few minutes of downtime, so it maintains a fully staffed, fully equipped duplicate facility with live-replicated data. Which site type is this?

• a.A cold site providing only space and power, requiring extensive setup before any use
• b.A warm site with equipment in place but needing data restoration before it can operate
• c.A hot site✓
• d.A mobile recovery unit towed to a location only after a disaster has been declared

A hot site is fully provisioned with equipment, current data, and often staff, allowing near-immediate takeover. It offers the fastest recovery at the highest cost. It suits organizations with very low tolerance for downtime.

Where in a secure architecture should end-of-life storage media be handled so that residual data cannot be recovered by outsiders?

• a.Left in place indefinitely because encryption alone guarantees permanent destruction
• b.Sold or donated immediately after a quick file deletion to maximize the salvage value
• c.Returned to general storage shelves once the files appear deleted in the interface view
• d.Sanitized or physically destroyed under a documented media disposal process✓

Media at end of life must be sanitized or destroyed through a documented process to prevent recovery of residual data. Simple deletion or formatting can leave data recoverable. Certificates of destruction provide auditable assurance.

Under zero trust, after a user authenticates, their device's security posture changes to non-compliant mid-session. What should ideally happen?

• a.Nothing, because access granted at login remains valid for the entire session by design
• b.All logging stops to conserve resources once the initial authentication has succeeded
• c.Access is re-evaluated and can be restricted based on the changed posture✓
• d.The user gains additional privileges automatically as a reward for staying connected

Zero trust continuously evaluates trust, so a change in device posture during a session can trigger reduced access or re-authentication. Trust is never permanent or based on a single login. This adaptive, ongoing verification limits risk from changing conditions.

To block users from resolving known malicious domains before any connection is made, an organization deploys protective DNS filtering. Which benefit does this provide?

• a.It stops connections to known-malicious domains at the name-resolution stage✓
• b.It encrypts all stored data at rest on the endpoints without needing any local agent
• c.It replaces the need for endpoint protection and network firewalls entirely for good
• d.It guarantees that no zero-day exploit can ever affect the protected endpoints again

Protective DNS filtering blocks resolution of known-malicious domains, stopping many threats such as phishing and command-and-control before a connection is established. It is a lightweight, broad control. It complements, but does not replace, other layered defenses.

A popular web service distributes incoming requests across a pool of identical servers so no single server is overwhelmed and one failing server does not take the site down. Which technology is this?

• a.A tabletop exercise conducted to walk through the incident response plan verbally as a group
• b.Data classification used to label information according to its sensitivity level for handling
• c.Full-disk encryption applied to protect data at rest on each of the servers involved here
• d.Load balancing✓

Load balancing spreads client requests across multiple servers, improving performance and availability while allowing a failed node to be bypassed. It supports both scaling and resilience. Health checks let the balancer route around unhealthy servers.

When selecting where to position a new intrusion prevention system, which factor most directly determines whether it can actively block attacks?

• a.Whether it is deployed inline in the traffic path rather than passively receiving copies✓
• b.The brand of the switch that happens to connect the device to the rest of the network
• c.The color-coding scheme used on the physical network cables in the data center racks
• d.The number of unrelated administrative user accounts defined on the appliance itself

An IPS must be inline, sitting directly in the traffic path, to actively block malicious packets; a passive tap deployment can only detect and alert. Device placement therefore determines its capability. This inline-versus-passive decision is a core architecture consideration.