CompTIA Security+ (SY0-701) - Blueprint Practice Exam 1

1. A business accepts a low-impact risk because remediation costs exceed the expected loss. What should accompany that decision?
2. A clinic must keep life-support equipment separate from guest Wi-Fi while allowing narrowly defined management traffic. Which design is most appropriate?
3. A company installs bollards outside its data center to stop vehicles reaching the entrance. Which control category best describes the bollards?
4. A company issues short-lived credentials to an automated deployment job instead of storing a permanent cloud key. What is the primary benefit?
5. A company wants a secure replacement for passwords that resists look-alike login websites. Which authentication option best meets this requirement?
6. A company's remote administrators need access to internal management services without exposing those services directly to the internet. What is a suitable architecture?
7. A critical service must tolerate losing an entire building. Which design directly addresses that failure scope?
8. A database contains public product descriptions and restricted medical records. What should determine the stronger protection requirements for the medical records?
9. A departing contractor no longer needs access to source code. Which action best enforces the access lifecycle?
10. A developer downloads a package whose name differs from a popular library by one letter. The package runs a credential-stealing installation script. Which risk does this illustrate?
11. A help desk receives many reports of repeated unsolicited MFA approvals, followed by one user accepting a prompt to stop the interruptions. What technique was used?
12. A laptop is stolen while shut down. Which two controls most directly protect its local confidential files? Select 2.
13. A newly acquired company has an internet-facing device running unsupported firmware with no available patch. What best reduces immediate exposure while replacement is arranged?
14. A partner's legitimate account is used from an unusual location to download far more records than its normal baseline. Which detection strategy is most relevant?
15. A payroll service must prove that a signed payment instruction was sent by a particular authorized manager. Which property does a verifiable digital signature primarily support here?
16. A public application executes database commands assembled directly from untrusted search text. Which change most directly prevents SQL injection?
17. A red-team report shows that a user-controlled file path allows reading files outside an intended upload directory. What is the primary weakness?
18. A retailer can lose at most 30 minutes of transaction data after a disaster. Which requirement does this specify?
19. A retailer needs to hide stored customer identifiers while allowing reversal by an authorized service using a secure lookup table. Which method fits?
20. A security policy requires separation between requesting a payment and approving it. What risk does this primarily reduce?
21. A security team wants to determine whether last night's backup can actually restore the payroll service. What provides the strongest evidence?
22. A SIEM alert combines failed logins, a successful login from a new location, and a new privileged role assignment. What should the analyst do first?
23. A system has an asset value of $200,000 and an estimated exposure factor of 25% per incident. What is its single loss expectancy?
24. A team must apply legal holds to selected records while routinely deleting expired data elsewhere. What should govern this behavior?
25. A vulnerability scan reports an affected product, but the host has a backported fix. What should the analyst do?
26. A web application runs in a public cloud. Under the shared-responsibility model for its virtual machines, which task normally remains the customer's responsibility?
27. A web server requires a certificate renewal. What must be protected most carefully to prevent an attacker impersonating that server?
28. A workstation encrypts shared documents and displays a payment demand. Select 2 actions that directly reduce further damage and support recovery.
29. An administrator needs to give a reporting service access only to its own read-only database views. Which principle applies?
30. An administrator prepares a firewall rule permitting one application server to reach a database on one required port. What is the best validation approach?
31. An attacker uses one common password against hundreds of employee accounts while avoiding repeated failures against any single account. Which attack is this?
32. An awareness exercise shows that employees report suspicious messages more quickly after training. Which metric directly supports that conclusion?
33. An employee receives a message that appears to be from the finance director, requesting an urgent supplier bank-account change outside normal approval channels. What is the best immediate action?
34. An incident responder must collect a disk image for possible legal proceedings. What practice best supports evidence integrity?
35. An industrial controller cannot be patched immediately without halting a safety-critical process. Which approach best balances security and operational needs?
36. An internal audit finds that a production exception has no expiry date or designated owner. What is the best corrective action?
37. An organization needs encrypted data to remain unreadable if a retired disk is lost, even after files were deleted. Which preventive measure is best?
38. An organization permits each application request only after evaluating the user's identity, device posture, and requested resource. Which approach is illustrated?
39. An organization uses one shared administrator account for all engineers. What change best improves accountability?
40. Before signing with a cloud processor that will store sensitive customer data, what should a company prioritize?

Comments — 0