Security+ study guide for SY0-701, with SY0-801 notes

An enterprise PKI architect requires that the root CA be kept offline and only used to sign intermediate CA certificates. What is the primary security rationale for this design?

Use Check on the answer you favor. The verdict shows up with a short note on each choice.

1. Enables real-time revocation status checks
   Check

   Revocation status comes from CRLs or OCSP responders run by the issuing CAs; an offline root doesn't provide real-time checks.
2. Provides faster certificate issuance to clients
   Check

   Clients get certificates from the online intermediate CAs; taking the root offline adds steps for root tasks and doesn't speed issuance.
3. Simplifies the overall PKI management
   Check

   Rather than simplifying PKI management, an offline root adds work, such as periodic ceremonies to sign intermediate certificates and the root's CRL.
4. Reduces costs of online infrastructure
   Check

   It doesn't reduce costs: an offline root needs secure storage and formal key ceremonies, so the design is chosen for protection.
5. Prevents root CA private key compromise
   Check

   Every certificate chains up to the root, so keeping the root's private key offline puts it out of reach of network attackers; if it leaked, the whole hierarchy would have to be rebuilt.

During a ransomware incident, the IT team restores data from immutable backups after the threat is contained. How should this restoration process be classified?

1. Detective
   Check

   Detective controls such as alerts and log reviews reveal that something happened; restoring files detects nothing.
2. Compensating
   Check

   A compensating control stands in for a primary control that can't be used; restoration is the normal recovery step, not a substitute.
3. Preventive
   Check

   It isn't preventive: immutable backups keep the backups themselves from being encrypted, but restoring happens after the incident and doesn't stop it.
4. Corrective
   Check

   Restoring clean data after the threat is contained repairs the damage the ransomware did, which is what a corrective control does.

An attacker sends a specially crafted HTTP request that makes a web application copy input past the end of a fixed-size array on the stack. The extra bytes overwrite the saved return address, letting the attacker run arbitrary code with the application's privileges. Which type of software vulnerability is being exploited?

1. SQL injection
   Check

   SQL injection changes database queries through unsanitized input; it doesn't overwrite stack memory or return addresses.
2. Race condition
   Check

   A race condition depends on the timing of two operations, such as a check and a later use; nothing here relies on timing.
3. Integer overflow
   Check

   An integer overflow is arithmetic wrapping past a numeric type's limit; it can lead to memory bugs, but the flaw described is the unchecked copy into the array.
4. Buffer overflow
   Check

   Copying more input than a fixed-size buffer holds spills into adjacent stack memory, and overwriting the saved return address to hijack execution is the classic buffer overflow.
5. Cross-site scripting
   Check

   Cross-site scripting runs attacker script in other users' browsers; it doesn't corrupt the server application's memory.

Due to severe budget limits, an organization rents a recovery facility that provides only power, cooling, and space, requiring them to bring and configure all hardware. Identify the site type.

1. Cold site
   Check

   A cold site supplies only space, power and cooling; the organization brings in and sets up its own hardware, which makes it the cheapest and slowest option.
2. Warm site
   Check

   A warm site already has some hardware and connectivity in place, so it costs more than a bare facility but recovers faster.
3. Hot site
   Check

   A hot site is fully equipped and often holds current data, ready to take over quickly; it is the most expensive choice, not the budget one.
4. Cloud recovery site
   Check

   A cloud recovery site runs on a provider's infrastructure instead of an empty facility that you fill with your own hardware.
5. Mobile site
   Check

   A mobile site is a portable facility, such as a trailer, moved to where it is needed; the scenario describes a fixed rented building.

A government agency handling Top Secret information mandates complete physical separation of its classified network from any other network to prevent data exfiltration. Which network architecture must be implemented?

1. Cloud-based isolated VPC
   Check

   A VPC is logically isolated inside a provider's shared infrastructure and reached over networks, not physically separated.
2. VLAN segmentation
   Check

   VLANs separate traffic logically on shared switches; a misconfiguration or VLAN hopping can bridge them, so this isn't physical separation.
3. Air-gapped system
   Check

   An air-gapped system has no physical or wireless connection to any other network, so data can leave only through a deliberate physical transfer.
4. Firewall with DMZ
   Check

   A DMZ design still connects the networks through a firewall, which filters traffic rather than removing the link.
5. VPN connectivity
   Check

   A VPN encrypts a connection between networks; it creates a link instead of removing one.

A multinational company stores customer data in data centers located in the United States, Germany, and Australia. A legal request from US authorities demands access to data stored exclusively in Germany. Which data governance principle determines that the data is subject to German law, not US law?

1. Data classification
   Check

   Classification labels data by sensitivity to decide how it is handled; it doesn't settle which country's law applies.
2. Data sovereignty
   Check

   Data sovereignty means data is subject to the laws of the country where it is physically stored, so records held only in Germany fall under German law.
3. Data minimization
   Check

   Minimization limits collection to what a purpose needs; it says nothing about legal jurisdiction over stored data.
4. Data retention
   Check

   Retention sets how long data is kept and when it is destroyed, not which legal system governs it.

A junior project manager with no programming responsibilities was automatically enrolled in the annual secure coding training course. What should the security awareness manager do?

1. Have them finish only the coding course's introduction
   Check

   Finishing only the coding course's introduction is still the wrong content for the role and doesn't give them the training they need.
2. Reassign them to a general course that fits their role
   Check

   Reassigning them to a general course that fits the role, such as phishing and data handling awareness, gives someone with no coding duties training they can use.
3. Add a project management course and keep the coding course
   Check

   Adding a project management course while keeping the coding course still leaves an irrelevant course assigned, so the mismatch isn't fixed.
4. Take no action and trust the automated assignment
   Check

   Taking no action leaves the wrong training in place; the automated assignment has already made a mistake.
5. Keep the enrollment so they learn secure coding too
   Check

   Keeping the enrollment means secure coding content that doesn't apply to their daily work, which costs time and leaves their real risks untrained.

During a vendor risk assessment, an analyst needs the auditor's detailed test results showing how a cloud provider's security controls operated over the past 12 months. Which type of report should be requested?

1. SOC 1 report
   Check

   SOC 1 covers controls relevant to customers' financial reporting, not the provider's security controls in general.
2. ISO 27001 certification
   Check

   ISO 27001 certification shows the provider runs a conforming management system; it isn't a control-by-control report of test results over a period.
3. SOC 3 report
   Check

   A SOC 3 is a short general-use summary meant for the public and leaves out the detailed test results the analyst needs.
4. SOC 2 Type I report
   Check

   A SOC 2 Type I report covers the design of controls at one point in time; it can't show whether they worked over the past year.
5. SOC 2 Type II report
   Check

   A SOC 2 Type II report tests how the provider's security controls actually operated across a review period, not on a single date, and lists the auditor's tests and results.

Following a major data breach, an investigation reveals that the IT team, acting as Data Custodians, failed to properly implement access controls as directed. According to standard data governance roles, who holds ultimate accountability for the breach?

1. Chief Information Security Officer
   Check

   The CISO runs the security program and advises, but in standard data governance roles the CISO isn't the accountable party for each data set.
2. IT Manager
   Check

   An IT manager supervises the custodians' work; that is operational responsibility, not ownership of the data.
3. Data Owner
   Check

   The data owner, usually a senior business leader, sets classification and access requirements and stays accountable even when others carry out the controls.
4. Data Custodian
   Check

   Custodians implement and run controls as directed; they answer for that work, but ultimate accountability for the data sits above them.

A security patch for a critical vulnerability in the company's financial application was released by the vendor six weeks ago, but the IT team postponed deployment due to testing requirements. During this time, an attacker exploits the vulnerability to gain access to the database. Which of the following best classifies the exploited vulnerability?

1. Misconfiguration
   Check

   A misconfiguration is an insecure setting such as a default password or open permissions; the problem here is a missing vendor fix, not a setting.
2. Unpatched software
   Check

   The vendor had already released a fix and the company delayed applying it, so the attacker used a known flaw in unpatched software.
3. Hardware security flaw
   Check

   The vulnerability is in a financial application, which is software; no hardware component is involved.
4. End-of-life software
   Check

   End-of-life products no longer receive patches; this vendor still supported the application and had issued one.
5. Zero-day exploit
   Check

   A zero-day exploit targets a flaw that has no fix yet; this patch had been out for six weeks.

A marketing team at a large corporation uses an unapproved cloud-based file-sharing service to collaborate on a campaign. Due to a misconfiguration, confidential client contracts are publicly accessible for three days before IT discovers the exposure. Which of the following best classifies this threat?

1. Hacktivist collective protesting the corporation
   Check

   Hacktivists act to make a public point about a cause; nothing here involves a protest or an outside group.
2. External attacker exploiting the misconfiguration
   Check

   An external attacker would have to find and use the open files, and none is described; the exposure came from the team's own setup and was found by IT.
3. Shadow IT used by unintentional insiders
   Check

   This is shadow IT by unintentional insiders: employees adopted an unapproved service to get their work done and exposed data by mistake, with no intent to harm.
4. Malicious insider intentionally exposing data
   Check

   The marketing team meant to collaborate, not to leak contracts; without intent to cause harm this isn't a malicious insider.
5. Organized crime group targeting the company
   Check

   Organized crime seeks profit through theft or extortion, and the scenario shows no criminal actor at all.

When checking the digital signature on a software patch from its vendor, which key does the recipient use to verify the signature?

1. The vendor's private key
   Check

   The vendor's private key creates the signature and never leaves the vendor; a recipient who held it could forge signatures.
2. The customer's public key
   Check

   The customer's public key is used to encrypt data for the customer, not to check something the vendor signed.
3. The customer's private key
   Check

   The customer's private key would decrypt data sent to the customer or sign the customer's own messages; it has no link to the vendor's signature.
4. A shared symmetric key
   Check

   A shared symmetric key gives integrity checks such as an HMAC but not a digital signature, since anyone holding the key could have produced the value.
5. The vendor's public key
   Check

   The vendor signs with its private key, so anyone can check the signature with the matching public key, which the vendor publishes or embeds in its certificate.

A defense contractor must control access to project data with security clearance levels and classification labels. Users cannot change permissions on files they create; only security administrators assign labels. Which access control model must be implemented?

1. Mandatory Access Control
   Check

   Mandatory access control decides access by comparing a user's clearance with a label that only administrators set, so users can't grant access themselves.
2. Discretionary Access Control
   Check

   Discretionary access control lets the owner of a file decide who may use it, which is exactly what this contractor forbids.
3. Role-Based Access Control
   Check

   Role-based access control grants permissions by job role; it doesn't compare clearance levels with classification labels.
4. Attribute-Based Access Control
   Check

   Attribute-based access control evaluates flexible policies over many attributes; the fixed clearance-and-label rule described is the defining trait of mandatory access control.

A healthcare organization's approved vulnerability scanner at 10.50.50.8 triggers thousands of IPS alerts daily on one web-exploit signature. Which action best reduces false positives while preserving detection of real attacks?

1. Block 10.50.50.8 at the perimeter firewall permanently
   Check

   The scanner is an approved internal tool; blocking it stops legitimate vulnerability scanning instead of tuning the alert.
2. Change the entire IPS deployment to monitor-only IDS mode
   Check

   Switching every sensor to monitor-only gives up blocking for all attacks to fix noise from one known source.
3. Disable the web-exploit signature entirely on the IPS
   Check

   Disabling the signature silences the scanner but also stops detection of real attackers using that exploit.
4. Exempt 10.50.50.8 from that one signature only
   Check

   Exempting the approved scanner from that one signature removes the known noise while the signature still fires on every other source.
5. Set the signature action to drop without source exceptions
   Check

   Dropping the traffic with no exception keeps the alerts coming and breaks the approved scanner's work.

A Tier-1 SOC analyst discovers a security incident that exceeds their authorized remediation scope according to the incident response plan. What is the NEXT step the analyst should take?

1. Escalate it to the higher-tier analysts
   Check

   Escalating to the higher-tier analysts, as the incident response plan directs, hands the incident to people authorized to act on it before evidence or time is lost.
2. Immediately isolate the affected system from the network
   Check

   Isolating a system is a containment action the plan has put outside this analyst's authority; acting alone can disrupt business or evidence.
3. Conduct a thorough analysis to identify the root cause
   Check

   A deep root-cause analysis belongs to the responders who own the incident; doing it first delays the people who can act.
4. Notify all end users about the potential security breach
   Check

   Broad notification is decided by incident leadership and communications under the plan, not by a Tier-1 analyst at first discovery.
5. Close the ticket after documenting it
   Check

   Closing the ticket leaves a confirmed incident unhandled; documenting is right, but the case has to move on to someone authorized.