Security+ SY0-701 Practice Questions

Purchasing cyber insurance is a form of risk treatment where the financial impact of a

potential cyber incident is shifted to a third party (the insurer). This strategy is known as

risk transference. According to NIST SP 800-37, "Risk sharing or transfer: Shifting a

given risk to other organizations or entities (e.g., by using insurance, service level

agreements, contracts, or other agreements)." Similarly, university courseware on risk

management categorizes insurance as a primary example of risk transfer.

A. Accept: Risk acceptance means acknowledging a risk and deciding not to take

action to reduce it, often because the cost of mitigation outweighs the potential impact.

Purchasing insurance is an active measure, not acceptance. (NIST SP 800-37)

C. Mitigate: Risk mitigation involves implementing controls or countermeasures to

reduce the likelihood or impact of a risk. While insurance can cover financial losses

(impact), it doesn't reduce the likelihood of the event itself. (NIST SP 800-37)

D. Avoid: Risk avoidance means deciding not to engage in the activities that would

create the risk. Purchasing insurance addresses the financial consequences of a risk,

not avoiding the activities that lead to it. (NIST SP 800-37)

National Institute of Standards and Technology (NIST). (2010). Special Publication

800-37, Revision 1: Guide for Applying the Risk Management Framework to Federal

Information Systems: A Security Life Cycle Approach. Page B-20 (Appendix B,

Section B.4 RISK RESPONSE).

URL: https://csrc.nist.gov/publications/detail/sp/800-37/rev-1/final

Specific Reference: "Risk sharing or transfer: Shifting a given risk to other

organizations or entities (e.g., by using insurance, service level agreements, contracts,

or other agreements)." Also defines risk acceptance, mitigation (risk reduction), and

avoidance.

Huber, M., & P R. (2013). Managing Information Security Risks: The OCTAVE Approach.

Addison-Wesley Professional. (Though a book, it is published by a reputable academic

publisher and aligns with NIST concepts widely taught in university courses).

Note: While a direct link to specific page numbers isn't feasible for a commercial book,

it's a widely recognized academic resource. Risk treatment options including transfer

(sharing) via insurance are standard concepts covered. For a specific university

reference embodying these concepts:

University of Washington. (n.d.). ITLC - IT Risk Management - Risk Treatment.

URL: https://www.washington.edu/itlc/what-we-do/it-risk-management/risk- treatment/

Specific Reference: Defines "Transfer (Share)" as: "Transferring or sharing a risk with a

third party (e.g., contracts, insurance). Reduces the impact of the risk to the UW." Also

defines Avoid, Accept, and Mitigate (Reduce).

A compensating control provides an alternative measure of protection when a

primary security control cannot be fully implemented or is bypassed. In this scenario, if

access to a high-risk website must be granted (meaning a primary control like outright

blocking is not employed), enabling threat prevention features (e.g., Intrusion

Prevention Systems (IPS), advanced anti-malware, content filtering) on the firewall is

an appropriate compensating control. These features actively inspect traffic to and from

the risky site, attempting to identify and mitigate potential threats in real-time, thereby

reducing the risk associated with the allowed access. This aligns with the NIST

definition of a compensating control, which is used in lieu of a recommended control to

provide a comparable level of protection.

· B. Configuring a SIEM tool to capture all web traffic: A Security Information and

Event Management (SIEM) tool is primarily a detective control. It collects and

analyzes log data to identify potential security incidents but doesn't inherently

prevent or mitigate the initial risk of accessing the high-risk website itself.

· C. Setting firewall rules to allow traffic from any port to that destination: This action

would increase security risks significantly by unnecessarily exposing the destination

to potential attacks on various ports, violating the principle of least privilege. It is not a

security control, let alone a compensating one.

· D. Blocking that website on the endpoint protection software: This is a

preventive control. If the website is blocked, access isn't "provided," which

contradicts the question's premise that user access is being given. A compensating

control is needed when the risky action (accessing the site) is allowed.

1. NIST Glossary - Compensating Security Control: Defines a compensating security

control as: "A security control that is employed by an organization in lieu of a

recommended security control (or control enhancement) in a baseline that provides

equivalent or comparable protection for an information system or organization."

o URL: https://csrc.nist.gov/glossary/term/compensating_security_control

2. Microsoft Azure Documentation - Azure Firewall Premium features (IDPS):

Describes Intrusion Detection and Prevention Systems (IDPS) as a threat prevention

feature that monitors for malicious activity and can block it. This exemplifies the type of

"threat prevention features" referred to in option A.

o URL: https://learn.microsoft.com/en-us/azure/firewall/premium-features#idps

o Specific section: "IDPS"

3. Indiana University - Knowledge Base - What are compensating controls?: States,

"Compensating controls are alternative controls designed to accomplish the intent of a

prescribed control that cannot be implemented due to legitimate technical or business

constraints." This supports the context of using a compensating control when a primary

one (like blocking) isn't feasible.

o URL: https://protect.iu.edu/cybersecurity/security-topic/policiesstandards/compensating-controls/index.html

An Internet-facing payment application must be protected from web-based attacks (SQLi, XSS, etc.). PCI DSS v4.0 §6.4.3 requires either formal code review or placement of a web application firewall in front of public payment sites. Cloud architecture guides (e.g., AWS Well-Architected Security Pillar, §3.2) place the WAF at the edge of the public subnet, between the Internet gateway/load balancer and the web servers. This provides real-time, layer-7 filtering without exposing the application directly to untrusted traffic.

1. PCI Security Standards Council. “Payment Card Industry Data Security Standard

v4.0

” Req. 6.4.3

pp. 108-109.

2. AWS Well-Architected Framework

Security Pillar

§3.2 “Protecting Workloads

” pp. 19-20.

3. IEEE Computer Society. S. Chaudhary et al.

“Mitigating Web Application Attacks with WAFs

” IEEE Access

vol. 8

2020

pp. 210680-210693

https://doi.org/10.1109/ACCESS.2020.3039217.

Sanctions are official penalties, such as financial fines, operational restrictions, or legal

actions, imposed by authorities for non-compliance with government regulations.

These punitive measures directly translate into significant financial, reputational, and

operational risks for a company, making them the primary and most impactful

consequence, and thus the "greatest concern" when non-compliance occurs. Non-

compliance inherently means breaking the law, and sanctions are the direct enforcement

actions.

· A. Right to be forgotten: This is a specific provision within some data privacy

regulations (e.g., GDPR). Failure to comply with this right is an instance of non-

compliance that leads to sanctions, rather than being the ultimate consequence itself.

· C. External compliance reporting: This is a process or obligation to demonstrate

adherence to regulations. While failure to report correctly can constitute non-

compliance and result in sanctions, reporting itself is a requirement, not the punitive

consequence of overall non-compliance.

· D. Attestation: This is a formal declaration or confirmation of compliance. Similar to

reporting, it is a required activity. Incorrect or missing attestations are forms of non-

compliance that can trigger sanctions, which are the more direct concern.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 83

("General conditions for imposing administrative fines"). This article details the

administrative fines (a type of sanction) that can be imposed for infringements of the

regulation.

o URL: https://eur-lex.europa.eu/legalcontent/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e6394-1-1

o Specifically: Article 83(1) states "Each supervisory authority shall ensure that the

imposition of administrative fines pursuant to this Article in respect of infringements of

this Regulation...shall in each individual case be effective, proportionate and

dissuasive."

2. NIST Special Publication 800-39, "Managing Information Security Risk:

Organization, Mission, and Information System View" (March 2011), Chapter 2,

Section 2.2, Page 8. This publication discusses that risk framing must consider legal

and regulatory requirements, and that adverse impacts from security risks (which

include non-compliance) can include "legal liability [and] financial costs." Sanctions

are the mechanisms that impose such liabilities and costs.

o URL: https://csrc.nist.gov/publications/detail/sp/800-39/final

o Specifically: Page 8, "Potential adverse impacts from security risks...can

include...damage to reputation; harm to individuals or groups; societal harm; mission

degradation or failure; legal liability; financial costs (e.g., direct losses, recovery costs,

penalties/fines); or loss of confidence in the organization by its partners, customers, or

constituency."

3. Cambridge Dictionary (Cambridge University Press). Definition of "sanction"

(noun, PUNISHMENT). Defines a sanction as "a punishment for not obeying a rule or

law."

o URL: https://dictionary.cambridge.org/dictionary/english/sanction (Definition 2

under "sanction noun (PUNISHMENT)")

4. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 17 ("Right

to erasure (‘right to be forgotten’)"). This article defines a specific regulatory

obligation.

o URL: https://eur-lex.europa.eu/legalcontent/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e2539-1-1

The host 192.168.10.22 is the origin of the infection. The logs for this host at 2:31 PM show "Scheduled scan disabled by process svch0st.exe" and "Scheduled update disabled by process svch0st.exe." This indicates it was the first host to be compromised, allowing the malware to disable its security measures before spreading. The typo "svch0st.exe" is a common malware tactic to mimic a legitimate Windows process, svchost.exe. The hosts 192.168.10.41 and 10.10.9.18 are infected. Their logs show they were unable to quarantine the svch0st.exe file, indicating the infection is active and has bypassed the security software. The hosts 192.168.10.37 and 10.10.9.12 are clean. Their logs show they successfully detected and quarantined the svch0st.exe file, effectively containing the threat before it could compromise the system.

Fortinet. "What is an Attack Vector?". (Provides context on how malware disables security software).

Kaspersky. "Dealing with Svchost.exe Virus' Sneak Attack." (Explains the common malware tactic of mimicking the svchost.exe process).

Secureworks. "A Firewall Log Analysis Primer." (Explains how firewall logs can be used to trace the origin and spread of an infection by analyzing connections and timestamps).

Luo, Wuqiong. "Identifying Infection Sources in a Network." Nanyang Technological University, 2012. (Discusses methodologies for identifying the origin of an infection based on spread patterns and timestamps).

Typosquatting is the act of registering domain names that are slight misspellings or

variations of legitimate, often popular, domain names. The goal is to capture traffic from

users who mistype the intended URL. The scenario – "Attackers purchased the domain

www. company.com" (intended as a variant of a legitimate "www.Company.com") –

directly aligns with this definition. This technique relies on user typographical errors to

lead them to a malicious site.

B. Brand Impersonation: While typosquatting is often a method used for brand

impersonation (i.e., making the malicious site look like the legitimate brand's site), the

question specifically describes the act of acquiring the deceptive domain name.

Typosquatting is the more precise term for this specific action, whereas brand

impersonation is a broader outcome or goal.

C. On-path: An on-path attack (formerly man-in-the-middle) involves an attacker

intercepting and potentially altering communications between two parties. It does not

primarily involve the purchase of misleading domain names.

D. Watering-hole: A watering-hole attack involves compromising a legitimate

website that is frequently visited by the intended targets. This is different from

registering a new, similarly named domain to lure victims.

Typosquatting:

NIST Computer Security Resource Center - Glossary: "Typosquatting: A form of

cybersquatting that relies on mistakes such as typographical errors made by Internet

users when inputting a website address into a web browser. (Also known as URL

hijacking.)"

URL: https://csrc.nist.gov/glossary/term/typosquatting

Cybersecurity and Infrastructure Security Agency (CISA): "Typosquatting, also called

URL hijacking, is a common type of cybersquatting that targets users who incorrectly

type a URL into their web browser. Attackers register domains with names that are

common misspellings of legitimate, frequently accessed domains."

URL: https://www.cisa.gov/news-events/news/understanding-typosquatting (Page:

Understanding Typosquatting)

Brand Impersonation (as a broader concept distinct from the specific act):

While not a direct definition of the act of domain purchase, Microsoft describes related

impersonation tactics: "Impersonation is when attackers try to make a message look like

it came from a trusted company or person." Typosquatted domains are often used in

such impersonation attempts.

Source: Microsoft Learn - "Anti-phishing policies in Microsoft 365" (Section on

impersonation settings)

URL: https://learn.microsoft.com/en-us/microsoft-365/security/office-365security/anti-phishing-policies-about?view=o365-worldwide

On-path Attack:

NIST Computer Security Resource Center - Glossary: "On-Path Attack: An attack

where an adversary positions himself between the user and the system so that he can

intercept and alter data. (Formerly known as man-in-the-middle attack.)"

URL: https://csrc.nist.gov/glossary/term/on_path_attack

Watering-hole Attack:

NIST Computer Security Resource Center - Glossary: "Watering Hole Attack: A

specialized type of spear phishing attack where the attacker identifies a group of

targets, determines a website that they frequent, and then compromises that website to

install malware. When a target in the group visits the compromised website, they

become infected."

URL: https://csrc.nist.gov/glossary/term/watering_hole_attack

Full Disk Encryption (FDE) is a cryptographic solution specifically designed to protect

data at rest. It works by encrypting the entire contents of a storage drive, including the

operating system, application files, and user data. This ensures that if the physical

storage device is lost or stolen, the data remains unreadable to unauthorized individuals

who do not possess the decryption key. FDE provides a comprehensive layer of

confidentiality for all data stored on the encrypted medium.

A. Digital signatures: These primarily provide data integrity, authenticity, and non-

repudiation. They verify that data has not been altered and originates from the

claimed sender, but they do not encrypt the entire dataset to protect its confidentiality

at rest.

C. Private key: A private key is a component of asymmetric cryptographic systems

used for decryption or creating digital signatures. While essential for accessing

encrypted data (which might be at rest), the key itself is not the overall "solution" that

protects the bulk of data at rest; rather, it's a tool used within such solutions. Full Disk

Encryption is a more precise and complete solution.

D. Steganography: This technique focuses on concealing the existence of data within

other data, aiming for obscurity rather than providing cryptographic protection

(confidentiality through encryption) for data at rest.

Full Disk Encryption & Data at Rest:

National Institute of Standards and Technology (NIST). (2018). NIST Special Publication

800-111: Guide to Storage Encryption Technologies for End User Devices. Section 2.1

"Data-at-Rest", Section 3.1 "Full Disk Encryption".

URL: https://csrc.nist.gov/publications/detail/sp/800-111/final

Specific: Section 2.1 defines Data-at-Rest (DAR) and mentions encryption as a

protection strategy. Section 3.1 defines FDE as encrypting the entire hard drive.

Digital Signatures:

National Institute of Standards and Technology (NIST). (2001). NIST Special Publication

800-32: Introduction to Public Key Technology and the Federal PKI Infrastructure.

Section 2.1.3 "Digital Signature".

URL: https://csrc.nist.gov/publications/detail/sp/800-32/archive/2001-11-26

Specific: Section 2.1.3 describes the purpose of digital signatures as providing data

integrity and non-repudiation.

Private Key:

National Institute of Standards and Technology (NIST). (2020). NIST Special

Publication 800-57 Part 1 Revision 5: Recommendation for Key Management: Part 1 –

General. Section 5.1 "Overview of Asymmetric Cryptographic Key Pairs".

URL: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final

Specific: Section 5.1 describes private keys as secret components of key pairs in

asymmetric cryptography.

Steganography:

National Institute of Standards and Technology (NIST). (2021). NIST Internal Report

(NISTIR) 7298 Revision 3: Glossary of Key Information Security Terms. Page 177.

URL: https://csrc.nist.gov/publications/detail/nistir/7298/rev-3/final

Specific: Page 177 defines steganography as "The art or science of concealing a

message, file, or information within another message, file, or information."

Memory injection techniques, such as buffer overflows or heap overflows, can be used

to compromise systems running a Real-Time Operating System (RTOS). RTOS are

often written in languages like C/C++ which are susceptible to memory corruption

vulnerabilities. Exploiting these vulnerabilities can allow an attacker to execute arbitrary

code, thereby compromising the system. Due to their deterministic nature and often

direct hardware control, memory-related attacks are a significant threat to the integrity

and availability of RTOS-based systems.

A. Cross-site scripting (XSS): XSS is a vulnerability typically found in web

applications. While an RTOS could host a web server susceptible to XSS, XSS itself

doesn't directly compromise the RTOS core. It targets users of the web application.

C. Replay attack: A replay attack involves capturing and retransmitting valid data.

While it can disrupt operations or trick systems that use vulnerable protocols, it doesn't

inherently compromise the underlying RTOS in terms of gaining control over its

execution.

D. Ransomware: Ransomware is a type of malicious software that denies access to

a system or its data until a ransom is paid. While an RTOS-based system could be a

target for ransomware, ransomware is the payload, not the primary method of initial

system compromise at the OS level. The compromise would occur via another vector

first.

1. Memory Injection (specifically Buffer Overflows):

o Humayed, A., Lin, J., Klide, F., & Lothspeich, T. (2017). Cybersecurity for a specific

class of cyber-physical systems. IEEE Internet of Things Journal, 4(5), 1566-1575.

(Discusses buffer overflows as a key vulnerability in embedded systems, many of

which run RTOS).

DOI: https://doi.org/10.1109/JIOT.2017.2705217 (Section III.A discusses common

vulnerabilities including buffer overflows)

o National Institute of Standards and Technology (NIST). (2021). Systems Security

Engineering: Considerations for a Multidisciplinary Approach in the Engineering of

Trustworthy Secure Systems (NIST SP 800-160 Vol. 1).

URL: https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/final

Relevant Section: While not RTOS-specific for this point, it broadly discusses system

vulnerabilities. Memory corruption (which includes injection) is a fundamental software

vulnerability class. Section 3.3.3.2 "System Weaknesses and Vulnerabilities" implicitly

covers such low-level issues. Many RTOS are susceptible due to C/C++ usage and

performance constraints.

o Noorman, J., Wouters, L., Vrijdaghs, T., Piessens, F., & Strackx, R. (2017). Sancus

2.0: A Low-Cost Security Architecture for IoT Devices. ACM Transactions on Privacy and

Security (TOPS), 20(3), 1-33. (Discusses memory protection mechanisms for

embedded systems, highlighting the threat of memory corruption attacks).

DOI: https://doi.org/10.1145/3092801 (Introduction and background sections often

describe the threat landscape for embedded systems, including memory attacks).

2. Cross-Site Scripting (XSS):

o OWASP Foundation. "Cross Site Scripting (XSS)".

URL: https://owasp.org/www-community/attacks/xss/

This resource clearly defines XSS as a web application vulnerability, distinct from direct

RTOS compromise.

3. Replay Attack:

o Internet Engineering Task Force (IETF). RFC 4949: Internet Security Glossary,

Version 2.

URL: https://datatracker.ietf.org/doc/html/rfc4949

Section: "replay attack" (Defines it as an attack on a security protocol).

4. Ransomware:

o National Institute of Standards and Technology (NIST). (2021). Data Integrity:

Identifying and Protecting Assets Against Ransomware and Other Destructive Events

(NIST Special Publication 1800-26).

URL: https://www.nccoe.nist.gov/sites/default/files/legacy/files/NIST.SP.1800-26.pdf

Section: 1.2 "The Ransomware Threat" (Describes ransomware as malware that

encrypts files or locks systems, not as the initial vector for OS compromise itself).

Hashing is a cryptographic process that generates a unique, fixed-size string of characters, known as a hash value or digest, from a given input file or data. A core property of a secure hash function is that any change to the input data—even a single bit—will result in a drastically different hash value. By calculating the hash of a file and comparing it to a previously stored, trusted hash value for that same file, one can definitively verify whether the file has been altered or corrupted. This process directly confirms the file's integrity.

A. Masking: This technique protects data confidentiality by replacing sensitive information with fictitious but realistic-looking data, primarily for use in non-production environments. It does not verify integrity.

B. Encryption: The primary purpose of encryption is to ensure confidentiality by rendering data unreadable without the proper key. It does not, by itself, guarantee that the data has not been altered.

D. Obfuscation: This is the practice of making code or data difficult for humans to understand. It is a method to protect intellectual property or hide logic, not to check for data integrity.

1. National Institute of Standards and Technology (NIST). (2020). Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms (NIST Special Publication 800-175B Revision 1).

Section 5.3

"Hash Functions

" states: "A primary use of hash functions is for the generation and verification of digital signatures... Another use is for the generation of a message authentication code (MAC)... Both of these uses provide data integrity."

2. Rivest

R. (2017). Lecture 5: Hash Functions. MIT OpenCourseWare

6.857 Computer and Network Security.

The lecture notes explicitly state that a key application of collision-resistant hash functions is for "Message integrity

" where one can "Compute h(M)

save h(M) securely. Later

can check if M is modified by recomputing h(M)."

3. Katz

J.

& Lindell

Y. (2020). Introduction to Modern Cryptography (3rd ed.). Chapman and Hall/CRC.

Chapter 5

Section 5.1

"Definitions

" describes how hash functions are used for verifying file integrity. The text explains that a server can post a hash of a file

and a user who downloads the file can compute the hash locally and compare it to the server's value to ensure the file was not modified during download.

Proper data sanitization is a process to irreversibly remove or destroy data stored on a

memory device (e.g., hard drives, SSDs) or in reusable media to make it

unrecoverable. Its primary goal is to protect the confidentiality of information.

Therefore, it directly prevents hackers or any unauthorized individuals from obtaining

residual data from used, discarded, or resold hard drives.

· B. Devices reaching end-of-life and losing support: Data sanitization is a

procedure often performed when devices reach end-of-life, but it doesn't prevent the

end-of-life status or loss of support itself. This is a matter of hardware lifecycle.

· C. Disclosure of sensitive data through incorrect classification: Incorrect data

classification can lead to improper handling and subsequent disclosure. While

sanitization is applied based on classification, sanitization itself doesn't prevent the act

of misclassification.

· D. Incorrect inventory data leading to a laptop shortage: This is an issue related to

asset management and inventory control, not directly addressed or prevented by data

sanitization processes.

1. National Institute of Standards and Technology (NIST) Special Publication 800-88

Rev. 1, "Guidelines for Media Sanitization."

o URL: https://doi.org/10.6028/NIST.SP.800-88r1

o Specifics: Section 2.3, "Purpose/Scope," states: "The purpose of this document is to

provide guidance for sanitizing electronic media." Section 1, "Introduction," discusses

that sanitization is performed to prevent data recovery. Table 1 outlines the relationship

between information confidentiality and sanitization. Specifically, page 7 (PDF page 14)

defines sanitization as "a process to render access to Target Data on the media

infeasible for a given level of effort." This directly supports option A.

2. IEEE 2883-2022 - IEEE Standard for Sanitizing Storage.

o URL: While the full standard typically requires purchase, summaries and abstracts

often reinforce the core purpose. A general search for the standard's purpose would

confirm its focus on rendering data unrecoverable. For instance, the abstract often

mentions preventing unauthorized access to data. (Example:

https://standards.ieee.org/ieee/2883/7028/ - abstract usually available)

o Specifics: The standard focuses on methods to ensure data is not recoverable from

storage devices, aligning with preventing hackers from accessing data on used drives.

3. Microsoft Azure Documentation - Data security and encryption best practices

(While a vendor, their security documentation is generally robust and aligned with

standards).

o URL: https://learn.microsoft.com/en-us/azure/security/fundamentals/data-security

(This is a general link, specific documentation on data destruction or media

sanitization would be more targeted). More specifically, documentation on "Data

destruction in Azure" or similar topics.

o Specifics: Microsoft's descriptions of data destruction and sanitization in their

services emphasize making data unrecoverable to protect against unauthorized access

when hardware is decommissioned, which directly supports preventing hackers from

obtaining data. For instance, see the section on "Data destruction" in their compliance

offerings.

(Note on options B, C, D): These options describe issues related to IT governance,

data governance, and asset management respectively, which are distinct from the

technical process and primary goal of data sanitization as defined by NIST and IEEE.