Free Security+ SY0-701 Practice Test

Risk management strategies define how an organization responds to identified risks. Purchasing cyber insurance is a classic example of risk transfer (also known as risk sharing). This strategy involves shifting the financial impact of a potential loss to a third party, in this case, the insurance company. The organization pays a premium, and in exchange, the insurer agrees to cover the costs associated with a cyber incident, such as data recovery, legal fees, and fines. The company does not eliminate or reduce the risk itself, but it transfers the financial consequences.

Accept is when an organization acknowledges a risk and decides to take no action, bearing any potential losses itself. Mitigate involves implementing controls (e.g., firewalls, training) to reduce the likelihood or impact of a risk, which is different from purchasing insurance. Avoid is the strategy of eliminating a risk by ceasing the activity that causes it (e.g., discontinuing an online service).

1. National Institute of Standards and Technology (NIST). (2018). Special Publication 800-37 Revision 2: Risk Management Framework for Information Systems and Organizations. Section 2.5

"Risk Response

" explicitly lists the four responses as "accept

avoid

mitigate

share/transfer" and notes that risk sharing involves shifting risk to other organizations.

2. Joint Task Force Transformation Initiative. (2014). NIST Special Publication 800-39: Managing Information Security Risk. Section 2.3

"Risk Response

" states

"Risk can be shared with other organizations (e.g.

through insurance)."

3. Stoneburner

G.

Goguen

A.

& Feringa

A. (2002). NIST Special Publication 800-30: Risk Management Guide for Information Technology Systems. Section 3.3

"Risk Mitigation

" describes risk transference as a key option

stating

"Transfer the risk by using other options to compensate for the loss

such as purchasing insurance."

A compensating control is an alternative measure used to mitigate risk when a primary security control is not feasible. In this scenario, the primary control would be to block the high-risk website, but the business need requires providing access. Therefore, a compensating control is needed to reduce the risk of this access. Enabling threat prevention features on the firewall, such as an Intrusion Prevention System (IPS), anti-malware scanning, or advanced URL filtering, actively inspects the traffic to and from the website and can block malicious payloads or connections, thereby compensating for the inherent risk of the allowed activity.

B. A SIEM is a detective control that logs and alerts on events; it does not actively prevent threats from the website.
C. Allowing traffic from any port would drastically increase risk and is the opposite of a security control.
D. Blocking the website is a preventative control, which contradicts the scenario's premise of providing user access.

1. National Institute of Standards and Technology (NIST). (2020). SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. Appendix D, "Glossary," defines a compensating control as "A security or privacy control for an information system that is employed in lieu of a recommended control...and provides an equivalent or comparable level of protection."

2. Carnegie Mellon University. (2018). The CERT Resilience Management Model. Version 1.2. Section A3.3, "Controls Management," discusses the use of alternative (compensating) controls when primary controls cannot be implemented.

3. ISACA. (2019). COBIT 2019 Framework: Governance and Management Objectives. The framework discusses the selection of controls to mitigate risk, where compensating controls are used to address control deficiencies.

The provided diagram represents a standard, secure 3-tier cloud architecture designed to host a customer-facing payment application. When designing networks that handle sensitive payment data, you must adhere to strict isolation protocols (such as PCI DSS) which mandate that application logic and databases cannot be directly accessible from the internet.

1. Subnet Configuration: The middle tier must be configured as a Private subnet. Application servers processing payment data must be isolated from direct internet ingress.
2. WAF (Edge/Top): The Web Application Firewall (WAF) acts as the first line of defense. Traffic from the Internet Gateway (IGW) hits the WAF to filter out malicious web payloads (e.g., SQL injection, XSS) before it ever touches the compute resources.
3. Instances (Public Subnet): These represent the Web/Presentation tier. They are deployed in the public subnet to serve frontend assets and terminate initial client connections.
4. Load Balancer (Central): Positioned between the Web tier and the Application tier, this internal load balancer distributes incoming traffic from the web instances evenly across the backend application servers.
5. Autoscaling Instances (Middle Subnet): These represent the Application/Logic tier. They are clustered to indicate an autoscaling group, ensuring the payment application can dynamically scale compute resources to handle variable processing loads securely within the private network boundary.
6. Database (Bottom Private Subnet): The Data tier is placed in the deepest, most isolated private subnet. It only accepts connections from the application tier, ensuring maximum protection for stored transaction records.

This is a simulation question where the user must select and place the correct control. Other controls like a standard network firewall or an IDS/IPS are less specific. A network firewall works at Layers 3/4 and cannot inspect application-layer content, while a WAF is specialized for the threats facing this specific application type.

PCI Security Standards Council: PCI DSS v4.0, Requirement 1.3: "Network access to and from the cardholder data environment is restricted" and explicitly prohibits direct access between the internet and any system component in the CDE.

Amazon Web Services (AWS) Architecture Center: Three-Tier Architecture Reference. Validates the structural placement of public web tiers, internal application load balancers, and isolated private database tiers within a VPC environment.

NIST Special Publication 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy, Section 4.1. Details the architectural necessity of placing Web Application Firewalls at the network edge to proxy and filter traffic directed at public-facing instances. (DOI: 10.6028/NIST.SP.800-41r1)

The greatest concern for a company regarding non-compliance with government regulations is the potential for sanctions. Sanctions are the penalties or disciplinary actions imposed by a regulatory body for failure to comply. These can include substantial financial fines, operational restrictions, or even criminal charges. While other items listed are related to compliance, sanctions represent the direct, negative consequence that organizations strive to avoid, making them the primary concern from a risk management perspective.

A. Right to be forgotten: This is a specific provision within a regulation (like GDPR), not the ultimate penalty for non-compliance with the regulation as a whole.
C. External compliance reporting: This is a required activity to demonstrate compliance, not a negative consequence of failing to comply.
D. Attestation: This is a formal process of affirming that controls are in place, which is part of a compliance audit, not a penalty.

1. General Data Protection Regulation (GDPR)

Article 83

"General conditions for imposing administrative fines." This article details the sanctions (fines) for non-compliance

which can be up to €20 million or 4% of the total worldwide annual turnover.

2. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53

Rev. 5). Section 2.4

"External Service Providers

" discusses how organizations are responsible for ensuring compliance and are liable for the consequences of non-compliance.

3. Fruhlinger

J. (2020). The GDPR: How to comply with the EU's data privacy law. CSO Online. This university-level resource explains that "The penalties for non-compliance are significant

" highlighting sanctions as the major concern.

Log analysis indicates that the primary outbreak occurred in the early morning of 4/18. Host 192.168.10.22 is the Origin because the firewall logs show it initiating the first anomalous outbound connection in this cluster (57.203.55.234 via port 443) at 02:31:02. Immediately after this connection, its endpoint protection was disabled directly by the malware (svch0st.exe), indicating a complete primary compromise.

Lateral movement and secondary payload downloads subsequently occurred across the network (e.g., SMB traffic from 10.10.9.18 at 02:31:36). Hosts 192.168.10.37, 192.168.10.41, and 10.10.9.18 are all Infected; their respective antivirus logs confirm the presence of the svch0st.exe file during their 4/18 scheduled scans (though with varying degrees of quarantine success). Host 10.10.9.12 is Clean, as its AV logs explicitly show "Files removed: 0" and "Files quarantined: 0" with no heuristic warnings during both the 4/17 and 4/18 scan cycles.

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61, Revision 2). National Institute of Standards and Technology. Section 3.2.4 (Analyzing Incident-Related Data) & Section 3.3 (Containment, Eradication, and Recovery). https://doi.org/10.6028/NIST.SP.800-61r2

Kent, K., & Souppaya, M. (2006). Guide to Computer Security Log Management (NIST Special Publication 800-92). National Institute of Standards and Technology. Section 3.1.2 (Understanding Log Data) & Section 4.2 (Log Analysis). https://doi.org/10.6028/NIST.SP.800-92

Typosquatting, also known as URL hijacking, is a form of cybersquatting that targets users who incorrectly type a URL into their web browser. In this scenario, the attacker registered a domain (wwww.company.com) that is a common typographical error for the legitimate domain (www.company.com). The intent is to divert traffic from the legitimate site to the attacker's malicious site, often for phishing, malware distribution, or ad revenue.

B. While typosquatting is a form of brand impersonation, "typosquatting" is the more precise and specific term for an attack based on a typographical error in a domain name.
C. An on-path attack involves intercepting and potentially altering communications between two parties; it does not involve registering a deceptive domain name to lure victims.
D. A watering-hole attack involves compromising a legitimate website that a targeted group of users is known to frequent, rather than creating a new, fake website based on a typo.

1. National Institute of Standards and Technology (NIST). (n.d.). Glossary: Typosquatting. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary/term/typosquatting. The definition provided by NIST directly matches the scenario described.

2. Moore, T., & Edelman, B. (2010). Measuring the Perpetrators and Funders of Typosquatting. In Proceedings of the 14th International Conference on Financial Cryptography and Data Security. This academic paper defines and analyzes typosquatting as targeting "Internet users who mistype the address of a popular website" (p. 1). https://doi.org/10.1007/978-3-642-14992-41

3. Cybersecurity and Infrastructure Security Agency (CISA). (2021). Phishing and Suspicious Emails. CISA.gov. While discussing phishing, CISA materials often cite typosquatting as a common lure technique used to direct users to malicious sites.

Data at rest refers to data that is stored on physical media, such as hard drives, solid-state drives, or backup tapes. Full disk encryption (FDE) is a cryptographic solution specifically designed to protect data at rest by encrypting the entire contents of a storage device. If the device is lost or stolen, the data remains unreadable without the correct decryption key, thereby ensuring its confidentiality. Technologies like BitLocker (Windows) and FileVault (macOS) are common implementations of FDE.

A. Digital signatures are used to provide integrity, authentication, and non-repudiation for data, not to encrypt and protect entire datasets at rest.
C. A private key is a component of an asymmetric cryptographic system; it is a tool used for decryption or signing, not a complete solution for protecting data at rest.
D. Steganography is the practice of concealing data within other non-secret files or messages; it provides obscurity, not cryptographic protection.

1. National Institute of Standards and Technology (NIST). (2016). Special Publication 800-175B Revision 1: Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms. Section 2.1

"Data States

" defines data-at-rest and lists disk/file encryption as a primary protection mechanism. https://doi.org/10.6028/NIST.SP.800-175Br1

2. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 5

"Cryptography in Practice

" discusses the application of encryption for stored data.

3. Carnegie Mellon University. (2019). Introduction to Information Security (IIS) Courseware. Module on Cryptography. Discusses the three states of data (in use

in transit

at rest) and the corresponding security controls.

Real-Time Operating Systems (RTOS) are often used in resource-constrained embedded systems and are frequently developed using languages like C/C++, which are susceptible to memory management errors. Memory injection attacks, such as buffer overflows or heap overflows, exploit these vulnerabilities. An attacker can inject malicious code into a process's memory space and execute it, leading to a full system compromise. This is a direct attack on the low-level operation of the RTOS.

Cross-site scripting is a web application vulnerability and does not directly compromise the underlying operating system itself. A replay attack is a network-level attack that retransmits valid data; it exploits protocol weaknesses, not OS memory vulnerabilities. Ransomware is a type of malicious payload, whereas memory injection is the technique or vector used to deliver such a payload.

1. Papp

D. (2017). Hardening RTOS-based embedded systems. In Proceedings of the 2017 Workshop on Cyber-Physical Systems Security and Privacy (pp. 83-88). ACM. https://doi.org/10.1145/3140241.3140253. The paper discusses memory protection as a key defense against attacks like code injection in RTOS environments.

2. Heelan

S. (2019). Security for Real-Time Operating Systems. In: Le

D.

Le

T. (eds) Security and Privacy in Cyber-Physical Systems. EAI/Springer Innovations in Communication and Computing. Springer

Cham. https://doi.org/10.1007/978-3-030-03225-72. Chapter discusses memory protection mechanisms needed to prevent memory corruption and injection attacks in RTOS.

3. Carnegie Mellon University

Software Engineering Institute. (2022). SEI CERT C Coding Standard. Rule MEM35-C

"Allocate sufficient memory for an object

" directly addresses preventing buffer overflows

a form of memory injection common in systems programmed in C

like many RTOSs.

Hashing is a cryptographic function that generates a unique, fixed-length string (a hash or digest) from a given input file or data set. If the file is altered in any way, even by a single bit, the resulting hash will be completely different. By comparing a pre-calculated, trusted hash of a file with a newly generated hash of the same file, one can definitively confirm whether the file's integrity has been maintained.

A. Masking obscures data to protect confidentiality by replacing sensitive information with non-sensitive placeholders, but it does not verify integrity.
B. Encryption transforms data into an unreadable format to ensure confidentiality. While some modes provide integrity, its primary purpose is not integrity verification.
D. Obfuscation makes data or code difficult for humans to understand. It is a security-through-obscurity technique and does not provide a mathematical guarantee of integrity.

1. National Institute of Standards and Technology (NIST). (2015). Secure Hash Standard (SHS) (FIPS PUB 180-4). Section 1, "A hash algorithm is used to detect whether or not data has been modified (i.e., to determine the integrity of the data)."

2. Katz, J., & Lindell, Y. (2014). Introduction to Modern Cryptography (2nd ed.). CRC Press. Chapter 5, "Hash Functions and Applications," details the use of hash functions for integrity verification.

3. MIT OpenCourseWare. (6.857 Network and Computer Security, Spring 2014). Lecture notes on "Hashing" describe its fundamental properties, including collision resistance and its primary use case for data integrity checks.

Data sanitization is the process of deliberately, permanently, and irreversibly removing or destroying the data stored on a memory device. The primary purpose is to ensure that data cannot be recovered or reconstructed after the device is retired, sold, or repurposed. Proper sanitization techniques, such as cryptographic erasure, overwriting (clearing/purging), or physical destruction, prevent unauthorized individuals, including hackers, from retrieving sensitive information from discarded or used hard drives and other storage media.

B. Data sanitization is a process applied to devices at their end-of-life; it does not prevent the device from reaching that state or losing support.
C. Data classification is a prerequisite for determining the required level of sanitization, but sanitization itself does not prevent the initial act of misclassification.
D. This is an asset management or inventory control issue and is unrelated to the process of erasing data from storage media.

1. National Institute of Standards and Technology (NIST). (2014). Special Publication 800-88 Rev. 1: Guidelines for Media Sanitization. Section 2.3, "Sanitization," p. 8. "Sanitization is the process to render access to target data on the media infeasible for a given level of effort." The document's purpose is to prevent data remanence and subsequent unauthorized disclosure.

2. Kissell, K. V. (2017). Introduction to Information Security. Courseware, Johns Hopkins University Whiting School of Engineering. Module on "Data Security," discusses data sanitization as a key control for protecting data on media that is being disposed of.

3. Garfinkel, S. L., & Shelat, A. (2003). Remembrance of Data Passed: A Study of Disk Sanitization Practices. IEEE Security & Privacy, 1(1), 17-27. This foundational paper demonstrates the high risk of data recovery from used hard drives and establishes the need for effective sanitization. DOI: https://doi.org/10.1109/MSECP.2003.1176992