How many questions are on the SecurityX (CASP+) exam and how long is it?

The CAS-005 exam has a maximum of 90 questions — a mix of multiple-choice and performance-based (hands-on simulation) questions — with a 165-minute time limit.

What score do I need to pass SecurityX (CASP+)?

The CAS-005 exam is scored pass/fail only, with no scaled or numeric score reported. CompTIA simply tells you whether you passed. Because there is no scaled score, there is no published numeric cut score to aim for.

What experience do I need before taking SecurityX (CASP+)?

There are no formal prerequisites, but CompTIA recommends a minimum of ten years of general IT experience, including at least five years of hands-on security experience. It also suggests holding or having the equivalent knowledge of Network+, Security+, CySA+, Cloud+, and PenTest+. It is a master-level certification, so deep real-world experience is strongly recommended.

How much does the SecurityX (CASP+) exam cost and how do I register?

The published exam voucher price is approximately 509 USD, though pricing and discounts vary, so verify the current cost with CompTIA. You register through CompTIA or its testing partner Pearson VUE and can test at a center or online with proctoring. Unexpired CASP+ (CAS-004) vouchers can be used for the SecurityX (CAS-005) exam.

How long is SecurityX (CASP+) valid and how do I renew it?

The SecurityX (CASP+) certification is valid for three years from the date you pass. You can renew it through CompTIA's continuing education (CEU) program by earning the required continuing education units, which keeps the credential active without re-taking the exam.

What is the difference between SecurityX (CASP+) and CISSP?

Both are advanced security credentials, but SecurityX (CASP+) is vendor-neutral and more hands-on and technical, including performance-based questions that test practical engineering and architecture skills. CISSP, offered by ISC2, is more management- and governance-focused and requires five years of paid work experience to become fully certified. Many senior practitioners pursue both.

Which of the following best describes a Zero Trust security model in network architecture?

Verifying the trust of all devices, both inside and outside the network, before granting access

Trusting all internal network devices by default

Implementing a perimeter-based security approach

Placing complete trust in external networks

In the context of security architecture, what is the primary purpose of a Data Loss Prevention (DLP) system?

To monitor and protect sensitive data from unauthorized access or exfiltration

To enhance network speed and efficiency

To provide redundancy in data storage

Which technology is most effective for isolating and securing a sensitive application in an enterprise environment?

Intrusion Detection System (IDS)

What is a primary security benefit of using network segmentation in an organizational infrastructure?

Limiting the scope of potential attacks

Reduced complexity of network management

Increased data storage capacity

Enhancing the speed of data transmission

In secure system architecture, what is the main function of a demilitarized zone (DMZ)?

To act as a buffer zone between the internal network and untrusted external networks

To provide a secure area for data backups

To encrypt data passing through the network

What is the primary purpose of implementing an Intrusion Prevention System (IPS) in network security architecture?

To actively block and prevent identified threats

To provide redundancy in data storage

To increase network data transmission speed

Which cryptographic protocol is best suited for securing communication between web servers and browsers?

Secure/Multipurpose Internet Mail Extensions (S/MIME)

What is the main security advantage of implementing a hardware security module (HSM) in an organization?

It offers a secure environment for cryptographic operations

It increases storage capacity for sensitive data

In the context of secure architecture, what is the primary function of a Web Application Firewall (WAF)?

To filter, monitor, and block HTTP traffic to and from a web application

To increase web server processing power

To provide a redundant system for web servers

In security architecture, what is the primary purpose of implementing a Secure Socket Tunneling Protocol (SSTP)?

To create a secure connection over a non-secure network like the Internet

What is the primary security benefit of using a Virtual Private Network (VPN) in an enterprise?

Encrypting data transmission over unsecured networks

Increasing the speed of network connections

Providing additional storage space for data

Managing user access to network resources

In a security architecture context, what is the role of a Security Information and Event Management (SIEM) system?

To aggregate, analyze, and report on security data and events

To provide physical security to data centers

In enterprise security, what is the main function of a Network Access Control (NAC) system?

To control access to network resources based on compliance with security policies

To enhance the speed of data transfer

To provide a backup solution for data

To encrypt all data passing through the network

In Security Architecture, what is the primary purpose of implementing a Secure Sockets Layer (SSL) termination proxy?

To intercept and decrypt SSL traffic for inspection before re-encrypting and sending it to the server

To distribute network traffic evenly across several servers

To increase the SSL encryption strength

To serve as a backup for SSL certificates

What is the primary security concern when implementing a Security Information and Event Management (SIEM) system?

Protection of log information and analysis

The physical security of SIEM servers

Integration with existing network infrastructure

Ensuring high availability of the SIEM system

In the context of Security Architecture, what is the primary function of a WAF (Web Application Firewall)?

To filter and monitor HTTP/HTTPS traffic to and from a web application

To serve as an endpoint protection platform

What is the main security advantage of using virtualization in an enterprise environment?

Isolation of different operating system environments

Reduced need for physical security

In Security Architecture, what is the primary purpose of a Data Loss Prevention (DLP) system?

To detect and prevent the unauthorized transmission of sensitive information

To prevent unauthorized network access

To ensure high availability of data

What is the primary benefit of implementing an Intrusion Prevention System (IPS) in a network?

To proactively detect and prevent malicious activities

In the context of enterprise security, what is the primary purpose of implementing a Network Access Control NAC system?

To enforce security policy compliance on devices attempting to access network resources

To manage software installations on network devices

To monitor real-time network traffic

To encrypt data transmissions on the network

In Security Architecture, which of the following best describes Attribute-Based Access Control ABAC?

Access control based on the attributes of users, resources, and environmental conditions

Access control based solely on user roles within an organization

Access control based on a user's rank in the organizational hierarchy

Access control based on predefined security groups

What is the main purpose of implementing a Honeypot in a network security infrastructure?

To attract and analyze potential threats and attacks

To serve as the primary defense against cyber-attacks

To provide redundancy for network components

In the context of Security Architecture, what is the primary function of a Secure Shell (SSH) protocol?

To provide a secure channel for remote login and command execution

To manage network devices remotely

What is the main purpose of a DeMilitarized Zone (DMZ) in network security?

To provide a buffer zone between the public internet and an internal network

To isolate internal network segments

To monitor network traffic for anomalies

What is the primary purpose of Security Information and Event Management (SIEM) in an enterprise environment?

Real-time analysis of security alerts

Which of the following best describes a honeypot in network security?

A decoy system designed to lure and analyze attackers

A tool that prevents access to malicious websites

A software that detects and blocks malware

A protocol for secure communication over a network

In the context of digital forensics, what is the primary purpose of chain of custody?

To document the handling of evidence

To maintain data integrity during transit

To ensure the physical security of data

To provide a backup of the evidence

What is the primary goal of a Data Loss Prevention (DLP) system in an organization?

To monitor and control data usage

To provide redundant data storage

To increase data processing speed

In cybersecurity, what is the main function of a Security Operations Center SOC?

Coordinating security incident response

What is the primary purpose of employing a Red Team in cybersecurity operations?

To conduct realistic adversarial attacks for testing defenses

To manage the organization's firewalls

To develop and update security policies

To provide cybersecurity training to employees

Which of the following is a primary concern when deploying Security Information and Event Management (SIEM) systems in a large organization?

Scalability and data ingestion rates

Integration with physical security systems

Which of the following best describes the role of a Purple Team in cybersecurity operations?

Integrating and optimizing Red and Blue Team activities

Conducting external security audits

Managing organizational security policies

Overseeing regulatory compliance

In the context of digital forensics, what is the significance of the "first responder"?

The first person to collect and preserve digital evidence

The individual responsible for data recovery

The first person to detect a security incident

The individual in charge of communicating with law enforcement

What is the primary purpose of a File Integrity Monitoring (FIM) system in an organization's security infrastructure?

To detect changes to critical system files

To prevent unauthorized data exfiltration

To monitor network bandwidth usage

In a security operations context, what is the primary function of User and Entity Behavior Analytics UEBA?

Detecting anomalies in user and entity behavior

Monitoring and managing user access rights

Conducting background checks on new users

Your FREE CompTIA SecurityX (CASP+) Practice Test 2026 – 190+ Q&A

Q: What are the four SecurityX (CASP+) domains?

The CAS-005 exam covers four domains: Security Engineering (31%), Security Architecture (27%), Security Operations (22%), and Governance, Risk, and Compliance (20%). These weights come from CompTIA's official CAS-005 exam objectives.

Realistic CompTIA SecurityX (CASP+) CAS-005 practice questions across all four official exam domains, with instant scoring and answer explanations.

Master questions to boost your scoreMaster questions to raise your exam readiness score

How ready are you?

SecurityX (CASP+) Practice Questions

Which of the following best describes a Zero Trust security model in network architecture?
- Trusting all internal network devices by default
- Implementing a perimeter-based security approach
- Verifying the trust of all devices, both inside and outside the network, before granting access
- Placing complete trust in external networks
Correct answer: Verifying the trust of all devices, both inside and outside the network, before granting access
Correct answer: C. Explanation: The Zero Trust model operates on the principle of "never trust, always verify." It mandates verifying the trust of all devices and users, regardless of their location (inside or outside the network), before granting access to resources.
In the context of security architecture, what is the primary purpose of a Data Loss Prevention (DLP) system?
- To enhance network speed and efficiency
- To monitor and protect sensitive data from unauthorized access or exfiltration
- To provide redundancy in data storage
- To encrypt data in transit
Correct answer: To monitor and protect sensitive data from unauthorized access or exfiltration
Correct answer: B. Explanation: A Data Loss Prevention (DLP) system is primarily designed to monitor and protect sensitive data. It helps prevent unauthorized access and exfiltration (leakage) of critical information.
Which technology is most effective for isolating and securing a sensitive application in an enterprise environment?
- VLAN
- Firewall
- Virtualization
- Intrusion Detection System (IDS)
Correct answer: Virtualization
Correct answer: C. Explanation: Virtualization is most effective for isolating and securing a sensitive application. It allows the application to run in a separate, controlled environment (such as a virtual machine), reducing the risk of system-wide compromise.
What is a primary security benefit of using network segmentation in an organizational infrastructure?
- Reduced complexity of network management
- Increased data storage capacity
- Limiting the scope of potential attacks
- Enhancing the speed of data transmission
Correct answer: Limiting the scope of potential attacks
Correct answer: C. Explanation: Network segmentation's primary security benefit is limiting the scope of potential attacks. By dividing the network into smaller segments, it restricts an attacker's movement and access, thereby containing breaches within a limited area.
In secure system architecture, what is the main function of a demilitarized zone (DMZ)?
- To provide a secure area for data backups
- To act as a buffer zone between the internal network and untrusted external networks
- To encrypt data passing through the network
- To increase network bandwidth
Correct answer: To act as a buffer zone between the internal network and untrusted external networks
Correct answer: B. Explanation: In network architecture, a DMZ is used as a buffer zone between the protected internal network and untrusted external networks (like the internet). It typically contains externally facing services, providing an additional layer of security.
What is the primary purpose of implementing an Intrusion Prevention System (IPS) in network security architecture?
- To analyze network traffic
- To provide redundancy in data storage
- To actively block and prevent identified threats
- To increase network data transmission speed
Correct answer: To actively block and prevent identified threats
Correct answer: C. Explanation: An Intrusion Prevention System (IPS) is designed to actively analyze and block potential threats in real-time. Unlike an Intrusion Detection System (IDS), which only detects and alerts, an IPS can take action to prevent the threat.
Which cryptographic protocol is best suited for securing communication between web servers and browsers?
- Secure Shell (SSH)
- Transport Layer Security (TLS)
- Wired Equivalent Privacy (WEP)
- Secure/Multipurpose Internet Mail Extensions (S/MIME)
Correct answer: Transport Layer Security (TLS)
Correct answer: B. Explanation: Transport Layer Security (TLS) is the standard cryptographic protocol used to secure communications between web servers and browsers. It ensures data privacy and integrity between client-server applications.
What is the main security advantage of implementing a hardware security module (HSM) in an organization?
- It acts as a physical firewall
- It offers a secure environment for cryptographic operations
- It enhances network bandwidth
- It increases storage capacity for sensitive data
Correct answer: It offers a secure environment for cryptographic operations
Correct answer: B. Explanation: A hardware security module (HSM) provides a secure environment for cryptographic operations such as key generation, encryption, and decryption. It is designed to be tamper-resistant, offering enhanced security for handling sensitive data.
In the context of secure architecture, what is the primary function of a Web Application Firewall (WAF)?
- To increase web server processing power
- To filter, monitor, and block HTTP traffic to and from a web application
- To provide a redundant system for web servers
- To encrypt website data
Correct answer: To filter, monitor, and block HTTP traffic to and from a web application
Correct answer: B. Explanation: A Web Application Firewall (WAF) is specifically designed to filter, monitor, and block HTTP traffic to and from web applications. It helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet.
Which type of security control is an air-gapped computer network?
- Technical control
- Administrative control
- Physical control
- Compensating control
Correct answer: Physical control
Correct answer: C. Explanation: An air-gapped computer network is a physical control. It involves physically isolating a network from other unsecured networks, such as the Internet, to prevent unauthorized access and data breaches.
In security architecture, what is the primary purpose of implementing a Secure Socket Tunneling Protocol (SSTP)?
- To create a secure connection over a non-secure network like the Internet
- To encrypt emails
- To provide a firewall
- To enhance database security
Correct answer: To create a secure connection over a non-secure network like the Internet
Correct answer: A. Explanation: Secure Socket Tunneling Protocol (SSTP) is primarily used for creating a secure Virtual Private Network (VPN) connection over a non-secure network like the Internet. It encapsulates traffic in SSL/TLS and allows secure transmission of data.
What is the primary security benefit of using a Virtual Private Network (VPN) in an enterprise?
- Increasing the speed of network connections
- Providing additional storage space for data
- Encrypting data transmission over unsecured networks
- Managing user access to network resources
Correct answer: Encrypting data transmission over unsecured networks
Correct answer: C. Explanation: The primary security benefit of a VPN in an enterprise is to encrypt data transmission over unsecured networks. VPNs create a secure tunnel for data transmission, ensuring confidentiality and integrity of data even over public networks.
In a security architecture context, what is the role of a Security Information and Event Management (SIEM) system?
- To manage network bandwidth
- To encrypt data storage
- To provide physical security to data centers
- To aggregate, analyze, and report on security data and events
Correct answer: To aggregate, analyze, and report on security data and events
Correct answer: D. Explanation: A Security Information and Event Management (SIEM) system aggregates, analyzes, and reports on security data and events from various sources. It is used for real-time analysis of security alerts and for longer-term security data analytics.
In enterprise security, what is the main function of a Network Access Control (NAC) system?
- To enhance the speed of data transfer
- To provide a backup solution for data
- To control access to network resources based on compliance with security policies
- To encrypt all data passing through the network
Correct answer: To control access to network resources based on compliance with security policies
Correct answer: C. Explanation: Network Access Control (NAC.) systems control access to network resources by ensuring that all devices and users comply with defined security policies. NAC assesses and enforces policy compliance before allowing access to the network.
Which of the following best describes a Zero Trust security model in the context of Security Architecture?
- Trusting all users within the organization
- Trusting no one, regardless of their location relative to the network perimeter
- Trusting users based on their organizational role
- Trusting users within a network perimeter, but not external users
Correct answer: Trusting no one, regardless of their location relative to the network perimeter
Correct answer: B. Explanation: Zero Trust is a security concept centered on the belief that organizations should not automatically trust anything inside or outside its perimeters and instead must verify anything and everything trying to connect to its systems before granting access.
In Security Architecture, what is the primary purpose of implementing a Secure Sockets Layer (SSL) termination proxy?
- To distribute network traffic evenly across several servers
- To intercept and decrypt SSL traffic for inspection before re-encrypting and sending it to the server
- To increase the SSL encryption strength
- To serve as a backup for SSL certificates
Correct answer: To intercept and decrypt SSL traffic for inspection before re-encrypting and sending it to the server
Correct answer: B. Explanation: An SSL termination proxy is used to intercept, decrypt, and inspect SSL-encrypted traffic. After inspection, it re-encrypts the traffic and sends it to the intended server. This allows for deep packet inspection and other security checks on encrypted traffic.
What is the primary security concern when implementing a Security Information and Event Management (SIEM) system?
- The physical security of SIEM servers
- Integration with existing network infrastructure
- Protection of log information and analysis
- Ensuring high availability of the SIEM system
Correct answer: Protection of log information and analysis
Correct answer: C. Explanation: When implementing a SIEM system, the primary security concern is the protection of log information and analysis. SIEM systems store and process a vast amount of sensitive log data, which must be secured against unauthorized access and tampering.
Which architecture design principle is most effective in preventing single points of failure in a network?
- Defense in depth
- Network segmentation
- Redundancy
- Least privilege
Correct answer: Redundancy
Correct answer: C. Explanation: Redundancy is the architecture design principle that involves having multiple backup components in place to ensure system functionality in case of failure of any single component. This is key in preventing single points of failure in a network.
In the context of Security Architecture, what is the primary function of a WAF (Web Application Firewall)?
- To monitor network traffic
- To filter and monitor HTTP/HTTPS traffic to and from a web application
- To encrypt web traffic
- To serve as an endpoint protection platform
Correct answer: To filter and monitor HTTP/HTTPS traffic to and from a web application
Correct answer: B. Explanation: A Web Application Firewall (WAF) is primarily used to filter, monitor, and block HTTP/HTTPS traffic to and from a web application. It helps protect web applications by filtering and monitoring HTTP requests between a web application and the Internet.
Which protocol is primarily used for secure file transfer over a network in a Unix-like environment?
- FTP
- SFTP
- SNMP
- SMTP
Correct answer: SFTP
Correct answer: B. Explanation: SFTP (SSH File Transfer Protocol) is the protocol primarily used for secure file transfer over a network in Unix-like environments. It provides file access, file transfer, and file management functionalities over any reliable data stream and is typically used as part of SSH (Secure Shell).
What is the main security advantage of using virtualization in an enterprise environment?
- Reduced need for physical security
- Isolation of different operating system environments
- Decreased network traffic
- Simplified software updates
Correct answer: Isolation of different operating system environments
Correct answer: B. Explanation: The main security advantage of using virtualization in an enterprise environment is the isolation of different operating system environments. This isolation allows for running multiple virtual machines independently, reducing the risk of one VM's compromise affecting others.
In Security Architecture, what is the primary purpose of a Data Loss Prevention (DLP) system?
- To prevent unauthorized network access
- To detect and prevent the unauthorized transmission of sensitive information
- To ensure high availability of data
- To manage user access rights
Correct answer: To detect and prevent the unauthorized transmission of sensitive information
Correct answer: B. Explanation: The primary purpose of a Data Loss Prevention (DLP) system is to detect and prevent the unauthorized transmission or exfiltration of sensitive information. It helps in protecting sensitive data from being sent outside the corporate network without authorization.
What is the primary benefit of implementing an Intrusion Prevention System (IPS) in a network?
- To encrypt data traffic
- To proactively detect and prevent malicious activities
- To provide a backup for data
- To manage network bandwidth
Correct answer: To proactively detect and prevent malicious activities
Correct answer: B. Explanation: The primary benefit of an Intrusion Prevention System (IPS) is to proactively detect and prevent malicious activities within a network. Unlike an Intrusion Detection System (IDS), an IPS can actively block or prevent the detected threat.
In the context of enterprise security, what is the primary purpose of implementing a Network Access Control NAC system?
- To manage software installations on network devices
- To monitor real-time network traffic
- To enforce security policy compliance on devices attempting to access network resources
- To encrypt data transmissions on the network
Correct answer: To enforce security policy compliance on devices attempting to access network resources
Correct answer: C. Explanation: The primary purpose of a Network Access Control NAC system in an enterprise is to enforce security policy compliance on devices attempting to access network resources. NAC systems determine whether the devices meet the required security posture before allowing them network access.
Which cryptographic algorithm is primarily used for secure key exchange over an unsecured medium in a network?
- AES
- RSA
- SHA-256
- Diffie-Hellman
Correct answer: Diffie-Hellman
Correct answer: D. Explanation: The Diffie-Hellman algorithm is primarily used for secure key exchange over an unsecured medium in a network. It allows two parties to establish a shared secret over an unsecured communications channel, which is then used for encrypting further communications.
In Security Architecture, which of the following best describes Attribute-Based Access Control ABAC?
- Access control based on the attributes of users, resources, and environmental conditions
- Access control based solely on user roles within an organization
- Access control based on a user's rank in the organizational hierarchy
- Access control based on predefined security groups
Correct answer: Access control based on the attributes of users, resources, and environmental conditions
Correct answer: A. Explanation: Attribute-Based Access Control ABAC is an access control paradigm where access rights are granted to users based on the attributes of users, resources, and environmental conditions. It offers fine-grained access control that can adapt to complex environments.
What is the main purpose of implementing a Honeypot in a network security infrastructure?
- To serve as the primary defense against cyber-attacks
- To attract and analyze potential threats and attacks
- To encrypt sensitive data
- To provide redundancy for network components
Correct answer: To attract and analyze potential threats and attacks
Correct answer: B. Explanation: The main purpose of a Honeypot in network security is to act as a decoy, attracting and analyzing potential threats and attacks. Honeypots are designed to mimic systems that an attacker would want to break into but are isolated and monitored closely to study the attack patterns.
In the context of Security Architecture, what is the primary function of a Secure Shell (SSH) protocol?
- To filter HTTP traffic
- To manage network devices remotely
- To provide a secure channel for remote login and command execution
- To monitor network traffic
Correct answer: To provide a secure channel for remote login and command execution
Correct answer: C. Explanation: The primary function of the Secure Shell (SSH) protocol is to provide a secure channel over an unsecured network for remote login and command execution. SSH is widely used for secure remote access to computers and network devices.
In an enterprise security architecture, which technology is primarily used for separating sensitive network segments from one another?
- VLAN
- WAF
- NAC
- IPS
Correct answer: VLAN
Correct answer: A. Explanation: VLAN (Virtual Local Area Network) technology is primarily used in enterprise security architectures to separate sensitive network segments. This isolation enhances security by restricting access to and from different parts of the network based on business needs and security policies.
What is the main purpose of a DeMilitarized Zone (DMZ) in network security?
- To isolate internal network segments
- To provide a buffer zone between the public internet and an internal network
- To encrypt data in transit
- To monitor network traffic for anomalies
Correct answer: To provide a buffer zone between the public internet and an internal network
Correct answer: B. Explanation: A DMZ in network security is used to provide a buffer zone between the public internet and an organization's internal network. It contains public-facing services that need to be accessible from the internet, isolating them from the internal network for security purposes.
In a security operations context, which tool is primarily used for automated vulnerability scanning and assessment?
- SIEM
- IDS/IPS
- NAC
- Nessus
Correct answer: Nessus
Correct answer: D. Explanation: Nessus is a widely used tool for vulnerability scanning and assessment. It automates the process of scanning for vulnerabilities and provides comprehensive reports, making it a key tool in security operations for identifying and mitigating potential security risks.
What is the primary purpose of Security Information and Event Management (SIEM) in an enterprise environment?
- Patch management
- Real-time analysis of security alerts
- Physical access control
- User authentication
Correct answer: Real-time analysis of security alerts
Correct answer: B. Explanation: The primary purpose of SIEM is the real-time collection, analysis, and reporting of security alerts generated by applications and network hardware. It helps in the rapid detection, response, and mitigation of security incidents.
Which of the following best describes a honeypot in network security?
- A tool that prevents access to malicious websites
- A decoy system designed to lure and analyze attackers
- A software that detects and blocks malware
- A protocol for secure communication over a network
Correct answer: A decoy system designed to lure and analyze attackers
Correct answer: B. Explanation: A honeypot in network security is a system set up as a decoy to attract attackers. Its purpose is to be compromised to study attack methods and to distract attackers from more valuable machines on a network.
In the context of digital forensics, what is the primary purpose of chain of custody?
- To maintain data integrity during transit
- To ensure the physical security of data
- To document the handling of evidence
- To provide a backup of the evidence
Correct answer: To document the handling of evidence
Correct answer: C. Explanation: Chain of custody in digital forensics is crucial for documenting the handling and transfer of evidence from the time it is collected until it is presented in court. It ensures the integrity and credibility of the evidence.
What is the primary goal of a Data Loss Prevention (DLP) system in an organization?
- To monitor and control data usage
- To encrypt sensitive data
- To provide redundant data storage
- To increase data processing speed
Correct answer: To monitor and control data usage
Correct answer: A. Explanation: The primary goal of a DLP system is to monitor, control, and protect data usage within an organization. It helps prevent unauthorized access and sharing of sensitive information, mitigating the risk of data breaches.
In cybersecurity, what is the main function of a Security Operations Center SOC?
- Developing security policies
- Conducting security audits
- Coordinating security incident response
- Managing IT infrastructure
Correct answer: Coordinating security incident response
Correct answer: C. Explanation: The main function of a Security Operations Center SOC is to coordinate the monitoring and response to security incidents. It serves as a central unit that deals with security issues on an organizational and technical level.
Which technology is primarily used in Intrusion Prevention Systems (IPS) to detect and prevent attacks?
- Signature-based detection
- Token-based authentication
- Virtual Private Network (VPN)
- Data encryption
Correct answer: Signature-based detection
Correct answer: A. Explanation: Intrusion Prevention Systems (IPS) primarily use signature-based detection to identify and prevent attacks. This method involves comparing network traffic with a database of known threat signatures to detect malicious activities.
What is the primary purpose of employing a Red Team in cybersecurity operations?
- To manage the organization's firewalls
- To conduct realistic adversarial attacks for testing defenses
- To develop and update security policies
- To provide cybersecurity training to employees
Correct answer: To conduct realistic adversarial attacks for testing defenses
Correct answer: B. Explanation: The primary purpose of a Red Team in cybersecurity operations is to simulate realistic adversarial attacks against an organization's defenses. This helps in identifying vulnerabilities and testing the effectiveness of security measures.
Which of the following is a primary concern when deploying Security Information and Event Management (SIEM) systems in a large organization?
- Data redundancy
- Scalability and data ingestion rates
- User interface customization
- Integration with physical security systems
Correct answer: Scalability and data ingestion rates
Correct answer: B. Explanation: In large organizations, scalability and data ingestion rates are primary concerns when deploying SIEM systems. The SIEM must handle large volumes of data and scale accordingly to accommodate the growing amount of logs and security events.
Which of the following best describes the role of a Purple Team in cybersecurity operations?
- Conducting external security audits
- Managing organizational security policies
- Integrating and optimizing Red and Blue Team activities
- Overseeing regulatory compliance
Correct answer: Integrating and optimizing Red and Blue Team activities
Correct answer: C. Explanation: A Purple Team in cybersecurity operations focuses on integrating and optimizing the activities of both the Red Team (offensive) and Blue Team (defensive). Their goal is to ensure that the insights from both teams are effectively used to strengthen an organization's security posture.
In the context of digital forensics, what is the significance of the "first responder"?
- The individual responsible for data recovery
- The first person to detect a security incident
- The first person to collect and preserve digital evidence
- The individual in charge of communicating with law enforcement
Correct answer: The first person to collect and preserve digital evidence
Correct answer: C. Explanation: In digital forensics, the "first responder" is crucial as they are responsible for the initial collection and preservation of digital evidence. This role requires understanding how to properly handle and document evidence to maintain its integrity.
What is the primary purpose of a File Integrity Monitoring (FIM) system in an organization's security infrastructure?
- To prevent unauthorized data exfiltration
- To detect changes to critical system files
- To ensure data redundancy
- To monitor network bandwidth usage
Correct answer: To detect changes to critical system files
Correct answer: B. Explanation: The primary purpose of File Integrity Monitoring (FIM) is to detect and alert on unauthorized changes to critical system files and configurations. This is essential for identifying potential security breaches or policy violations.
In a security operations context, what is the primary function of User and Entity Behavior Analytics UEBA?
- Monitoring and managing user access rights
- Detecting anomalies in user and entity behavior
- Encrypting user data
- Conducting background checks on new users
Correct answer: Detecting anomalies in user and entity behavior
Correct answer: B. Explanation: User and Entity Behavior Analytics UEBA primarily focuses on detecting anomalous behavior patterns in users and entities within an organization's network. This helps in identifying potential security threats based on deviations from normal behavior patterns.
Which technology is typically employed in Intrusion Detection Systems (IDS) for pattern matching in network traffic?
- Deep packet inspection
- SSL/TLS decryption
- Quality of Service (QoS) analysis
- Bandwidth throttling
Correct answer: Deep packet inspection
Correct answer: A. Explanation: Deep packet inspection (DPI) is a technology used in Intrusion Detection Systems (IDS) for analyzing the content of network packets. DPI involves pattern matching to identify known attack signatures within the traffic, making it essential for detecting security threats.
In the context of security operations, what is the primary goal of implementing Security Orchestration, Automation, and Response (SOAR)?
- To manually respond to security incidents
- To automate routine security tasks and coordinate responses
- To encrypt sensitive data automatically
- To increase the physical security of data centers
Correct answer: To automate routine security tasks and coordinate responses
Correct answer: B. Explanation: Security Orchestration, Automation, and Response (SOAR) aims to automate routine security tasks and coordinate complex workflows in response to security incidents. This helps in streamlining operations and reducing response times.
What is the primary purpose of using sandboxing in cybersecurity?
- To provide a secure environment for data storage
- To isolate and analyze suspicious code or files
- To manage user access and authentication
- To increase network bandwidth efficiency
Correct answer: To isolate and analyze suspicious code or files
Correct answer: B. Explanation: Sandboxing in cybersecurity is used to isolate and analyze suspicious code or files in a controlled environment. This allows for safe examination of potential threats without risking the integrity of the main system.
Which of the following best describes the function of a Security Assertion Markup Language (SAML) in a federated identity management system?
- Encrypting data at rest
- Facilitating single sign-on (SSO) across different systems
- Managing network firewalls
- Conducting vulnerability assessments
Correct answer: Facilitating single sign-on (SSO) across different systems
Correct answer: B. Explanation: Security Assertion Markup Language (SAML) is primarily used in federated identity management systems to facilitate single sign-on (SSO). It allows users to use one set of login credentials to access multiple applications, simplifying authentication and authorization across different systems.
What is the primary benefit of using an Endpoint Detection and Response (EDR) solution in an organization's cybersecurity strategy?
- Reducing the need for user authentication
- Managing email servers
- Continuously monitoring and responding to endpoint threats
- Increasing network speed
Correct answer: Continuously monitoring and responding to endpoint threats
Correct answer: C. Explanation: The primary benefit of an Endpoint Detection and Response (EDR) solution is its ability to continuously monitor endpoints (like workstations, servers, mobile devices) and respond to cyber threats in real-time. This helps in early detection and rapid mitigation of threats at the endpoint level.
What is the primary function of a Security Information and Event Management (SIEM) system in a Security Operations Center SOC?
- Managing network configurations
- Real-time monitoring and analysis of security alerts
- Physical security management
- Data encryption and decryption
Correct answer: Real-time monitoring and analysis of security alerts
Correct answer: B. Explanation: The primary function of a SIEM system in a SOC is the real-time monitoring and analysis of security alerts generated by applications and network hardware. SIEM systems aggregate and correlate data from various sources, helping identify and respond to security incidents effectively.
In the context of Incident Response, what is the primary goal of the containment phase?
- Identifying the root cause of an incident
- Preventing further spread of an incident
- Collecting evidence for legal actions
- Restoring systems to normal operation
Correct answer: Preventing further spread of an incident
Correct answer: B. Explanation: The primary goal of the containment phase in Incident Response is to prevent the further spread of an incident. This involves isolating affected systems or networks to limit the impact and prevent additional damage or data loss.
Which of the following is a primary use case for deploying a Network Intrusion Detection System (NIDS)?
- Encrypting network traffic
- Managing network bandwidth
- Monitoring network traffic for suspicious activities
- Load balancing across servers
Correct answer: Monitoring network traffic for suspicious activities
Correct answer: C. Explanation: A Network Intrusion Detection System (NIDS) is primarily used for monitoring network traffic to detect suspicious activities or policy violations. It analyzes network traffic to identify potential security breaches or attacks.
What is the main purpose of employing threat intelligence in cybersecurity operations?
- To provide data backup solutions
- To assist in the proactive identification of emerging threats
- To manage user access controls
- To encrypt sensitive data transmissions
Correct answer: To assist in the proactive identification of emerging threats
Correct answer: B. Explanation: The main purpose of employing threat intelligence in cybersecurity operations is to proactively identify and understand emerging threats. This allows organizations to prepare and respond more effectively to potential security incidents.
In cybersecurity, what is the primary function of a Security Operations Center SOC?
- Developing security policies
- Conducting security audits
- Coordinating security incident response
- Managing IT infrastructure
Correct answer: Coordinating security incident response
Correct answer: C. Explanation: The primary function of a Security Operations Center SOC is to coordinate the monitoring and response to security incidents. It serves as the central point for detecting, analyzing, and responding to various cybersecurity incidents.
Which technology is primarily used in an Intrusion Prevention System (IPS) to prevent known threats?
- Signature-based detection
- Machine learning algorithms
- Token-based authentication
- Data loss prevention (DLP)
Correct answer: Signature-based detection
Correct answer: A. Explanation: Intrusion Prevention Systems (IPS) primarily use signature-based detection to identify and prevent known threats. This involves comparing network traffic with a database of known threat signatures to detect and block malicious activities.
In the context of digital forensics, what is the primary purpose of preserving the integrity of evidence?
- To ensure faster analysis
- To comply with data privacy laws
- To maintain its admissibility in legal proceedings
- To reduce storage requirements
Correct answer: To maintain its admissibility in legal proceedings
Correct answer: C. Explanation: The primary purpose of preserving the integrity of evidence in digital forensics is to maintain its admissibility in legal proceedings. This involves ensuring that the evidence has not been altered or tampered with from the time of collection to its presentation in court.
What is the primary role of an Endpoint Detection and Response (EDR) solution in cybersecurity?
- Managing network configurations
- Encrypting data in transit
- Continuously monitoring endpoints for threats
- Providing secure remote access
Correct answer: Continuously monitoring endpoints for threats
Correct answer: C. Explanation: The primary role of an Endpoint Detection and Response (EDR) solution is to continuously monitor endpoints, such as workstations and servers, for cybersecurity threats. EDR systems help in the early detection and response to security incidents at the endpoint level.
Which of the following is a primary security concern when implementing a Bring Your Own Device BYOD policy?
- Ensuring network bandwidth
- Managing device compatibility
- Securing data on personal devices
- Providing technical support for various devices
Correct answer: Securing data on personal devices
Correct answer: C. Explanation: A primary security concern with a Bring Your Own Device BYOD policy is securing data on personal devices. This involves implementing measures to protect sensitive information accessible or stored on employees' personal devices.
In the context of security operations, what is the primary function of User and Entity Behavior Analytics UEBA?
- Monitoring and managing user access rights
- Detecting anomalies in user and entity behavior
- Encrypting user data
- Conducting background checks on new users
Correct answer: Detecting anomalies in user and entity behavior
Correct answer: B. Explanation: User and Entity Behavior Analytics UEBA primarily focuses on detecting anomalous behavior patterns in users and entities within an organization's network. This helps in identifying potential security threats based on deviations from normal behavior patterns.
What is the primary purpose of conducting a security gap analysis in an organization?
- To identify differences between current and desired security states
- To increase employee awareness about security
- To comply with regulatory requirements
- To audit financial records for security expenditures
Correct answer: To identify differences between current and desired security states
Correct answer: A. Explanation: The primary purpose of conducting a security gap analysis is to identify the differences between the current state of security in an organization and the desired or required state. This helps in pinpointing areas that need improvement and developing strategies to address them.
In the context of cryptographic algorithms, which of the following is considered a symmetric key algorithm?
- RSA
- ECC
- AES
- PGP
Correct answer: AES
Correct answer: C. Explanation: AES (Advanced Encryption Standard) is a symmetric key algorithm, meaning it uses the same key for both encryption and decryption. This is in contrast to asymmetric algorithms like RSA, which use different keys for encryption and decryption.
Which cryptographic attack method involves decrypting a ciphertext by trying every possible key?
- Man-in-the-middle attack
- Brute force attack
- Cryptanalysis
- Side-channel attack
Correct answer: Brute force attack
Correct answer: B. Explanation: A brute force attack in cryptography involves trying every possible key until the correct one is found to decrypt the ciphertext. This method does not rely on any inherent weaknesses in the cryptographic algorithm but rather on the attacker's ability to try all possible keys.
What is the primary purpose of using a Public Key Infrastructure (PKI)?
- To manage network configurations
- To authenticate users on a network
- To manage the creation, distribution, and revocation of digital certificates
- To encrypt internet traffic
Correct answer: To manage the creation, distribution, and revocation of digital certificates
Correct answer: C. Explanation: Public Key Infrastructure (PKI) is primarily used for managing digital certificates. It establishes a level of trust by ensuring the secure electronic transfer of information for a range of network activities like e-commerce, internet banking, and confidential email.
In quantum cryptography, what is the main principle that ensures security?
- Heisenberg's Uncertainty Principle
- Shannon's theory of information
- Moore's law
- Kerckhoffs's principle
Correct answer: Heisenberg's Uncertainty Principle
Correct answer: A. Explanation: The security of quantum cryptography is largely based on the Heisenberg Uncertainty Principle. This principle states that certain pairs of physical properties, like position and momentum, cannot both be measured exactly at the same time, even in theory, which is used to ensure that any attempt to eavesdrop on quantum communications can be detected.
Which cryptographic concept ensures that a message has not been altered during transmission?
- Confidentiality
- Integrity
- Non-repudiation
- Authentication
Correct answer: Integrity
Correct answer: B. Explanation: Integrity in cryptography ensures that a message or data has not been altered or tampered with during transmission. Cryptographic techniques like hash functions are used to maintain integrity by providing a unique digital fingerprint of the data.
What is the main purpose of using a cryptographic hash function?
- To encrypt and decrypt data
- To verify the authenticity of data
- To generate a fixed-size string from input data
- To establish a secure communication channel
Correct answer: To generate a fixed-size string from input data
Correct answer: C. Explanation: A cryptographic hash function is used to generate a fixed-size string (hash) from input data of any size. The resulting hash is unique to the input data, and even a small change in the data will produce a significantly different hash.
In the field of cryptography, what is the primary purpose of using an Elliptic Curve Cryptography ECC algorithm?
- To ensure data integrity
- To facilitate secure key exchange
- To provide digital signatures
- To enhance encryption strength with shorter key lengths
Correct answer: To enhance encryption strength with shorter key lengths
Correct answer: D. Explanation: Elliptic Curve Cryptography ECC is used to enhance encryption strength while allowing for shorter key lengths. This results in faster computations, smaller key sizes, and lower bandwidth requirements, all while maintaining high security levels.
Which of the following is a characteristic of a symmetric encryption algorithm?
- It uses different keys for encryption and decryption.
- It is primarily used for creating digital signatures.
- It is based on the concept of public and private key pairs.
- It uses the same key for both encryption and decryption.
Correct answer: It uses the same key for both encryption and decryption.
Correct answer: D. Explanation: Symmetric encryption algorithms use the same key for encryption and decryption. This key needs to be shared and kept secret among the entities involved in the secure communication.
What is the primary advantage of implementing a Zero Trust network architecture?
- It simplifies network management.
- It eliminates the need for encryption.
- It minimizes the attack surface within the network.
- It reduces the need for regular software updates.
Correct answer: It minimizes the attack surface within the network.
Correct answer: C. Explanation: The primary advantage of a Zero Trust network architecture is that it minimizes the attack surface within the network. It operates on the principle of "never trust, always verify," meaning each request is authenticated, authorized, and encrypted before granting access.
In cryptography, what is the primary function of a Certificate Authority CA?
- To generate public and private keys
- To distribute digital certificates
- To validate user identities
- To issue and manage digital certificates
Correct answer: To issue and manage digital certificates
Correct answer: D. Explanation: A Certificate Authority CA is primarily responsible for issuing and managing digital certificates. These certificates validate the ownership of a public key by the named subject of the certificate, ensuring secure communication in a public network.
Which cryptographic attack involves attempting all possible key combinations until the correct one is found?
- Man-in-the-middle attack
- Brute-force attack
- Dictionary attack
- Replay attack
Correct answer: Brute-force attack
Correct answer: B. Explanation: A brute-force attack in cryptography involves trying every possible key combination until the correct key is found. This type of attack is time-consuming and often used as a last resort when other methods fail.
What is the primary purpose of using a Hardware Security Module (HSM) in a security infrastructure?
- To manage network configurations
- To enhance the physical security of servers
- To provide secure cryptographic key generation and storage
- To monitor and log security events
Correct answer: To provide secure cryptographic key generation and storage
Correct answer: C. Explanation: A Hardware Security Module (HSM) is used in security infrastructures to provide secure cryptographic key generation, storage, and management. It ensures that cryptographic keys are kept in a tamper-resistant hardware device, enhancing the overall security of key management processes.
In terms of security engineering, what is the main goal of implementing a Security Development Lifecycle (SDL)?
- To decrease software development time
- To enhance collaboration between development teams
- To integrate security practices into software development processes
- To reduce the cost of software development
Correct answer: To integrate security practices into software development processes
Correct answer: C. Explanation: The main goal of implementing a Security Development Lifecycle (SDL) is to integrate security practices and considerations into every phase of the software development process, from design to deployment, ensuring that security is a central focus throughout.
Which cryptographic protocol is designed to secure HTTP traffic on the Internet?
- SSH
- S/MIME
- TLS
- PGP
Correct answer: TLS
Correct answer: C. Explanation: Transport Layer Security (TLS) is the cryptographic protocol designed to secure HTTP traffic on the Internet, known as HTTPS. It provides confidentiality, data integrity, and authentication for secure web communications.
What is the main security advantage of using blockchain technology?
- It simplifies the encryption process.
- It offers a centralized database management system.
- It provides a high level of data transparency.
- It ensures data immutability and tamper resistance.
Correct answer: It ensures data immutability and tamper resistance.
Correct answer: D. Explanation: The main security advantage of blockchain technology is its ability to ensure data immutability and tamper resistance. Once data is recorded on a blockchain, it cannot be altered, which provides a high level of security and trust in the recorded transactions.
In security engineering, what is the primary purpose of an Intrusion Detection System (IDS)?
- To prevent unauthorized access to network resources
- To detect and alert on potential security threats and breaches
- To encrypt data transmissions
- To manage user access controls
Correct answer: To detect and alert on potential security threats and breaches
Correct answer: B. Explanation: The primary purpose of an Intrusion Detection System (IDS) is to monitor network or system activities for malicious activities or policy violations and produce reports or alerts for detected threats, aiding in the rapid response to potential security incidents.
Which technology is essential for securing virtualized environments in a cloud infrastructure?
- Network Address Translation (NAT)
- Virtual Private Network (VPN)
- Virtual Machine Escape Protection
- Software-Defined Networking (SDN)
Correct answer: Virtual Machine Escape Protection
Correct answer: C. Explanation: Virtual Machine Escape Protection is essential for securing virtualized environments in cloud infrastructure. It prevents a VM from breaking out and accessing the host machine or other VMs, which is a critical security concern in virtualized environments.
In the context of secure software engineering, what is "fuzzing" used for?
- Performance testing
- User interface design
- Security vulnerability testing
- Network optimization
Correct answer: Security vulnerability testing
Correct answer: C. Explanation: "Fuzzing" in secure software engineering is used for security vulnerability testing. It involves providing invalid, unexpected, or random data inputs to a computer program to find security vulnerabilities that can be exploited or cause crashes.
Which cryptographic concept involves splitting data into parts, each of which is less sensitive, and only when combined do they reveal sensitive information?
- Data obfuscation
- Cryptographic hashing
- Secret sharing
- Key escrow
Correct answer: Secret sharing
Correct answer: C. Explanation: Secret sharing refers to a method in cryptography where data is divided into parts, with each part being less sensitive on its own. The full sensitivity of the data is only revealed when a sufficient number of these parts are combined.
What is the primary purpose of employing Forward Secrecy in a cryptographic communication protocol?
- To ensure data integrity
- To prevent the reuse of encryption keys
- To allow for non-repudiation
- To protect past sessions against future key compromises
Correct answer: To protect past sessions against future key compromises
Correct answer: D. Explanation: Forward Secrecy is a feature of certain key agreement protocols that ensures a unique session key is generated for each session. The main purpose is to protect past sessions from being compromised if future long-term keys are compromised.
In the context of digital certificates, what does the term "certificate pinning" refer to?
- Associating a certificate with a specific IP address
- Hardcoding the certificate details in an application
- Regularly updating certificates
- Distributing certificates through a secure channel
Correct answer: Hardcoding the certificate details in an application
Correct answer: B. Explanation: Certificate pinning involves hardcoding the certificate information within an application. This practice ensures the application accepts only a specific certificate or certificates, reducing the risk of man-in-the-middle attacks.
What is the primary security benefit of using containerization in application deployment?
- Enhanced network speed
- Reduced memory usage
- Isolation of application environments
- Simplified user authentication
Correct answer: Isolation of application environments
Correct answer: C. Explanation: The primary security benefit of using containerization is the isolation it provides for application environments. Each container operates independently, reducing the risk of one application impacting or compromising others.
Which of the following best describes a rainbow table attack?
- A method of exploiting weak passwords through precomputed hashes
- An attack on wireless networks using a collection of pre-shared keys
- A technique for breaking encryption by trying every possible key
- An attack that uses large databases of common phrases to crack passwords
Correct answer: A method of exploiting weak passwords through precomputed hashes
Correct answer: A. Explanation: A rainbow table attack is a method of exploiting weak passwords by using precomputed tables of hash values for millions of passwords. It is an efficient way to crack passwords stored as cryptographic hashes.
In the context of secure communications, what is the primary function of the Diffie-Hellman algorithm?
- Digital signature creation
- Symmetric key encryption
- Secure key exchange
- Hashing of data
Correct answer: Secure key exchange
Correct answer: C. Explanation: The primary function of the Diffie-Hellman algorithm is to enable two parties to securely exchange cryptographic keys over an insecure channel. It is a cornerstone of modern cryptographic key exchange protocols.
What is the primary security concern associated with quantum computing and cryptography?
- Quantum computers can significantly reduce the effectiveness of current hashing algorithms.
- Quantum computers could potentially break many of the cryptographic algorithms currently in use.
- Quantum computing can interfere with electronic cryptographic devices.
- Quantum computing will make it difficult to generate random numbers for cryptographic keys.
Correct answer: Quantum computers could potentially break many of the cryptographic algorithms currently in use.
Correct answer: B. Explanation: The primary security concern with quantum computing is its potential ability to break many of the cryptographic algorithms currently in use, especially those based on factoring large numbers, like RSA, or solving discrete logarithm problems, which are hard problems for classical computers.
In Public Key Infrastructure (PKI), what role does the Registration Authority RA play?
- It issues digital certificates.
- It is responsible for the generation of public and private keys.
- It verifies the identity of entities requesting a certificate.
- It serves as the central repository for public keys.
Correct answer: It verifies the identity of entities requesting a certificate.
Correct answer: C. Explanation: In PKI, the Registration Authority RA is responsible for verifying the identity of entities before they are issued a digital certificate by the Certificate Authority CA. The RA acts as a verifier for the CA.
Which term describes the process of transforming plaintext into a non-readable form, known as ciphertext?
- Decryption
- Encoding
- Compression
- Encryption
Correct answer: Encryption
Correct answer: D. Explanation: Encryption is the process of converting plaintext into a non-readable form, called ciphertext. This process is used to protect the confidentiality of digital data stored on computer systems or transmitted via the internet or other computer networks.
What is the main security objective of implementing an air-gapped computer or network?
- To prevent physical access to the system
- To isolate the system from unsecured networks
- To protect the system from electromagnetic interference
- To ensure high availability of the network
Correct answer: To isolate the system from unsecured networks
Correct answer: B. Explanation: The main security objective of an air-gapped computer or network is to isolate it from unsecured networks and the internet. This physical isolation provides a high level of security against network-based attacks.
Which type of cryptographic algorithm is primarily used for ensuring the confidentiality of data in transit?
- Hashing algorithms
- Digital signature algorithms
- Key exchange algorithms
- Encryption algorithms
Correct answer: Encryption algorithms
Correct answer: D. Explanation: Encryption algorithms are used primarily for ensuring the confidentiality of data in transit. These algorithms encrypt the data, making it unreadable to anyone who does not have the appropriate key to decrypt it.
What is the primary objective of implementing an Information Security Management System (ISMS) in an organization?
- To ensure compliance with industry regulations
- To enhance the physical security of facilities
- To manage and minimize information security risks
- To increase the speed of IT processes
Correct answer: To manage and minimize information security risks
Correct answer: C. Explanation: The primary objective of implementing an ISMS is to manage and minimize information security risks. It provides a systematic approach to managing sensitive company information, ensuring it remains secure.
Which of the following is a key component of a Business Continuity Plan (BCP)?
- Data encryption standards
- Disaster Recovery Plan
- Password management policies
- Compliance auditing procedures
Correct answer: Disaster Recovery Plan
Correct answer: B. Explanation: A Disaster Recovery Plan (DRP) is a key component of a Business Continuity Plan (BCP). It focuses on restoring IT operations after a disaster, which is essential for maintaining business operations.
What does the term "Due Diligence" refer to in the context of information security governance?
- The technical measures implemented to protect data
- The investigation and evaluation of risks involved in a business arrangement
- The process of training employees on security policies
- The regular auditing of security systems
Correct answer: The investigation and evaluation of risks involved in a business arrangement
Correct answer: B. Explanation: Due diligence in information security governance refers to the investigation and evaluation of risks involved in a business arrangement or decision. It involves understanding the potential security risks and making informed decisions to mitigate them.
Which framework primarily focuses on improving the maturity of an organization's security processes?
- ISO/IEC 27001
- NIST Cybersecurity Framework
- COBIT
- Capability Maturity Model Integration (CMMI)
Correct answer: Capability Maturity Model Integration (CMMI)
Correct answer: D. Explanation: Capability Maturity Model Integration (CMMI) is a framework that focuses on improving the maturity of an organization's processes, including security processes. It provides guidelines for developing effective processes that are predictable and efficient.
What is the primary goal of implementing Security Controls based on the principle of "Least Privilege"?
- To enhance the efficiency of IT processes
- To minimize the potential damage from a security breach
- To comply with industry standards
- To reduce the cost of security implementations
Correct answer: To minimize the potential damage from a security breach
Correct answer: B. Explanation: The primary goal of implementing Security Controls based on the "Least Privilege" principle is to minimize the potential damage from a security breach. By ensuring that users have only the necessary access rights, the impact of a breach can be significantly reduced.
What is the primary focus of the General Data Protection Regulation (GDPR) in the context of data privacy?
- Protecting the privacy and personal data of EU citizens
- Securing corporate financial information
- Standardizing cybersecurity laws in the EU
- Regulating the export of digital technology
Correct answer: Protecting the privacy and personal data of EU citizens
Correct answer: A. Explanation: The primary focus of the GDPR is to protect the privacy and personal data of individuals within the European Union (EU). It sets stringent data protection requirements for companies that process personal data of EU citizens.
In information security, what is the primary purpose of a Gap Analysis?
- To identify the differences between current and desired performance
- To calculate the financial loss potential of a security breach
- To determine the effectiveness of the training program
- To assess the efficiency of the IT infrastructure
Correct answer: To identify the differences between current and desired performance
Correct answer: A. Explanation: A Gap Analysis in information security is used to identify the differences between the current state of security controls and processes and the desired or required state. It helps in determining the areas that need improvement to meet security objectives.
What is the primary purpose of employing Separation of Duties (SoD.) in an IT environment?
- To improve operational efficiency
- To reduce workload on employees
- To prevent conflicts of interest and fraud
- To speed up decision-making processes
Correct answer: To prevent conflicts of interest and fraud
Correct answer: C. Explanation: The primary purpose of employing Separation of Duties (SoD.) in an IT environment is to prevent conflicts of interest, fraud, and error. By ensuring that no single individual has control over all aspects of any critical process, SoD enhances security and accountability.
Which of the following best describes the role of a Data Protection Officer (DPO) in an organization?
- Managing the IT infrastructure
- Overseeing compliance with data protection laws and regulations
- Developing and implementing security policies
- Conducting regular security audits
Correct answer: Overseeing compliance with data protection laws and regulations
Correct answer: B. Explanation: The role of a Data Protection Officer (DPO) in an organization is primarily to oversee compliance with data protection laws and regulations, such as GDPR. The DPO ensures that the organization processes personal data in compliance with the applicable data protection rules.
In the context of IT governance, what is the main focus of the ITIL framework?
- Managing IT risks
- Delivering IT services effectively and efficiently
- Ensuring legal compliance
- Protecting data privacy
Correct answer: Delivering IT services effectively and efficiently
Correct answer: B. Explanation: The main focus of the ITIL (Information Technology Infrastructure Library) framework in IT governance is on delivering IT services effectively and efficiently. It provides best practices for IT service management, aiming to align IT services with the needs of the business.
What is the primary objective of conducting Third-Party Vendor Risk Assessments in an organization?
- To evaluate the performance of third-party vendors
- To ensure that vendors comply with security policies and standards
- To negotiate better contract terms
- To assess the market reputation of vendors
Correct answer: To ensure that vendors comply with security policies and standards
Correct answer: B. Explanation: The primary objective of conducting Third-Party Vendor Risk Assessments is to ensure that vendors comply with the organization's security policies and standards. This is crucial for mitigating risks that might arise from third parties having access to sensitive data or systems.
Which regulatory compliance standard is primarily focused on securing and protecting cardholder data?
- HIPAA
- GDPR
- PCI-DSS
- SOX
Correct answer: PCI-DSS
Correct answer: C. Explanation: The Payment Card Industry Data Security Standard (PCI-DSS) is focused on securing and protecting cardholder data. It provides a set of requirements for enhancing payment account data security.
What is the primary purpose of a Risk Appetite Statement in an organization's risk management process?
- To document the acceptable level of risk the organization is willing to take
- To record the identified risks in the organization
- To detail the insurance coverage of the organization
- To outline the responsibilities of the risk management team
Correct answer: To document the acceptable level of risk the organization is willing to take
Correct answer: A. Explanation: A Risk Appetite Statement is used to document the acceptable level of risk an organization is willing to take. It guides decision-making and risk management strategies by defining the boundaries for risk-taking.
In the context of IT governance, what does COBIT primarily focus on?
- Data privacy laws
- IT service management
- IT governance and management practices
- Network security protocols
Correct answer: IT governance and management practices
Correct answer: C. Explanation: COBIT (Control Objectives for Information and Related Technologies) primarily focuses on IT governance and management practices. It provides a comprehensive framework for managing and governing enterprise IT environments.
Which of the following best describes the purpose of an Information Security Policy within an organization?
- To detail technical specifications of security tools
- To outline the organization's information security objectives and measures
- To list the inventory of IT assets
- To document the IT department's organizational structure
Correct answer: To outline the organization's information security objectives and measures
Correct answer: B. Explanation: An Information Security Policy outlines the organization's objectives and measures for protecting information assets. It sets the standards, guidelines, and procedures for ensuring information security.
What is the primary focus of the Sarbanes-Oxley Act (SOX) in terms of compliance?
- Protecting healthcare information
- Ensuring the accuracy of corporate financial information
- Securing credit card transactions
- Protecting personal data of EU citizens
Correct answer: Ensuring the accuracy of corporate financial information
Correct answer: B. Explanation: The Sarbanes-Oxley Act (SOX) is focused on ensuring the accuracy and reliability of corporate financial reports. It includes requirements for financial record keeping and reporting to prevent corporate accounting fraud.
Which compliance framework is primarily concerned with the security and privacy of healthcare information?
- HIPAA
- FISMA
- GDPR
- PCI-DSS
Correct answer: HIPAA
Correct answer: A. Explanation: The Health Insurance Portability and Accountability Act HIPAA is focused on the security and privacy of healthcare information. It sets standards for the protection of sensitive patient data.
What is the primary purpose of conducting a Privacy Impact Assessment PIA?
- To evaluate the impact of new technologies on user privacy
- To measure the performance of IT systems
- To audit the financial transactions of the company
- To assess the effectiveness of security controls
Correct answer: To evaluate the impact of new technologies on user privacy
Correct answer: A. Explanation: A Privacy Impact Assessment (PIA.) is conducted to evaluate the impact of new projects, systems, technologies, or processes on individual privacy. It helps identify privacy risks and the measures needed to mitigate them.
In terms of IT compliance, what is the main focus of the Federal Information Security Management Act (FISMA.)?
- Regulating financial reporting
- Ensuring the security of federal information systems
- Protecting credit card information
- Safeguarding healthcare information
Correct answer: Ensuring the security of federal information systems
Correct answer: B. Explanation: The Federal Information Security Management Act (FISMA.) focuses on ensuring the security of federal information systems. It requires federal agencies to develop, document, and implement security programs to protect information and assets.
Which concept is primarily associated with ensuring that data is not altered or tampered with during transmission or storage?
- Availability
- Confidentiality
- Integrity
- Authentication
Correct answer: Integrity
Correct answer: C. Explanation: Integrity in information security is associated with ensuring that data is not altered or tampered with during transmission or storage. It guarantees the accuracy and reliability of data.
What is the main purpose of implementing an IT Audit in an organization?
- To recruit IT personnel
- To evaluate the effectiveness and compliance of IT systems and processes
- To upgrade IT equipment
- To train employees on new technologies
Correct answer: To evaluate the effectiveness and compliance of IT systems and processes
Correct answer: B. Explanation: The main purpose of an IT Audit is to evaluate the effectiveness, security, and compliance of IT systems and processes within an organization. It helps identify areas of improvement and ensures that IT practices align with business objectives and regulatory requirements.
In the context of information security, what is the primary goal of Security Classification of data?
- To categorize data based on its sensitivity and value to the organization
- To determine the storage requirements of data
- To calculate the cost of data maintenance
- To track the location of data within the organization
Correct answer: To categorize data based on its sensitivity and value to the organization
Correct answer: A. Explanation: The primary goal of Security Classification of data is to categorize data based on its level of sensitivity and value to the organization. This classification guides the implementation of appropriate security controls to protect the data accordingly.
What is the primary objective of a Security Posture Assessment in an organization?
- To determine the effectiveness and readiness of the organization's security measures
- To evaluate the financial impact of a potential security breach
- To check the compliance with data privacy laws
- To assess the physical security of the organization's premises
Correct answer: To determine the effectiveness and readiness of the organization's security measures
Correct answer: A. Explanation: A Security Posture Assessment aims to evaluate the effectiveness and readiness of an organization's security measures. It assesses the current security status and identifies areas for improvement to mitigate potential risks.
Which principle is most crucial in managing user access to sensitive data in an organization?
- Defense in depth
- Least privilege
- Segregation of duties
- Mandatory access control
Correct answer: Least privilege
Correct answer: B. Explanation: The principle of least privilege is crucial in managing user access to sensitive data. It ensures that users have only the minimum levels of access necessary to perform their job functions, reducing the risk of unauthorized access to sensitive data.
In the context of governance, what does the term "Compliance Burden" refer to?
- The cost of implementing security controls
- The effort and resources required to adhere to regulatory requirements
- The responsibility of the board of directors in cybersecurity
- The workload of the IT department in maintaining systems
Correct answer: The effort and resources required to adhere to regulatory requirements
Correct answer: B. Explanation: Compliance Burden refers to the effort, time, and resources required for an organization to adhere to relevant regulatory requirements. This includes understanding, implementing, and maintaining compliance with laws, standards, and regulations.
What is the primary purpose of "Data Sovereignty" concerns in cloud computing?
- To ensure data is stored in environmentally sustainable ways
- To maintain data residency within certain geographic boundaries
- To improve data retrieval speeds
- To enhance data encryption standards
Correct answer: To maintain data residency within certain geographic boundaries
Correct answer: B. Explanation: Data Sovereignty concerns in cloud computing revolve around ensuring that data is stored and processed within specific geographic boundaries, often due to legal requirements related to privacy and data protection.
In an IT governance framework, what is the primary goal of a Maturity Model?
- To assess the age of the organization's technology
- To evaluate the effectiveness of IT processes and practices
- To determine the lifespan of IT systems
- To calculate the return on investment for technology
Correct answer: To evaluate the effectiveness of IT processes and practices
Correct answer: B. Explanation: A Maturity Model in an IT governance framework aims to evaluate the effectiveness, efficiency, and sophistication of IT processes and practices within an organization. It helps in identifying areas of improvement and planning for process enhancements.
What is the main objective of implementing a Third-Party Risk Management (TPRM) program?
- To enhance collaboration with third-party vendors
- To ensure third-party vendors comply with the organization's security standards
- To reduce costs associated with outsourcing
- To streamline supply chain processes
Correct answer: To ensure third-party vendors comply with the organization's security standards
Correct answer: B. Explanation: The main objective of a Third-Party Risk Management program is to ensure that third-party vendors and partners comply with the organization's security standards and policies. This is crucial to mitigate risks associated with sharing data and resources with external entities.
Which of the following best describes the purpose of a Business Impact Analysis (BIA.) in risk management?
- To determine the potential financial impact of a business disruption
- To assess the overall profitability of the company
- To calculate the annual loss expectancy from cyber threats
- To evaluate the effectiveness of marketing strategies
Correct answer: To determine the potential financial impact of a business disruption
Correct answer: A. Explanation: A Business Impact Analysis (BIA.) in risk management is conducted to determine the potential financial and operational impact of disruptions to business processes. It is essential for creating effective business continuity and disaster recovery plans.
What is the primary purpose of the "Right to Audit" clause in vendor contracts within the context of cybersecurity?
- To ensure vendors provide competitive pricing
- To grant the organization the authority to audit the vendor's compliance with security requirements
- To assess the vendor's financial stability
- To evaluate the vendor's corporate governance practices
Correct answer: To grant the organization the authority to audit the vendor's compliance with security requirements
Correct answer: B. Explanation: The "Right to Audit" clause in vendor contracts allows the organization to audit and review the vendor's compliance with agreed-upon security standards and requirements. This ensures the vendor maintains appropriate security measures.
What does the term "Cybersecurity Framework" primarily refer to in an organizational context?
- A set of technologies used to protect against cyber threats
- A structured approach outlining standards, guidelines, and practices to manage cyber risks
- A team within the IT department focused on cybersecurity
- The architectural design of the network security infrastructure
Correct answer: A structured approach outlining standards, guidelines, and practices to manage cyber risks
Correct answer: B. Explanation: In an organizational context, a Cybersecurity Framework refers to a structured approach that includes standards, guidelines, and best practices to manage and reduce cybersecurity risks. It provides a comprehensive method for organizations to identify, protect, detect, respond, and recover from cyber incidents.
A financial services firm has too many administrators sharing a single root account, with no record of which person ran which command on critical servers. The security architect wants to enforce just-in-time elevation, session recording, and automatic password rotation for the root account. Which category of solution directly addresses these requirements?
- Data loss prevention (DLP)
- Security information and event management (SIEM)
- Privileged access management (PAM)
- Network access control (NAC)
Correct answer: Privileged access management (PAM)
The answer is privileged access management (PAM). PAM is the discipline and tooling that secures, controls, and monitors elevated accounts; it provides credential vaulting with automatic rotation, just-in-time access elevation, and full session recording so each administrator's actions are attributable. NAC enforces device posture before network access and does not manage administrator credentials or sessions, so it does not satisfy these requirements.
An enterprise is designing its identity strategy and wants a single framework that governs the full lifecycle of digital identities: provisioning accounts at hire, assigning entitlements, enforcing authentication, and deprovisioning at termination. Which discipline best describes this scope?
- Public key infrastructure (PKI)
- Mobile device management (MDM)
- Endpoint detection and response (EDR)
- Identity and access management (IAM)
Correct answer: Identity and access management (IAM)
The answer is identity and access management (IAM). IAM is the overarching framework of policies and technologies that ensures the right identities have the right access to the right resources across their lifecycle, covering provisioning, authentication, authorization, and deprovisioning. PKI manages certificates and keys but is only one component an IAM program may use, not the lifecycle framework itself.
A SaaS company needs users to log in once to a web portal and then access several partner applications without re-entering credentials, with the user's identity asserted between the identity provider and each service provider using signed XML documents. Which protocol is purpose-built for this enterprise SSO use case?
- Security Assertion Markup Language (SAML)
- Kerberos
- RADIUS
- Lightweight Directory Access Protocol (LDAP)
Correct answer: Security Assertion Markup Language (SAML)
The answer is SAML. SAML is an XML-based standard in which an identity provider issues signed assertions to service providers, making it the most widely deployed protocol for browser-based enterprise single sign-on across organizational boundaries. RADIUS handles network access AAA and does not pass XML SSO assertions between web service providers.
A developer must let a third-party mobile app pull a user's calendar data from an API without ever exposing the user's password to that app. The requirement is delegated authorization, not proving who the user is. Which protocol is designed specifically for this?
- WS-Federation
- 802.1X
- SAML 2.0
- OAuth 2.0
Correct answer: OAuth 2.0
The answer is OAuth 2.0. OAuth 2.0 is an authorization framework that issues scoped access tokens so a third-party application can act on a resource on the user's behalf without receiving the user's credentials. SAML is primarily an authentication and SSO protocol using XML assertions and is not the standard for delegated API authorization, which is the distinction tested in SAML-versus-OAuth questions.
A team already uses OAuth 2.0 to authorize API calls but realizes OAuth alone does not reliably tell the application WHO the authenticated user is. Which standard adds a verifiable identity layer on top of OAuth 2.0 by returning a signed ID token?
- SAML 2.0
- OpenID Connect (OIDC)
- TACACS+
- SCIM
Correct answer: OpenID Connect (OIDC)
The answer is OpenID Connect (OIDC). OIDC is an identity layer built on top of OAuth 2.0 that returns a signed JSON Web Token called an ID token, giving the application a trustworthy assertion of the user's identity. Plain OAuth 2.0 only handles authorization through access tokens and was never intended to convey authenticated identity, which is why OIDC exists.
An enterprise needs a dedicated, tamper-resistant network appliance to generate and store the private keys backing its certificate authority and to perform bulk cryptographic operations for thousands of application servers. Which device meets this requirement?
- Network-attached storage (NAS)
- Universal second factor (U2F) key
- Hardware security module (HSM)
- Trusted platform module (TPM)
Correct answer: Hardware security module (HSM)
The answer is hardware security module (HSM). An HSM is a tamper-resistant, often network-connected device built to generate, store, and use cryptographic keys at high volume and is the standard backing for enterprise CAs and key management. A TPM is a low-throughput chip soldered to a single motherboard for device-level integrity and is not designed to serve cryptographic operations across many servers.
A security engineer must explain why a TPM is not interchangeable with an HSM for a server-side key management service. Which statement most accurately captures the difference?
- A TPM stores keys in plaintext while an HSM never stores keys
- A TPM performs faster bulk cryptographic operations than an HSM
- An HSM is soldered to a single motherboard while a TPM is a removable network appliance
- A TPM is a device-bound chip for endpoint integrity and local keys, while an HSM is a high-throughput appliance built to serve cryptographic operations across many systems
Correct answer: A TPM is a device-bound chip for endpoint integrity and local keys, while an HSM is a high-throughput appliance built to serve cryptographic operations across many systems
The answer is that a TPM is a device-bound chip for endpoint integrity and local keys, while an HSM is a high-throughput appliance serving many systems. The TPM anchors a hardware root of trust on one machine for tasks like measured boot and disk-encryption key sealing, whereas the HSM is purpose-built for scalable, certified key management and high-volume cryptography. The other options reverse the roles or misstate that either device exposes keys in plaintext, which neither does.
During design of a mobile platform, an architect needs to isolate biometric matching and key operations in a separate, dedicated coprocessor with its own memory, distinct from the main application processor and from the device's TPM. Which component is being described?
- A hypervisor
- A baseband processor
- A trusted platform module used for measured boot
- A secure enclave
Correct answer: A secure enclave
The answer is a secure enclave. A secure enclave is an isolated coprocessor or protected execution environment with its own memory that runs sensitive code such as biometric matching and key handling separately from the main OS. While a TPM also provides hardware-backed security, it is a standardized chip focused on platform integrity and key sealing rather than an isolated execution environment for application-level sensitive code.
A regulator asks an enterprise to prove that every server boots only firmware and an operating system that have not been tampered with, anchored to an immutable, hardware-based starting point of trust. Which concept describes that immutable starting point?
- Hardware root of trust
- Security through obscurity
- A demilitarized zone
- Defense in depth
Correct answer: Hardware root of trust
The answer is hardware root of trust. A hardware root of trust is an immutable, tamper-resistant component, often implemented in a TPM or secure element, that anchors a verifiable chain so each boot stage can be measured and attested before the next loads. Defense in depth describes layering controls generally and does not provide the cryptographically anchored boot-integrity starting point the regulator requires.
An OEM is enabling measured boot so the platform can attest that firmware, bootloader, and OS kernel are unmodified, with each stage's hash recorded in platform configuration registers. Which standardized chip provides these registers and the attestation keys?
- Solid-state drive controller
- Hardware security module (HSM)
- Trusted platform module (TPM)
- Network interface card (NIC)
Correct answer: Trusted platform module (TPM)
The answer is trusted platform module (TPM). The TPM is a standardized chip that stores measurements in platform configuration registers (PCRs) and holds attestation keys, enabling measured boot and remote attestation that the platform's firmware and OS are unmodified. An HSM serves enterprise key operations across systems and does not provide per-device PCR-based boot measurement, which is the TPM's defining role.
A research team wants a cloud provider to run analytics on encrypted customer records and return an encrypted result, without the provider ever decrypting the data during processing. Which cryptographic technique enables computation directly on ciphertext?
- Homomorphic encryption
- Format-preserving encryption
- Symmetric key wrapping
- Steganography
Correct answer: Homomorphic encryption
The answer is homomorphic encryption. Homomorphic encryption allows mathematical operations to be performed directly on ciphertext so the decrypted output matches the result of operating on the plaintext, letting an untrusted party compute without ever seeing the data. Format-preserving encryption only keeps ciphertext in the same format as plaintext and does not permit computation on encrypted values.
A mobile banking app must reject any TLS connection where the presented server certificate is not the exact certificate the app expects, even if a trusted CA signed the substitute. The goal is to defeat man-in-the-middle attacks that rely on a fraudulently issued but validly chained certificate. Which technique enforces this?
- Subject alternative name matching
- Certificate pinning
- OCSP stapling
- Certificate transparency logging
Correct answer: Certificate pinning
The answer is certificate pinning. Certificate pinning hardcodes or embeds the expected certificate or public key in the application so it will only trust that specific certificate, blocking MITM attacks even when an attacker presents a rogue certificate signed by an otherwise trusted CA. OCSP stapling only checks revocation status and would still accept any validly chained certificate, so it does not prevent this attack.
An engineer wants the property that if an attacker later steals a TLS server's long-term private key, they still cannot decrypt traffic captured from earlier sessions. Which property provides this guarantee, and how is it achieved?
- Key escrow, achieved by storing keys with a trusted third party
- Non-repudiation, achieved by digital signatures
- Forward secrecy, achieved by negotiating ephemeral per-session keys via (EC)DHE
- Perfect compression, achieved by deduplicating session keys
Correct answer: Forward secrecy, achieved by negotiating ephemeral per-session keys via (EC)DHE
The answer is forward secrecy, achieved by negotiating ephemeral per-session keys via (EC)DHE. Forward secrecy uses ephemeral Diffie-Hellman so each session has a unique key that is discarded afterward; compromising the server's long-term key does not reveal the ephemeral keys from past sessions. Key escrow does the opposite by retaining recoverable keys, which would actually expose past traffic if the escrowed key is stolen.
A security architect is documenting controls for the same dataset in two states: encrypting database files on disk versus encrypting the network channel carrying that data to clients. Which pairing correctly maps the protections?
- Data at rest is protected by storage/disk encryption; data in transit is protected by TLS
- Both are protected only by TLS
- Data at rest is protected by TLS; data in transit is protected by disk encryption
- Both are protected only by disk encryption
Correct answer: Data at rest is protected by storage/disk encryption; data in transit is protected by TLS
The answer is that data at rest is protected by storage or disk encryption and data in transit is protected by TLS. Data at rest is stored data sitting on disks, databases, or backups and is safeguarded with full-disk or file/database encryption; data in transit is data moving across a network and is safeguarded with transport encryption such as TLS. Swapping these controls leaves each state of the data unprotected against its relevant threat.
A government contractor must begin migrating its key-exchange and digital-signature mechanisms to algorithms resistant to attacks by large-scale quantum computers. Which set of finalized NIST standards should anchor that migration?
- FIPS 140-2 and FIPS 140-3 validation levels
- FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA)
- FIPS 197 (AES) and FIPS 186 (DSA) only
- FIPS 199 and FIPS 200 categorization standards
Correct answer: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA)
The answer is FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). NIST finalized these three post-quantum standards in August 2024: ML-KEM for quantum-resistant key encapsulation and ML-DSA and SLH-DSA for quantum-resistant digital signatures. FIPS 140-2/140-3 are cryptographic module validation standards and do not specify quantum-resistant algorithms, so they do not anchor a PQC migration.
Why are widely deployed algorithms such as RSA and ECDH considered the primary targets driving post-quantum cryptography adoption?
- A sufficiently large quantum computer running Shor's algorithm could break the integer-factoring and discrete-logarithm problems these algorithms rely on
- Quantum computers can instantly reverse all cryptographic hash functions
- Quantum computers eliminate the need for any encryption
- These algorithms have no key length and therefore cannot be secured
Correct answer: A sufficiently large quantum computer running Shor's algorithm could break the integer-factoring and discrete-logarithm problems these algorithms rely on
The answer is that a sufficiently large quantum computer running Shor's algorithm could break the integer-factoring and discrete-logarithm problems RSA and ECDH depend on. Shor's algorithm efficiently solves exactly the hard math problems underpinning these asymmetric schemes, which is why NIST standardized lattice-based replacements like ML-KEM. Hash functions are weakened only quadratically by Grover's algorithm and are not instantly reversed, so the first option, not the second, states the real threat.
A development team stores user passwords and wants to deliberately slow down offline brute-force and rainbow-table attacks by making each password hash computationally expensive to derive. Which approach achieves this?
- Hashing each password once with SHA-256 and no salt
- Using a key stretching function such as PBKDF2, bcrypt, or Argon2 with a high work factor and per-user salt
- Encrypting passwords with AES and storing the key alongside them
- Encoding passwords with Base64 before storage
Correct answer: Using a key stretching function such as PBKDF2, bcrypt, or Argon2 with a high work factor and per-user salt
The answer is using a key stretching function such as PBKDF2, bcrypt, or Argon2 with a high work factor and per-user salt. Key stretching intentionally increases the cost of each hash computation and adds a unique salt, making large-scale brute-force and precomputed rainbow-table attacks impractical. A single unsalted SHA-256 is fast and salt-free, exactly the conditions that make rainbow-table attacks effective, so it is the wrong choice.
A mobile fleet team needs every corporate device to maintain a continuous encrypted tunnel to the enterprise gateway whenever it has connectivity, automatically reconnecting without user action so traffic is never sent in the clear. Which VPN configuration meets this?
- A clientless SSL portal VPN
- A split-tunnel VPN triggered only on demand
- A site-to-site IPsec tunnel between two data centers
- An always-on VPN
Correct answer: An always-on VPN
The answer is an always-on VPN. An always-on VPN automatically establishes and maintains the encrypted tunnel whenever the device is connected, removing the user's ability to send traffic outside the tunnel and ensuring continuous protection for mobile endpoints. A site-to-site tunnel connects fixed networks, not roaming endpoint devices, so it does not satisfy the mobile always-connected requirement.
An organization wants to embed security into software from the earliest stages rather than testing only at the end, including threat modeling during design, secure coding standards, and security testing within each phase. Which framework formalizes this approach?
- A secure software development lifecycle (SSDLC/SDL)
- ITIL service operation
- A bug bounty program
- Waterfall project management
Correct answer: A secure software development lifecycle (SSDLC/SDL)
The answer is a secure software development lifecycle (SSDLC/SDL). An SSDLC integrates security activities such as threat modeling, secure coding, code review, and security testing into every phase of development so vulnerabilities are prevented and caught early rather than after release. A bug bounty crowdsources finding flaws in already-shipped software and does not build security into the development process itself.
A security team is hardening a public REST API against malformed and malicious payloads. They want to enforce strict checks on each request's schema, data types, length, and allowed values before any business logic executes. Which practice are they implementing?
- API response caching
- API rate limiting
- API versioning
- API input validation
Correct answer: API input validation
The answer is API input validation. API security validation enforces that incoming requests conform to an expected schema, data types, length limits, and allowed value ranges before processing, mitigating injection, overflow, and malformed-input attacks. Rate limiting only throttles request frequency and does not inspect or constrain the contents of each request, so it does not address malformed payloads.
A team finds developers have stored an AWS root account access key inside a public source-code repository. From a security engineering standpoint, what is the most appropriate immediate and longer-term response?
- Add the key to a .gitignore file so it stops appearing in future commits
- Make the repository private and leave the key in place since it is now hidden
- Email the key to the security team so they can monitor its use
- Revoke and rotate the exposed key immediately, then move secrets into a managed vault and use short-lived role-based credentials
Correct answer: Revoke and rotate the exposed key immediately, then move secrets into a managed vault and use short-lived role-based credentials
The answer is to revoke and rotate the exposed key immediately, then move secrets into a managed vault and use short-lived role-based credentials. Once a credential is exposed publicly it must be considered compromised; revocation removes the attacker's access and a secrets vault with short-lived, role-based credentials prevents recurrence. Making the repo private does not help because the key may already be cloned or cached, so the secret remains compromised.
An architect must choose an authentication factor design for high-assurance access. They want a phishing-resistant method where the private key never leaves a hardware authenticator and authentication is cryptographically bound to the legitimate website's origin. Which approach best fits?
- A shared departmental password rotated monthly
- One-time passwords delivered by SMS
- Static knowledge-based security questions
- FIDO2/WebAuthn hardware security keys
Correct answer: FIDO2/WebAuthn hardware security keys
The answer is FIDO2/WebAuthn hardware security keys. FIDO2/WebAuthn uses public-key cryptography where the private key stays in the hardware authenticator and the credential is scoped to the site's origin, making it resistant to phishing and credential replay. SMS one-time passwords are vulnerable to SIM swapping and real-time phishing and are not bound to the site origin, so they provide weaker assurance.
A company encrypts large data volumes with AES for performance but must securely deliver the symmetric key to a remote partner over an untrusted link. Which hybrid approach is the standard way to protect the key in transit?
- Hash the AES key with SHA-256 and send the hash
- Send the AES key in plaintext but over a different TCP port
- Encrypt (wrap) the AES key with the partner's public key so only their private key can recover it
- Compress the AES key before transmitting it
Correct answer: Encrypt (wrap) the AES key with the partner's public key so only their private key can recover it
The answer is to wrap the AES symmetric key with the partner's public key so only their private key can recover it. This hybrid model combines fast symmetric bulk encryption with asymmetric key transport, ensuring the AES key is confidential in transit. Hashing the key only produces a one-way digest that cannot be reversed to recover the key, so it cannot be used to share it.
A security engineer must select a mode of operation for AES that provides both confidentiality and built-in integrity/authentication of the ciphertext in a single operation, commonly used in TLS 1.3. Which mode meets this?
- Output Feedback (OFB) mode without a MAC
- Cipher Block Chaining (CBC) mode without a MAC
- Galois/Counter Mode (GCM), an authenticated encryption (AEAD) mode
- Electronic Code Book (ECB) mode
Correct answer: Galois/Counter Mode (GCM), an authenticated encryption (AEAD) mode
The answer is Galois/Counter Mode (GCM), an authenticated encryption with associated data (AEAD) mode. GCM provides confidentiality and an authentication tag in one pass, detecting tampering, and is a standard cipher suite component in TLS 1.3. ECB encrypts identical plaintext blocks to identical ciphertext and provides neither strong confidentiality nor any integrity, making it the classic insecure choice.
An organization wants to limit the blast radius of a compromised certificate authority by ensuring that the long-lived private key of the root CA is used rarely and kept offline, while day-to-day certificate issuance is handled by subordinate CAs. Which PKI design achieves this?
- Self-signed certificates distributed to every endpoint
- A single online root CA that issues all end-entity certificates directly
- An offline root CA that signs intermediate (subordinate) CAs which perform issuance
- Disabling certificate revocation entirely
Correct answer: An offline root CA that signs intermediate (subordinate) CAs which perform issuance
The answer is an offline root CA that signs intermediate CAs which perform issuance. Keeping the root CA offline and delegating routine issuance to subordinate CAs protects the most trusted key; if an intermediate is compromised it can be revoked without rebuilding the entire trust chain. Having a single online root issue all certificates directly maximizes exposure of the most critical key, which is exactly what this design avoids.
A security architect must decide how to protect data while it is actively being processed in memory on a shared cloud host, beyond protecting it at rest and in transit. Which technology addresses data-in-use protection?
- Full-disk encryption on the host's local storage
- Confidential computing using a hardware-based trusted execution environment (TEE)
- TLS 1.3 between the client and the server
- A network firewall rule restricting inbound ports
Correct answer: Confidential computing using a hardware-based trusted execution environment (TEE)
The answer is confidential computing using a hardware-based trusted execution environment (TEE). A TEE isolates and encrypts data while it is being processed in memory, protecting the third state, data in use, even from a compromised host OS or hypervisor. Full-disk encryption only protects data at rest and TLS only protects data in transit, so neither covers data actively being computed on in memory.
A company deploying full-disk encryption on laptops wants the disk-encryption key to be released only if the boot firmware and OS loader have not been altered, binding key release to platform integrity measurements. Which mechanism provides this?
- Deriving the key solely from the user's four-digit PIN
- Embedding the key in the disk controller firmware
- Sealing the key to the TPM's platform configuration registers (PCRs)
- Storing the key in a plaintext file in the EFI partition
Correct answer: Sealing the key to the TPM's platform configuration registers (PCRs)
The answer is sealing the key to the TPM's platform configuration registers (PCRs). TPM sealing releases the disk-encryption key only when the measured boot values in the PCRs match the expected trusted state, so tampered firmware or bootloader prevents key release. Storing the key in a plaintext EFI file offers no protection because any attacker with the disk can simply read it, defeating the purpose of binding to integrity.
A penetration test report shows that an internal web service still negotiates TLS using static RSA key exchange and a deprecated cipher suite. The security engineer wants to remediate so that compromise of the server's private key cannot retroactively decrypt captured traffic, while moving to modern authenticated encryption. Which change set best accomplishes both goals?
- Require ephemeral elliptic-curve Diffie-Hellman (ECDHE) key exchange with AES-GCM cipher suites
- Enable TLS compression to reduce the size of the handshake
- Disable certificate validation to speed up the handshake
- Increase the RSA key length to 4096 bits but keep static RSA key exchange
Correct answer: Require ephemeral elliptic-curve Diffie-Hellman (ECDHE) key exchange with AES-GCM cipher suites
The answer is to require ephemeral ECDHE key exchange with AES-GCM cipher suites. ECDHE provides forward secrecy so a later private-key compromise cannot decrypt previously captured sessions, and AES-GCM is an authenticated encryption mode addressing the deprecated suite. Simply enlarging the RSA key keeps static RSA key exchange, which still lacks forward secrecy, so past traffic remains exposed if the key is later stolen.
A retail company with 200 branch locations wants to replace expensive MPLS circuits and intelligently route application traffic across broadband, LTE, and private links based on real-time link quality. Which technology directly addresses this requirement?
- Cloud access security broker (CASB)
- Software-defined wide area network (SD-WAN)
- Hardware security module (HSM)
- Network access control (NAC)
Correct answer: Software-defined wide area network (SD-WAN)
The correct answer is software-defined wide area network (SD-WAN). SD-WAN is a virtual WAN architecture that uses centrally managed policies to dynamically steer traffic across multiple transport types such as broadband, LTE, and MPLS based on link health and application priority, reducing reliance on costly dedicated circuits. A CASB enforces cloud application policy, an HSM protects cryptographic keys, and NAC controls device admission, so none of those provide WAN transport optimization.
An architect is designing a model that converges networking and security into a single cloud-delivered service for a workforce that is now mostly remote. The design must integrate SD-WAN with secure web gateway, CASB, firewall-as-a-service, and zero trust network access. Which framework is being described?
- Public key infrastructure (PKI)
- Demilitarized zone (DMZ)
- Network function virtualization (NFV)
- Secure access service edge (SASE)
Correct answer: Secure access service edge (SASE)
The correct answer is secure access service edge (SASE). SASE is a cloud-delivered framework that merges WAN networking (SD-WAN) with converged security services including SWG, CASB, FWaaS, and ZTNA, delivered from distributed points of presence rather than on-premises appliances. A DMZ is a perimeter network segment, PKI manages certificates, and NFV virtualizes individual network appliances, so none describe this converged networking-plus-security model.
A security architect must explain the core distinction between SD-WAN and SASE to leadership. Which statement is the most accurate?
- SD-WAN and SASE are identical terms used interchangeably by vendors
- SD-WAN provides optimized network transport, while SASE adds converged cloud-delivered security services on top of that networking foundation
- SD-WAN encrypts data at rest, while SASE encrypts data in transit
- SD-WAN is a security framework, while SASE is purely a routing protocol
Correct answer: SD-WAN provides optimized network transport, while SASE adds converged cloud-delivered security services on top of that networking foundation
The correct answer is that SD-WAN provides optimized network transport while SASE adds converged cloud-delivered security on top of it. SD-WAN is the networking layer that steers traffic across links; SASE combines that SD-WAN foundation with security services such as SWG, CASB, FWaaS, and ZTNA into one cloud-delivered model (SD-WAN plus SSE equals SASE). The other choices misstate their functions, since neither term is about data-at-rest encryption and the two are not interchangeable.
An enterprise wants to programmatically control network traffic flows from a centralized controller, separating the control plane from the data plane on its switches and routers. Which technology enables this capability?
- Spanning Tree Protocol (STP)
- Software-defined networking (SDN)
- Network address translation (NAT)
- Border Gateway Protocol (BGP)
Correct answer: Software-defined networking (SDN)
The correct answer is software-defined networking (SDN). SDN decouples the control plane (decision-making about where traffic goes) from the data plane (the forwarding hardware), allowing a centralized controller to program flows dynamically across the network. STP prevents switching loops, NAT translates addresses, and BGP exchanges routes between autonomous systems, none of which provide the centralized control-plane and data-plane separation that defines SDN.
A company adopting numerous SaaS applications needs a single enforcement point to apply data loss prevention, encryption, and malware policies to traffic between users and cloud services, and to discover shadow IT usage. Which solution best fits?
- Intrusion detection system (IDS)
- Cloud access security broker (CASB)
- Hardware security module (HSM)
- Virtual private network (VPN) concentrator
Correct answer: Cloud access security broker (CASB)
The correct answer is cloud access security broker (CASB). A CASB sits between users and cloud providers to enforce policies such as DLP, encryption, access control, and malware protection, and it provides visibility into unsanctioned shadow IT cloud usage. An IDS only detects threats, an HSM safeguards keys, and a VPN concentrator terminates tunnels, so none deliver cloud-application policy enforcement and discovery the way a CASB does.
During a design review, a stakeholder asks what a cloud access security broker actually is. Which description is correct?
- A protocol that establishes a shared symmetric key over an untrusted channel
- A device that performs deep cryptographic operations in tamper-resistant hardware
- A security policy enforcement point placed between cloud service consumers and providers to apply visibility, compliance, data security, and threat protection controls
- A tool that randomly fuzzes application inputs to find software defects
Correct answer: A security policy enforcement point placed between cloud service consumers and providers to apply visibility, compliance, data security, and threat protection controls
The correct answer is that a CASB is a security policy enforcement point between cloud consumers and providers delivering visibility, compliance, data security, and threat protection. CASBs broker access to cloud apps so the organization can extend on-premises policy into SaaS, IaaS, and PaaS. The other options describe a key-exchange protocol, an HSM, and a fuzzer respectively, which are unrelated functions.
An organization is replacing its always-on corporate VPN. It wants users to reach only the specific internal applications they are authorized for, with per-session identity and context checks, and no implicit network-level trust. Which model satisfies this?
- Zero trust network access (ZTNA)
- Port-based 802.1X authentication only
- Stateful packet filtering at the perimeter
- Site-to-site IPsec tunneling
Correct answer: Zero trust network access (ZTNA)
The correct answer is zero trust network access (ZTNA). ZTNA brokers access to individual applications based on verified identity and device context for each session, hiding the rest of the network and granting no broad network-level trust the way a traditional VPN does. Site-to-site IPsec connects whole networks, 802.1X handles port admission, and stateful filtering inspects perimeter traffic, none of which deliver application-level least-privilege access.
A CISO asks how zero trust architecture differs from a SASE deployment. Which statement is most accurate?
- Zero trust is a security strategy and set of principles, while SASE is a delivery architecture that can implement zero trust (via ZTNA) alongside networking
- Zero trust requires on-premises hardware, while SASE forbids any encryption
- SASE is a subset of zero trust that only handles certificate issuance
- Zero trust and SASE are competing technologies that cannot be used together
Correct answer: Zero trust is a security strategy and set of principles, while SASE is a delivery architecture that can implement zero trust (via ZTNA) alongside networking
The correct answer is that zero trust is a strategy and set of principles while SASE is a delivery architecture that can implement zero trust through ZTNA alongside its networking components. Zero trust defines the 'never trust, always verify' philosophy; SASE is a cloud-delivered framework that operationalizes much of it. The other options misrepresent both, since they are complementary and SASE is not merely certificate issuance.
A hospital network is divided into separate subnets for clinical devices, administrative workstations, and guest Wi-Fi, each isolated by firewall rules. What primary security objective does this network segmentation achieve?
- Guaranteeing encryption of all data at rest across the hospital
- Containing breaches and limiting lateral movement by restricting traffic between zones
- Eliminating the need for endpoint antivirus on clinical devices
- Removing the requirement for user authentication on the guest network
Correct answer: Containing breaches and limiting lateral movement by restricting traffic between zones
The correct answer is containing breaches and limiting lateral movement by restricting traffic between zones. Network segmentation divides a network into separate zones so that a compromise in one segment cannot freely spread to others, reducing the blast radius of an attack. Segmentation does not remove the need for endpoint protection or authentication, nor does it inherently encrypt data at rest, so those objectives are unrelated.
A data center team wants security policy enforced at the individual workload level, allowing them to define which specific east-west flows are permitted between VMs even within the same subnet. Which approach provides this granularity?
- A single flat VLAN for the data center
- Perimeter-only firewalling
- Microsegmentation
- Disabling all east-west traffic logging
Correct answer: Microsegmentation
The correct answer is microsegmentation. Microsegmentation applies fine-grained, policy-based controls down to individual workloads or VMs, governing east-west traffic even within the same subnet so that only explicitly allowed flows occur. A flat VLAN provides no isolation, perimeter-only firewalling ignores internal lateral movement, and disabling logging weakens visibility, so none provide workload-level enforcement.
An architect must explain how microsegmentation differs from traditional network segmentation. Which statement is correct?
- They are identical and both operate exclusively at OSI Layer 1
- Network segmentation operates at the workload level, while microsegmentation only works at the building perimeter
- Traditional segmentation isolates broad zones using subnets or VLANs, while microsegmentation enforces granular policy at the individual workload or application level
- Microsegmentation isolates entire physical sites, while network segmentation only protects single hosts
Correct answer: Traditional segmentation isolates broad zones using subnets or VLANs, while microsegmentation enforces granular policy at the individual workload or application level
The correct answer is that traditional segmentation isolates broad zones using subnets or VLANs while microsegmentation enforces granular policy at the individual workload or application level. Network segmentation creates large trust zones, whereas microsegmentation controls east-west traffic per workload, often via host-based or virtualization-layer policy. The remaining options reverse or invent definitions and are incorrect.
A team is deciding between a CASB and a secure web gateway for an upcoming control. Which statement best distinguishes the two?
- A SWG governs SaaS data security, while a CASB performs SSL inspection of all web browsing
- A CASB only blocks malicious URLs, while a SWG manages digital certificates
- A CASB governs access to and data within sanctioned and unsanctioned cloud applications, while a SWG filters and inspects outbound web traffic and enforces URL and content policies
- They perform identical functions and the terms are interchangeable
Correct answer: A CASB governs access to and data within sanctioned and unsanctioned cloud applications, while a SWG filters and inspects outbound web traffic and enforces URL and content policies
The correct answer is that a CASB governs access to and data within cloud applications while a SWG filters and inspects outbound web traffic and enforces URL and content policies. A CASB focuses on cloud app visibility, compliance, and data protection; a SWG focuses on safe web access through filtering, SSL inspection, and content analysis. The other options swap their roles or wrongly claim they are identical.
Under the cloud shared responsibility model, an organization deploys a workload on an Infrastructure as a Service (IaaS) platform. Which security task remains the customer's responsibility rather than the provider's?
- Protecting the provider's core network backbone hardware
- Maintaining physical security of the data center facility
- Securing the underlying hypervisor and virtualization layer
- Patching and hardening the guest operating system and securing the application
Correct answer: Patching and hardening the guest operating system and securing the application
The correct answer is patching and hardening the guest operating system and securing the application. In IaaS, the provider secures the physical facility, hardware, and virtualization layer, while the customer remains responsible for the guest OS, applications, data, and access configuration. The other options describe responsibilities the cloud provider retains in the IaaS model.
A development team must inventory every open-source and third-party component, including transitive dependencies, in a shipped application so vulnerabilities like a newly disclosed library flaw can be quickly traced. Which artifact provides this?
- A certificate revocation list (CRL)
- A software bill of materials (SBOM)
- A data flow diagram (DFD)
- A network topology diagram
Correct answer: A software bill of materials (SBOM)
The correct answer is a software bill of materials (SBOM). An SBOM is a formal, machine-readable inventory of all components and dependencies within a piece of software, enabling rapid identification of which products are affected when a component vulnerability is disclosed. A topology diagram maps networks, a DFD models data movement for threat modeling, and a CRL lists revoked certificates, so none provide a component inventory.
A vendor risk analyst asks for a plain explanation of an SBOM. Which description is accurate?
- A signed log of every user authentication event in an application
- A cryptographic hash used to verify a downloaded installer
- A document that defines a firm's acceptable use policy for employees
- A nested, machine-readable list of all software components, libraries, and dependencies in a product, used to manage supply chain and component vulnerabilities
Correct answer: A nested, machine-readable list of all software components, libraries, and dependencies in a product, used to manage supply chain and component vulnerabilities
The correct answer is that an SBOM is a nested, machine-readable list of all software components, libraries, and dependencies in a product used to manage supply chain and component vulnerabilities. It is the software analog of an ingredients list and supports software composition analysis. The other options describe an audit log, an acceptable use policy, and a file integrity hash, which are different artifacts.
Early in designing a new payment microservice, an architect uses data flow diagrams to enumerate how an attacker might spoof identities, tamper with data, or escalate privileges, then ranks each risk before code is written. What practice is being performed?
- Penetration testing
- Threat modeling
- Disaster recovery planning
- Configuration management
Correct answer: Threat modeling
The correct answer is threat modeling. Threat modeling is a structured, proactive process performed during design that identifies potential threats, attack vectors, and weaknesses, often using data flow diagrams and frameworks like STRIDE, so mitigations can be built in early. Penetration testing actively exploits a running system, disaster recovery addresses availability after an incident, and configuration management governs system state, so none describe this design-phase analysis.
A security architect adopts the STRIDE framework during threat modeling of a new service. STRIDE categorizes threats by which six elements?
- Sensitivity, Trust, Reliability, Identity, Defense, and Encryption
- Scope, Time, Resources, Integration, Dependencies, and Execution
- Severity, Threat, Risk, Impact, Detection, and Eradication
- Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege
Correct answer: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege
The correct answer is Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. STRIDE is a Microsoft-developed threat modeling mnemonic that maps each letter to a category of threat applied to elements of a data flow diagram. The other options are invented expansions that do not correspond to the STRIDE methodology.
An enterprise is deploying a large language model and a fraud-detection classifier. The security team is asked to brief leadership on AI-specific security threats. Which of the following is a recognized threat class unique to machine learning systems?
- Standard SQL injection against the login form
- Cross-site scripting in the web console only
- Buffer overflows in the operating system kernel
- Adversarial attacks such as data poisoning, evasion, and model inversion
Correct answer: Adversarial attacks such as data poisoning, evasion, and model inversion
The correct answer is adversarial attacks such as data poisoning, evasion, and model inversion. These threats specifically target the ML lifecycle: poisoning corrupts training data, evasion crafts inputs that fool a deployed model, and inversion reconstructs sensitive training data from model outputs. The other options are conventional application or OS vulnerabilities that are not unique to machine learning systems.
A fraud model begins approving fraudulent transactions after an attacker quietly contaminated the historical records used to retrain it. This is an example of which adversarial machine learning attack?
- Data poisoning
- Prompt injection of a chatbot
- Evasion at inference time
- Model inversion
Correct answer: Data poisoning
The correct answer is data poisoning. Data poisoning corrupts the training dataset so the resulting model learns attacker-chosen behavior, such as misclassifying fraud as legitimate. Model inversion reconstructs training data, evasion manipulates inputs at inference rather than altering training data, and prompt injection targets a deployed conversational model, so those do not match a tampered training set.
An architect must define adversarial machine learning for a design document. Which definition is correct?
- A process for automatically labeling unstructured training data
- A compliance framework for documenting AI model lineage
- A set of techniques that deliberately exploit weaknesses in machine learning systems, across training and inference, to cause misclassification, data leakage, or other harmful outcomes
- A method of encrypting model weights so they cannot be stolen
Correct answer: A set of techniques that deliberately exploit weaknesses in machine learning systems, across training and inference, to cause misclassification, data leakage, or other harmful outcomes
The correct answer is that adversarial machine learning is a set of techniques that deliberately exploit weaknesses in ML systems across training and inference to cause misclassification, data leakage, or other harmful outcomes. It encompasses evasion, poisoning, inversion, and extraction attacks. The other options describe model encryption, data labeling, and governance documentation, which are not adversarial ML.
In a mature zero trust architecture, a user who already authenticated this morning attempts to access a high-sensitivity finance application from a new, unmanaged device. According to zero trust principles, what should the architecture do?
- Deny all access permanently and lock the user account without review
- Grant access automatically because the user authenticated earlier in the day
- Permit access because the request originates from inside the corporate network
- Re-evaluate trust continuously using identity and device context and require step-up verification before granting access
Correct answer: Re-evaluate trust continuously using identity and device context and require step-up verification before granting access
The correct answer is to re-evaluate trust continuously using identity and device context and require step-up verification before granting access. Zero trust operates on continuous, context-based authorization rather than one-time login or network location, so a riskier request triggers additional checks. Granting access based on a prior login or internal origin violates 'never trust, always verify,' and permanently locking the account is an excessive, non-adaptive response.
A SaaS-heavy organization wants to apply zero trust principles specifically to brokered access of internal web applications, while still relying on its existing SD-WAN for branch connectivity. Which component would the architect deploy to deliver per-application access without exposing the network?
- A traditional remote-access VPN granting full subnet access
- Zero trust network access (ZTNA)
- A flat Layer 2 bridge between sites
- An open reverse proxy with no authentication
Correct answer: Zero trust network access (ZTNA)
The correct answer is zero trust network access (ZTNA). ZTNA brokers access to specific applications based on verified identity and context, keeping the broader network hidden, which aligns with zero trust principles and complements SD-WAN connectivity. A full-subnet VPN grants excessive implicit trust, an unauthenticated reverse proxy is insecure, and a flat Layer 2 bridge removes isolation entirely.
An enterprise is pursuing deperimeterization, moving away from the assumption that the internal network is inherently safe. Which combination of design choices best supports this strategy?
- Identity-centric access controls, microsegmentation, and SASE-delivered security services
- Reliance on a single hardened perimeter firewall as the only control
- Disabling logging on internal segments to reduce overhead
- Implicit trust for any device physically connected to the LAN
Correct answer: Identity-centric access controls, microsegmentation, and SASE-delivered security services
The correct answer is identity-centric access controls, microsegmentation, and SASE-delivered security services. Deperimeterization assumes no implicit trust based on network location, so controls shift to identity, granular workload segmentation, and cloud-delivered security that follows users and data. Relying on a single perimeter firewall, trusting any LAN-connected device, or disabling internal logging all reinforce the outdated perimeter-trust model deperimeterization seeks to eliminate.
During threat modeling of a containerized application, the team builds a tree whose root node is the attacker goal 'exfiltrate cardholder data' and whose branches enumerate the methods to reach that goal. Which threat modeling technique is in use?
- Chaos engineering
- Attack tree analysis
- Static application security testing (SAST)
- Quantitative risk register scoring
Correct answer: Attack tree analysis
The correct answer is attack tree analysis. An attack tree is a hierarchical diagram in which the root represents an attacker's goal and the branches and leaves represent the alternative paths or methods to achieve it, helping architects reason about and prioritize defenses. SAST scans source code, chaos engineering tests resilience by injecting failures, and a risk register tracks risks numerically, so none describe this goal-oriented tree structure.
A SaaS customer experiences a breach after misconfiguring sharing permissions in the application, exposing customer records. Under the shared responsibility model for SaaS, who was responsible for that misconfiguration?
- The provider, because in SaaS the customer has zero security responsibilities
- The provider, because the provider manages all application-layer access policies for every tenant
- The customer, because data classification, access configuration, and user permissions remain the customer's responsibility even in SaaS
- Neither party, because SaaS configurations are governed solely by regulators
Correct answer: The customer, because data classification, access configuration, and user permissions remain the customer's responsibility even in SaaS
The correct answer is the customer, because data classification, access configuration, and user permissions remain the customer's responsibility even in SaaS. While the SaaS provider secures the infrastructure and application stack, customers always retain responsibility for their own data, identity, and access settings such as sharing permissions. The other options wrongly assert the customer has no responsibility or that the provider configures each tenant's access policies.
A payment platform must survive the total loss of an entire cloud region without data loss and with minimal downtime. An architect designs the system to run identical active stacks in two geographically separate regions, replicating the database synchronously and balancing live traffic across both. Which resilience design pattern is being implemented?
- Active-active multi-region deployment
- Pilot light architecture with a scaled-down replica region
- Cold standby with nightly backups restored on demand
- A single highly available cluster within one availability zone
Correct answer: Active-active multi-region deployment
The correct answer is an active-active multi-region deployment. In an active-active design, full production stacks run simultaneously in multiple regions and share live traffic, so the loss of one region is absorbed by the other with near-zero recovery time and, with synchronous replication, no data loss. A cold standby, single-zone cluster, and pilot light each leave a recovery gap or fail to survive a full-region loss, so they do not meet the stated near-zero RTO and RPO goals.
An architect is designing a data protection scheme for a database holding millions of credit card numbers. The requirement is to remove sensitive values from the application environment entirely so that compromise of the application database exposes only non-sensitive surrogate values, while a separately secured vault maps surrogates back to the real data. Which technique best satisfies this design goal?
- Transport Layer Security between client and server
- Role-based access control on the application tier
- Format-preserving hashing of the full record
- Tokenization
Correct answer: Tokenization
The correct answer is tokenization. Tokenization replaces sensitive data with non-sensitive surrogate tokens and stores the mapping in a separate, tightly controlled token vault, so the application data store never holds the real values and a breach of it yields only meaningless tokens. Hashing is one-way and cannot restore the original card number for processing, TLS only protects data in transit, and RBAC governs access but still leaves real data resident in the database.
A global enterprise is designing its identity architecture so that employees, partners, and customers authenticate against their own home identity providers, while a central broker establishes trust and translates assertions between them. The goal is to avoid maintaining a separate credential store for every external organization. Which architectural model should be adopted?
- A standalone local directory replicated to each partner
- Per-application username and password databases
- Federated identity with an identity broker
- A flat shared service account used by all partners
Correct answer: Federated identity with an identity broker
The correct answer is federated identity with an identity broker. A federated model lets each party authenticate against its own trusted identity provider while a broker establishes the trust relationships and translates assertions, eliminating the need to store and manage external credentials locally. Replicating a local directory, maintaining per-application credential stores, or sharing a single service account each increases credential sprawl and undermines accountability, the opposite of what federation is designed to achieve.
While designing a multi-account cloud environment, an architect wants a standardized, automated baseline that pre-provisions account structure, centralized logging, network topology, guardrails, and identity boundaries before any workload is deployed. Which cloud architecture construct provides this repeatable, governed foundation?
- An individual security group rule set
- A single shared virtual private cloud for all teams
- An ad hoc account created manually per project
- A cloud landing zone
Correct answer: A cloud landing zone
The correct answer is a cloud landing zone. A landing zone is a pre-architected, automated baseline that establishes account or subscription structure, centralized logging, network design, identity boundaries, and policy guardrails so new workloads inherit secure defaults from day one. A security group is only a host-level firewall, a single shared VPC removes isolation between teams, and manually created accounts produce inconsistent, ungoverned environments that a landing zone is specifically designed to prevent.
An architect deploying a customer-facing machine learning model is concerned that an attacker could repeatedly query the model and reconstruct sensitive attributes about individuals in the training data. To design the model-serving architecture against this model inversion and membership inference risk, which control is most appropriate to build in?
- Differential privacy combined with query rate limiting and output perturbation
- Adding a CAPTCHA only to the website login page
- Increasing the size of the training dataset without other changes
- Re-encrypting the model weights at rest with a new key daily
Correct answer: Differential privacy combined with query rate limiting and output perturbation
The correct answer is differential privacy combined with query rate limiting and output perturbation. Designing the serving layer to add calibrated noise (differential privacy), throttle queries, and limit confidence exposure directly counters inversion and membership inference, which rely on many precise queries to reconstruct training data. Re-encrypting weights protects the model file but not its query interface, a login CAPTCHA does not constrain API inference, and simply enlarging the dataset does not prevent reconstruction attacks.
A critical industrial control network must continue operating safely even if its central authentication server becomes unreachable. The architect must decide how the design behaves when a security control component fails. Which design decision aligns with a resilient architecture for this safety-critical environment, assuming continued physical-process operation is paramount?
- Relying on a single authentication server with no failure handling defined
- Designing every control to fail closed so the entire process halts the moment authentication is unavailable
- Removing authentication entirely to avoid any failure dependency
- Designing controls to fail open for the safety-critical process while alerting and logging the degraded state
Correct answer: Designing controls to fail open for the safety-critical process while alerting and logging the degraded state
The correct answer is designing controls to fail open for the safety-critical process while alerting and logging the degraded state. In safety-critical operational technology, halting a physical process can be more dangerous than a temporary loss of access control, so resilient design favors continued safe operation with compensating monitoring when an upstream control fails. Failing every control closed could cause unsafe shutdowns, removing authentication abandons security entirely, and a single server with no failure handling ignores resilience design altogether.
An enterprise wants to design its data architecture so that protection controls, retention rules, and access restrictions are applied automatically based on how sensitive each data set is, rather than being decided ad hoc per system. What foundational architectural element must be established first to drive these automated controls?
- A vendor-supplied default encryption setting left unchanged
- A single perimeter firewall in front of all data stores
- A data classification scheme tied to handling and protection requirements
- A nightly full backup job for every server
Correct answer: A data classification scheme tied to handling and protection requirements
The correct answer is a data classification scheme tied to handling and protection requirements. Classification labels data by sensitivity and maps each tier to required controls such as encryption, retention, and access, giving the architecture a consistent basis for applying protection automatically across systems. Backups address availability but not differentiated handling, a perimeter firewall does not distinguish data sensitivity, and accepting default encryption settings provides no structured, sensitivity-driven control model.
A SaaS provider is architecting a multi-tenant platform and must decide how to keep each customer's data isolated. Compliance requires that a flaw in one tenant's queries can never expose another tenant's records, while the company still wants to share application infrastructure for efficiency. Which tenancy design best balances isolation with shared infrastructure?
- Storing all tenant data in one document with no access boundaries
- Giving every tenant the application source code to self-host
- A shared application tier with a separate logical database or schema and enforced tenant identifiers per tenant
- A single shared table for all tenants with no tenant identifier column
Correct answer: A shared application tier with a separate logical database or schema and enforced tenant identifiers per tenant
The correct answer is a shared application tier with a separate logical database or schema and enforced tenant identifiers per tenant. This design keeps tenant data logically isolated so a query flaw cannot cross boundaries, while still sharing the application layer for cost efficiency, a standard secure multi-tenant pattern. A single shared table without tenant identifiers invites cross-tenant leakage, distributing source code does not address data isolation, and storing all data together with no boundaries directly violates the isolation requirement.
An enterprise security team wants to ingest firewall, endpoint, and authentication logs into a central platform that correlates events across sources and generates real-time alerts when patterns indicate a possible breach. Which technology directly answers the need for centralized log aggregation and correlation?
- A hardware security module for key storage
- A web application firewall placed at the perimeter
- A forward proxy with content filtering
- A security information and event management (SIEM) platform
Correct answer: A security information and event management (SIEM) platform
A SIEM is the correct answer. A security information and event management platform collects, normalizes, and correlates log and event data from many sources, then applies rules to generate real-time alerts and supports investigation and reporting. A WAF, HSM, and proxy each address narrower functions and do not perform enterprise-wide log correlation, so they do not satisfy the requirement.
During reconnaissance for a red-team engagement, an analyst gathers employee names from social media, subdomains from certificate transparency logs, and exposed documents indexed by search engines, using only publicly available data. Which discipline best describes this collection activity?
- Active vulnerability scanning
- Open-source intelligence (OSINT)
- Signals intelligence interception
- Endpoint memory forensics
Correct answer: Open-source intelligence (OSINT)
OSINT is the correct answer. Open-source intelligence is the collection and analysis of information from publicly available sources such as social media, public records, certificate transparency logs, and search-engine results, without intrusive access to target systems. Active scanning and memory forensics interact directly with systems, and signals interception captures private communications, so none describe purely public collection.
A security operations manager wants to reduce analyst fatigue by automatically enriching alerts, running predefined playbooks, and coordinating actions across the EDR, firewall, and ticketing system without manual handoffs. Which platform is designed for this orchestration and automated response?
- An intrusion detection system (IDS)
- A configuration management database (CMDB)
- A network access control (NAC) appliance
- Security orchestration, automation, and response (SOAR)
Correct answer: Security orchestration, automation, and response (SOAR)
SOAR is the correct answer. Security orchestration, automation, and response platforms integrate disparate tools, automate enrichment and remediation through playbooks, and coordinate response workflows to cut manual effort and response time. An IDS only detects, a CMDB inventories assets, and NAC governs admission, so none provide cross-tool orchestrated response.
A SOC lead is comparing two platforms: one aggregates and correlates logs to surface alerts, and another consumes those alerts to automate playbooks and coordinate response across tools. Which statement best distinguishes a SIEM from a SOAR platform?
- A SIEM blocks malicious traffic inline, while SOAR only generates passive alerts
- A SIEM is a hardware appliance, while SOAR is always a physical device
- A SIEM focuses on detection through log aggregation and correlation, while SOAR focuses on automating and orchestrating the response to those detections
- A SIEM encrypts data at rest, while SOAR manages digital certificates
Correct answer: A SIEM focuses on detection through log aggregation and correlation, while SOAR focuses on automating and orchestrating the response to those detections
The first option is correct. A SIEM concentrates on detection by aggregating, normalizing, and correlating event data to produce alerts, whereas SOAR concentrates on response by automating playbooks and orchestrating actions across security tools. They are complementary: SIEM commonly feeds alerts into SOAR. The other choices misstate their inline, cryptographic, or hardware characteristics.
To study attacker techniques and detect intruders early, a security engineer deploys an intentionally vulnerable, isolated, and heavily monitored decoy server that holds no production data and exists only to be probed. What is this control called?
- A jump server
- A bastion proxy
- A load balancer
- A honeypot
Correct answer: A honeypot
A honeypot is the correct answer. In cybersecurity a honeypot is a decoy system deliberately exposed and monitored to attract attackers, generate high-fidelity alerts, and reveal their tools and techniques, since any interaction with it is inherently suspicious. A jump server and bastion proxy provide controlled administrative access, and a load balancer distributes traffic, so none serve as deception decoys.
An analyst forms a hypothesis that an adversary is already inside the network and proactively searches log and endpoint data for evidence of lateral movement, rather than waiting for an automated alert. Which security operations activity is being performed?
- Threat hunting
- Patch management
- License auditing
- Capacity planning
Correct answer: Threat hunting
Threat hunting is the correct answer. Threat hunting is a proactive, hypothesis-driven search through telemetry to find adversaries and stealthy threats that have evaded automated detections, often guided by known tactics and behaviors. Patch management, capacity planning, and license auditing are operational tasks unrelated to actively pursuing undetected intruders.
A bank wants to detect compromised accounts by flagging when a user suddenly logs in at an unusual hour from a new location and accesses systems they have never touched, based on deviations from each account's normal baseline. Which capability provides this behavior-based detection?
- A reverse proxy
- User and entity behavior analytics (UEBA)
- Full-disk encryption
- Static application security testing
Correct answer: User and entity behavior analytics (UEBA)
UEBA is the correct answer. User and entity behavior analytics builds baselines of normal activity for users and entities, then uses analytics to flag anomalous behavior such as atypical login times, locations, or access patterns that may indicate compromised credentials or insider threats. Disk encryption, static code testing, and reverse proxies do not model behavioral baselines.
A CISO is concerned that internet-facing assets such as forgotten subdomains, exposed cloud storage, and unpatched edge devices are being discovered by attackers before the organization knows they exist. Which practice continuously discovers, inventories, and monitors externally exposed assets to reduce this exposure?
- Privileged access management
- Attack surface management
- Secure boot enforcement
- Data loss prevention
Correct answer: Attack surface management
Attack surface management is the correct answer. Attack surface management continuously discovers, inventories, and monitors an organization's externally exposed assets and their vulnerabilities, shrinking the openings an attacker can find and exploit. DLP protects data movement, PAM controls elevated accounts, and secure boot validates boot integrity, so none address external exposure discovery.
While investigating an incident, an analyst distinguishes between artifacts left behind, such as a malicious file hash and a known bad IP address, and behaviors observed in progress, such as credential dumping followed by lateral movement. Which statement correctly contrasts indicators of compromise (IOCs) with indicators of attack (IOAs)?
- IOCs are forensic artifacts of a past or present breach, while IOAs describe the attacker's behavior and intent as an attack unfolds
- IOCs detect behavior in real time, while IOAs are only useful after the fact
- IOCs and IOAs are identical terms for the same forensic hash values
- IOAs can only be expressed as file hashes, while IOCs describe tactics
Correct answer: IOCs are forensic artifacts of a past or present breach, while IOAs describe the attacker's behavior and intent as an attack unfolds
The first option is correct. IOCs are evidence-based artifacts, such as malicious hashes, IPs, or domains, that indicate a system has been or is compromised, making them reactive and useful for forensics. IOAs focus on the attacker's behavior and intent, such as privilege escalation or lateral movement, enabling proactive, behavior-based detection of even novel attacks. The other choices reverse or conflate these roles.
A threat intelligence team needs a central system to aggregate feeds, deduplicate and enrich indicators, score their relevance, and push curated intelligence to the SIEM and firewalls automatically. Which type of platform is purpose-built for managing this intelligence lifecycle?
- A virtual desktop infrastructure broker
- A continuous integration server
- A distributed denial-of-service scrubbing center
- A threat intelligence platform (TIP)
Correct answer: A threat intelligence platform (TIP)
A threat intelligence platform is the correct answer. A TIP centralizes the collection, normalization, deduplication, enrichment, scoring, and distribution of threat intelligence from multiple feeds, then operationalizes it by feeding indicators to security controls like SIEMs and firewalls. CI servers, VDI brokers, and DDoS scrubbing centers serve unrelated build, desktop, and traffic-filtering functions.
A SOC analyst receives a suspicious email attachment and detonates it in an isolated, instrumented environment to observe what files it creates, what registry keys it modifies, and what network connections it attempts. Which security operations discipline does this represent?
- Malware analysis
- Certificate enrollment
- Change advisory review
- Capacity planning
Correct answer: Malware analysis
Malware analysis is the correct answer. Malware analysis is the study of malicious software to understand its behavior, capabilities, and indicators; detonating a sample in an instrumented sandbox to observe file, registry, and network activity is dynamic (behavioral) analysis. Capacity planning, certificate enrollment, and change review are operational processes unrelated to dissecting malicious code.
Two organizations agree to share machine-readable threat intelligence. They standardize how indicators and relationships are described and how that data is securely exchanged over HTTPS between their servers. Which pairing correctly maps these two standards?
- STIX is a hashing algorithm, and TAXII is a key exchange method
- STIX defines the structured format of the intelligence, and TAXII defines the transport protocol used to exchange it
- STIX defines the transport protocol, and TAXII defines the data format
- Both STIX and TAXII are encryption ciphers for data at rest
Correct answer: STIX defines the structured format of the intelligence, and TAXII defines the transport protocol used to exchange it
The first option is correct. STIX (Structured Threat Information eXpression) is the standardized, JSON-based language for describing threat intelligence and its relationships, while TAXII (Trusted Automated eXchange of Intelligence Information) is the application-layer protocol for securely transporting that intelligence over HTTPS. The two are independent standards, so the choices that swap their roles or call them ciphers or hashes are incorrect.
A detection engineer writes one rule in YARA to identify a malware family by binary and string patterns in files, and another rule in Sigma to flag a suspicious PowerShell command sequence across log sources. Which statement best describes the typical scope of each rule format?
- Sigma matches binary file signatures, while YARA parses log files
- YARA is only for network packet capture, while Sigma is only for disk encryption
- YARA targets pattern matching in files and memory, while Sigma describes generic detections for log events that convert to SIEM queries
- Both YARA and Sigma are exclusively used to write firewall ACLs
Correct answer: YARA targets pattern matching in files and memory, while Sigma describes generic detections for log events that convert to SIEM queries
The first option is correct. YARA is a rule format for matching textual and binary patterns to classify and detect malware in files and memory, while Sigma is a generic, platform-agnostic format for describing log-based detections that converters translate into specific SIEM query languages. The remaining choices swap their roles or assign them to packet capture, encryption, or firewall rules, which is inaccurate.
A SecurityX architect is documenting recovery targets for a payment-processing application as part of a continuity plan. The business states it can tolerate losing at most 15 minutes of transaction data, and the service must be fully restored within 2 hours of an outage. Which pairing correctly maps these statements to recovery objectives?
- The 15-minute data-loss limit is the RPO and the 2-hour restoration target is the RTO
- Both values are RPOs because they both relate to a single application
- Both values are RTOs because they both measure time
- The 15-minute data-loss limit is the RTO and the 2-hour restoration target is the RPO
Correct answer: The 15-minute data-loss limit is the RPO and the 2-hour restoration target is the RTO
The correct answer is that the 15-minute data-loss limit is the RPO and the 2-hour restoration target is the RTO. The Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured backward from the moment of failure, so the 15-minute tolerance is an RPO that dictates backup frequency. The Recovery Time Objective (RTO) is how quickly the service must be restored after a disruption, making the 2-hour target the RTO; confusing the two leads to misaligned backup and failover investments.
A SecurityX lead is performing a quantitative risk assessment on a database server valued at 500,000 dollars. A ransomware event is expected to destroy 40 percent of the asset's value each time it occurs, and historical data suggests such an event happens about twice per year. Which value represents the Annualized Loss Expectancy (ALE) the lead should report?
- 250,000 dollars
- 400,000 dollars
- 200,000 dollars
- 100,000 dollars
Correct answer: 400,000 dollars
The correct answer is 400,000 dollars. Single Loss Expectancy (SLE) equals Asset Value times Exposure Factor, so 500,000 times 0.40 equals 200,000 dollars per occurrence. Annualized Loss Expectancy equals SLE times the Annualized Rate of Occurrence (ARO), so 200,000 times 2 equals 400,000 dollars. The 200,000 figure is only the SLE for a single event, not the annualized total.
After a quantitative risk assessment, a multinational firm implements encryption, network segmentation, and stricter access controls to reduce a critical risk. Senior leadership asks the security team to characterize what remains after these controls are applied so they can formally accept it. Which term best describes the risk that remains after controls are implemented?
- Transferred risk
- Residual risk
- Total risk
- Inherent risk
Correct answer: Residual risk
The correct answer is residual risk. Residual risk is the amount of risk that remains after security controls and mitigations have been applied, and it is what management formally accepts, transfers, or further treats. Inherent risk is the risk present before any controls are applied, so it does not describe the post-control state that leadership is being asked to accept.
A CISO is choosing a governance reference that uses five core functions to organize cybersecurity activities and help the enterprise communicate risk posture to non-technical executives. The framework's current version added a sixth function focused on organizational governance. Which framework, and which functions, is the CISO describing?
- The NIST Cybersecurity Framework, using Govern, Identify, Protect, Detect, Respond, and Recover
- PCI DSS, using its twelve prescriptive requirements
- COBIT, using its governance and management objectives
- ISO/IEC 27001, using a Statement of Applicability and Annex A controls
Correct answer: The NIST Cybersecurity Framework, using Govern, Identify, Protect, Detect, Respond, and Recover
The correct answer is the NIST Cybersecurity Framework. The NIST CSF organizes cybersecurity outcomes around core functions, and version 2.0 (released 2024) added Govern to the original five of Identify, Protect, Detect, Respond, and Recover. ISO/IEC 27001 is a certifiable management-system standard built around an ISMS and Annex A controls rather than these named functions, so it does not match the description.
During a board meeting, a SecurityX governance lead is asked to explain the difference between the organization's risk appetite and its risk tolerance so the two terms are used consistently in policy. Which statement most accurately distinguishes them?
- Risk appetite applies only to financial risk, while risk tolerance applies only to cybersecurity risk
- Risk appetite is the broad amount of risk an organization is willing to accept to meet objectives, while risk tolerance is the acceptable level of variation around a specific risk
- Risk appetite and risk tolerance are identical and can be used interchangeably in governance documents
- Risk appetite is the acceptable variation around a specific risk objective, while risk tolerance is the broad amount of risk the organization will pursue overall
Correct answer: Risk appetite is the broad amount of risk an organization is willing to accept to meet objectives, while risk tolerance is the acceptable level of variation around a specific risk
The correct answer is that risk appetite is the broad amount of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance is the acceptable level of variation around a specific risk or objective. Appetite is the high-level, strategic statement set by leadership, whereas tolerance is the more granular, measurable threshold for a particular risk. They are not interchangeable, and neither is limited to a single risk category such as financial or cyber.
A healthcare organization wants to validate its incident response plan by gathering stakeholders in a conference room to walk through a simulated ransomware scenario through discussion only, with no production systems touched and no actual technical actions performed. Which type of exercise is being described?
- A full-interruption (full-scale) test
- A tabletop exercise
- A parallel recovery test
- A penetration test
Correct answer: A tabletop exercise
The correct answer is a tabletop exercise. A tabletop exercise is a discussion-based session where stakeholders talk through their roles and decisions for a simulated scenario without activating or disrupting any production systems. A full-interruption test actually fails over live systems, and a penetration test attempts real exploitation, so neither matches a purely discussion-based walkthrough.

To find us again, just search “Career Employer SecurityX (CASP+)”

By Career EmployerUpdated Jun 7, 2026

SecurityX (CASP+) Question of the DayNew daily

1 of 190+ free questions — a new one every day

Which of the following best describes a Zero Trust security model in the context of Security Architecture?

Pick an answer to see the explanation

Click Start Test above to launch a full-length SecurityX (CASP+) practice test weighted exactly like the real CAS-005 exam, or drill a single domain — Security Engineering, Security Architecture, Security Operations, or Governance, Risk, and Compliance. Every question includes a clear explanation so you learn the reasoning, not just the answer.

SecurityX is CompTIA’s advanced-level cybersecurity certification formerly known as CASP+ (CompTIA Advanced Security Practitioner).

On December 17, 2024, CompTIA rebranded CASP+ as SecurityX and launched the current exam, CAS-005; many employers still use the name CASP+, so it’s commonly written as SecurityX (CASP+).

^[3] These free practice questions mirror the official CAS-005 objectives so you practice the way the real exam is built.^[2] To round out your prep, pair these with our free study guide, flashcards.

SecurityX (CASP+) is one of the 14 CompTIA certifications — explore all our CompTIA practice tests to compare and prep across the whole family.

SecurityX (CASP+) at a Glance

SecurityX / CASP+ (CAS-005) at a glance
Detail	SecurityX / CASP+ (CAS-005)
Certifying body	CompTIA
Exam code	CAS-005 (SecurityX, formerly CASP+)
Questions	Maximum of 90 (multiple choice + performance-based)
Time limit	165 minutes
Passing standard	Pass/fail only (no scaled score reported)
Exam cost	About USD $509 (subject to change; verify with CompTIA)
Recommended experience	10+ years IT, including 5+ years hands-on security
Certification validity	3 years; renew via continuing education (CEU)

What Is on the SecurityX (CASP+) Exam?

The SecurityX (CASP+) CAS-005 exam covers four domains: Security Engineering (31%), Security Architecture (27%), Security Operations (22%), and Governance, Risk, and Compliance (20%).^[2]

Security Engineering is the largest section — covering endpoint, network, and identity controls plus cryptographic and emerging-technology implementation — followed by Security Architecture, which designs resilient enterprise, cloud, and zero-trust architectures. Our full practice test is weighted to match:

SecurityX (CASP+) CAS-005 weighting by domain

Security Engineering31% · ≈28 Qs

Security Architecture27% · ≈24 Qs

Security Operations22% · ≈20 Qs

Governance, Risk, and Compliance20% · ≈18 Qs

Practice Questions by Domain

Use Start Test for a full weighted CAS-005 simulation, or open the hub and pick a single domain to drill your weak area. After each full exam, your results show a per-domain breakdown so you know exactly where to focus — most candidates need the most reps on the deeply technical Engineering and Architecture content.

What Are the Requirements to Take SecurityX (CASP+)?

SecurityX (CASP+) has no formal prerequisites, but CompTIA recommends a minimum of ten years of general IT experience, including at least five years of hands-on security experience, before attempting the exam.

It is a master-level certification intended for experienced practitioners.

^[1] CompTIA also suggests holding or having the equivalent knowledge of Network+, Security+, CySA+, Cloud+, and PenTest+. Anyone may register and sit CAS-005, but the content assumes senior-level expertise.

How Do You Register for SecurityX (CASP+)?

You register for SecurityX (CASP+) CAS-005 through CompTIA’s store or its testing partner, Pearson VUE.

Purchase an exam voucher (the published price is approximately USD $509, though pricing and discounts vary, so verify the current cost), then schedule the exam at a Pearson VUE testing center or via online proctoring.

^[1] If you hold an unexpired CASP+ (CAS-004) voucher, it can be used for the SecurityX (CAS-005) exam. Review CompTIA’s current candidate policies and the CAS-005 objectives PDF before scheduling.

What Is the Passing Score for SecurityX (CASP+)?

The SecurityX (CASP+) CAS-005 exam is scored on a pass/fail basis with no numeric or scaled score reported — CompTIA simply tells you whether you passed, so there is no published cut score to target.^[1] This differs from many other CompTIA exams (for example, Security+ uses a 100–900 scale).

The exam mixes multiple-choice questions with performance-based items that require demonstrating skills in simulated environments, and both contribute to the pass/fail outcome.

How Hard Is SecurityX (CASP+)? (Pass Rate)

CompTIA does not publish official first-time pass-rate statistics for SecurityX (CASP+).^[1] As a master-level, performance-based exam aimed at senior security professionals, it is widely regarded as one of CompTIA’s most difficult certifications, and candidates who lack deep hands-on architecture, engineering, and operations experience tend to struggle. Most who pass report extensive real-world experience combined with focused study of the CAS-005 objectives.

Pass/Fail

Scoring

no scaled score

165 min

Time limit

≤90 questions

31%

Security Engineering

largest domain

The takeaway: drill until you’re consistently passing full-length practice — especially the technical Engineering and Architecture domains — before you book your exam date.

What to Expect on Exam Day

Arrive at your Pearson VUE test center at least 15 minutes early to check in — bring a valid, unexpired government-issued photo ID whose name matches your CompTIA registration.^[1] You’ll store phones and personal items in a locker; no notes are allowed.

A short tutorial precedes the exam, then you have 165 minutes to answer up to 90 multiple-choice and performance-based questions. The performance-based items ask you to apply skills in simulated enterprise scenarios — they take longer, so pace yourself and don’t get stuck.

If you test via online proctoring, expect a similar room scan and ID check. CompTIA delivers a pass or fail result immediately. Having simulated the full timing with practice tests makes that long clock feel routine.

How to Use This SecurityX (CASP+) Practice Test

Recreate exam conditions. Take the full test timed, with no notes.^[1]
Diagnose, then drill. Use a full CAS-005 simulation to find weak domains, then drill them.
Think in scenarios. Questions ask for the best risk-based decision, not simple recall.
Practice the performance-based style. The hands-on simulations are where time runs out.
Learn the why. Read every explanation — understanding beats memorizing.

Why Get SecurityX (CASP+) Certified?

SecurityX (CASP+) validates the critical thinking and judgment of senior security architects and engineers, and unlike management-focused credentials it is vendor-neutral and hands-on, with performance-based questions that test practical skill.^[1] These free SecurityX practice tests are the most efficient way to get there.

Conclusion

Passing CAS-005 comes down to applying advanced security engineering, architecture, operations, and governance judgment in complex scenarios. Use this free SecurityX (CASP+) practice test to find your weak domains, drill them to mastery, and reinforce them with our study guide, flashcards so you walk in confident on test day.

SecurityX (CASP+) Practice Test FAQ

Yes. CompTIA rebranded CASP+ (CompTIA Advanced Security Practitioner) as SecurityX on December 17, 2024, when it launched the current CAS-005 exam as part of the CompTIA Xpert series. The credential is the same advanced-level certification; many employers still refer to it as CASP+, so it is often written as SecurityX (CASP+). Existing CASP+ holders automatically received the SecurityX brand.

References

1.CompTIA. “SecurityX Certification (CAS-005).” CompTIA, 2026. ↑
2.CompTIA. “What Is on the CompTIA SecurityX Exam? (CAS-005 Objectives).” CompTIA Blog. ↑
3.CompTIA. “SecurityX Certification (CAS-005) — CASP+ Rebrand.” CompTIA. ↑

Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

All Posts

Career Employer’s Editorial Process

Here at Career Employer, we focus a lot on providing factually accurate information that is always up to date. We strive to provide correct information using strict editorial processes, article editing, and fact-checking for all of the information found on our website. We only utilize trustworthy and relevant resources. To find out more, make sure to read our full editorial process page here.